Windows 2008 R2 Certification Authority installation guide
This step-by-step guide explains how to install and configure public key infrastructure, based on:
- Windows 2008 R2 Server core – offline Root CA
- Windows 2008 R2 domain controller
- Windows 2008 R2 enterprise edition – Subordinate Enterprise CA server
Offline Root CA – OS installation phase
- Boot the server using Windows 2008 R2 bootable DVD.
- Specify the product ID -> click Next.
- From the installation option, choose “Windows Server 2008 R2 (Server Core Installation)” -> click Next.
- Accept the license agreement -> click Next.
- Choose “Custom (Advanced)” installation type -> specify the hard drive to install the operating system -> click Next.
- Allow the installation phase to continue and restart the server automatically.
- To login to the server for the first time, press CTRL+ALT+DELETE
- Choose “Administrator” account -> click OK to replace the account password -> specify complex password and confirm it -> press Enter -> Press OK.
- From the command prompt window, run the command bellow:
sconfig.cmd
- Press “2” to replace the computer name -> specify new computer name -> click “Yes” to restart the server.
- To login to the server, press CTRL+ALT+DELETE -> specify the “Administrator” account credentials.
- From the command prompt window, run the command bellow:
sconfig.cmd
- Press “5” to configure “Windows Update Settings” -> select “A” for automatic -> click OK.
- Press “6” to download and install Windows Updates -> choose “A” to search for all updates -> Choose “A” to download and install all updates -> click “Yes” to restart the server.
- To login to the server, press CTRL+ALT+DELETE -> specify the “Administrator” account credentials.
- From the command prompt window, run the command bellow:
sconfig.cmd
- In-case you need to use RDP to access and manage the server, press “7” to enable “Remote Desktop” -> choose “E” to enable -> choose either “1” or “2” according to your client settings -> Press OK.
- Press “8” to configure “Network settings” -> select the network adapter by its Index number -> press “1” to configure the IP settings -> choose “S” for static IP address -> specify the IP address, subnet mask and default gateway -> press “2” to configure the DNS servers -> click OK -> press “4” to return to the main menu.
- Press “9” to configure “Date and Time” -> choose the correct “date/time” and “time zone” -> click OK
- Press “11” to restart the server to make sure all settings take effect -> click “Yes” to restart the server.
Offline Root CA – Certificate Authority server installation phase
- To login to the server, press CTRL+ALT+DELETE -> specify the “Administrator” account credentials.
- Install Certificate services:
start /w ocsetup.exe CertificateServices /norestart /quiet
- To check that the installation completed, run the command:
oclist find /i "CertificateServices"
- Download the file “setupca.vbs” from:
http://blogs.technet.com/b/pki/archive/2009/09/18/automated-ca-installs-using-vb-script-on-windows-server-2008-and-2008r2.aspx
To:
C:\Windows\system32
- Run the command bellow to configure the Root CA:
Cscript /nologo C:\Windows\System32\setupca.vbs /is /sn
< ca_server_name> /sk 4096 /sp "RSA#Microsoft Software Key Storage Provider" /sa SHA256 - In-order to verify that the installation completed successfully, open using Notepad, the file “_SetupCA.log” located in the current running directory, and make sure the last line is:
Install complete! Passed
- Run the command bellow to enable remote management of the Root CA:
netsh advfirewall firewall set rule group="Remote Service Management" new enable=yes
- Run the command bellow to stop the CertSvc service:
Net stop CertSvc
- Run the command bellow to change new certificate validity period time:
reg add HKLM\SYSTEM\CurrentControlSet\services\CertSvc\Configuration\
Note: The command above should be written in one line.< rootca_netbios_name> /v ValidityPeriodUnits /t REG_DWORD /d 5 /f - Run the command bellow to start the CertSvc service:
Net start CertSvc
Enterprise Subordinate CA – OS installation phase
Pre-requirements:
- Active Directory (Forest functional level – Windows 2008 R2)
- Add “A” record for the Root CA to the Active Directory DNS.
- Boot the server using Windows 2008 R2 Enterprise Edition bootable DVD.
- Specify the product ID -> click Next.
- From the installation option, choose “Windows Server 2008 R2 Enterprise Edition Full installation” -> click Next.
- Accept the license agreement -> click Next.
- Choose “Custom (Advanced)” installation type -> specify the hard drive to install the operating system -> click Next.
- Allow the installation phase to continue and restart the server automatically.
- To login to the server for the first time, press CTRL+ALT+DELETE
- Choose “Administrator” account -> click OK to replace the account password -> specify complex password and confirm it -> press Enter -> Press OK.
- From the “Initial Configuration Tasks” window, configure the following settings:
- Set time zone
- Configure networking – specify static IP address, netmask, gateway, DNS
- Provide computer name and domain – add the server to the domain
- Enable Remote Desktop
- In-order to be able to remotely manage the Root CA, run the command bellow:
cmdkey /add:
< RootCA_Hostname> /user:Administrator /pass:< RootCA_Admin_Password>
Enterprise Subordinate CA – Certificate Authority server installation phase
Pre-requirements:
- DNS CNAME record named “wwwca” for the Enterprise Subordinate CA.
- To login to the server, press CTRL+ALT+DELETE -> specify the credentials of account member of “Schema Admins”, “Enterprise Admins” and “Domain Admins”.
- Start -> Administrative Tools -> Server Manager.
- From the left pane, right click on Roles -> Add Roles -> Next -> select “Web Server (IIS)” -> click Next twice -> select the following role services:
- Web Server
- Common HTTP Features
- Static Content
- Default Document
- Directory Browsing
- HTTP Errors
- HTTP Redirection
- Application Development
- .NET Extensibility
- ASP
- ISAPI Extensions
- Health and Diagnostics
- HTTP Logging
- Logging Tools
- Tracing
- Request Monitor
- Security
- Windows Authentication
- Client Certificate Mapping Authentication
- IIS Client Certificate Mapping Authentication
- Request Filtering
- Performance
- Static Content Compression
- Management Tools
- IIS Management Console
- IIS Management Scripts and Tools
- IIS 6 Management Compatibility
- IIS 6 Metabase Compatibility
- Click Next -> click Install -> click Close.
- From the left pane, right click on Features -> Add Features -> Next -> expand “Windows Process Activation Service” -> select “.NET Environment” and “Configuration APIs” -> select the feature “.NET Framework 3.5.1 Features” -> click Next -> click Install -> click Close.
- From the left pane, right click on Roles -> Add Roles -> Next -> select “Active Directory Certificate Services” -> click Next twice -> select the following role services:
- Certification Authority
- Certification Authority Web Enrollment
- Certificate Enrollment Policy Web Service
- Click Next.
- Configure the following settings:
- Specify Setup Type: Enterprise
- CA Type: Subordinate CA
- Private Key: Create a new private key
- Cryptography:
Cryptographic service provider (CSP): RSA#Microsoft software Key Storage Provider
Key length: 2048
Hash algorithm SHA256 - CA Name:
Common name: specify here the subordinate server NetBIOS name
Distinguished name suffix: leave the default domain settings - Certificate Request: Save a certificate to file and manually send it later
- Certificate Database: leave the default settings
- Authentication Type: Windows Integrated Authentication
- Server Authentication Certificate: Choose and assign a certificate for SSL later
- Click Next twice -> click Install -> click Close.
- Close the Server Manager.
- Start -> Administrative Tools -> Certification Authority
- From the left pane, right click on “Certification Authority (Local)” -> “Retarget Certification Authority” -> choose “Another computer” -> specify the RootCA hostname -> click Finish.
- Right click on the RootCA server name -> Properties -> -> Extensions tab -> extension type: CRL Distribution Point (CDP):
- Uncheck “Publish Delta CRLs to this location”.
- Mark the line begins with “LDAP”, and click remove.
- Mark the line begins with “HTTP”, and click remove.
- Mark the line begins with “file”, and click remove.
- Click on Add -> on the location, put:
http://wwwca/CertEnroll/< RootCA_Server_Name> .crl - Click on the line begins with “HTTP”, and make sure the only option checked is: “Include in CDP extension of issued certificates”.
- Click on the line begins with “C:\Windows”, and make sure the only option checked is: “Publish CRLs to this location”
- Extensions tab -> extension type: Authority Information Access (AIA):
- Mark the line begins with “LDAP”, and click remove.
- Mark the line begins with “HTTP”, and click remove.
- Mark the line begins with “file”, and click remove.
- Click on Add -> on the location, put:
http://wwwca/CertEnroll/< RootCA_Server_Name> .crt
- Click OK and allow the CA server to restart its services.
- From the “Certification Authority” left pane, right click on “Revoked certificates”-> Properties:
- CRL publication interval: 180 days
- Make sure “Publish Delta CRLs” is not checked
- Click OK
- Right click on the CA name -> All tasks -> Stop service
- Right click on the CA name -> All tasks -> Start service
- Run the commands bellow from command line, to configure the Offline Root CA to publish in the active-directory:
certutil.exe -setreg ca\DSConfigDN "CN=Configuration,DC=mycompany,DC=com"
Note: Replace “DC=mycompany,DC=com” according to your domain name.
certutil.exe -setreg ca\DSDomainDN "DC=mycompany,DC=com" - From the “Certification Authority” left pane, right click on “Revoked certificates”-> All tasks -> Publish -> click OK.
- Close the “Certification Authority” snap-in and logoff the subordinate CA server.
- Login to a domain controller in the forest root domain, with account member of Domain Admins and Enterprise Admins.
- Copy the file bellow from the Offline Root CA server to a temporary folder on the domain controller:
C:\Windows\System32\CertSrv\CertEnroll\*.crt
- Start -> Administrative Tools -> Group Policy Management.
- From the left pane, expand the forest name -> expand Domains -> expand the relevant domain name -> right click on “Default domain policy” -> Edit.
- From the left pane, under “Computer Configuration” -> expand Policies -> expand “Windows Settings” -> expand “Security Settings” -> expand “Public Key Policies” -> right click on “Trusted Root Certification Authorities” -> Import -> click Next -> click Browse to locate the CRT file from the Root CA -> click Open -> click Next twice -> click Finish -> click OK.
- Logoff the domain controller.
- Return to the subordinate enterprise CA server.
- Start -> Administrative Tools -> Certification Authority.
- From the left pane, right click on “Certification Authority (Local)” -> “Retarget Certification Authority” -> choose “Another computer” -> specify the RootCA hostname -> click Finish.
- Right click on the RootCA server name -> All Tasks -> Submit new request -> locate the subordinate CA request file (.req) -> Open.
- Expand the RootCA server name -> right click on “Pending Requests” -> locate the subordinate CA request ID according to the date -> right click on the request -> All Tasks -> Issue.
- From the left pane, click on “Issued Certificates” -> locate the subordinate CA request ID -> right click on the request -> All Tasks -> “Export Binary Data” -> choose “Binary Certificate” -> click “Save binary data to a file” -> click OK -> specify location and the file name –
< subordinate_ca_server_name_signed_certificate> .p7b -> click Save. - Run the command bellow from command line to avoid offline CRL errors:
Certutil.exe -setreg ca\CRLFlags +CRLF_REVCHECK_IGNORE_OFFLINE
- From the left pane, right click on “Certificate Authority” -> “Retarget Certification Authority” -> choose “Local computer” -> click Finish.
- Right click on the subordinate CA server name -> All Tasks -> “Install CA Certificate” -> locate the file
< Subordinate_CA_Server_Name_Signed_Certificate> .p7b -> click Open. - Right click on the subordinate CA server name -> All Tasks -> Start Service.
- Right click on the subordinate CA server name -> Properties -> -> Extensions tab -> extension type: CRL Distribution Point (CDP):
- Mark the line begins with “HTTP” -> click Remove -> click Yes.
- Mark the line begins with “file” -> click Remove -> click Yes.
- Click on Add -> on the location, put:
http://wwwca/CertEnroll/< subordinate_CA_Server_Name> .crl - Click on the line begins with “HTTP”, and make sure the following options are checked: “Include in CRLs” and “Include in the CDP”.
- Extensions tab -> extension type: Authority Information Access (AIA):
- Mark the line begins with “HTTP” -> click Remove -> click Yes.
- Mark the line begins with “file” -> click Remove -> click Yes.
- Click on Add -> on the location, put:
http://wwwca/CertEnroll/< SubordinateCA-FQDN_Subordinate_NetBIOS_Name> .crt - Click on the line begins with “HTTP”, and make sure the following option is checked: “Include in the AIA”.
Example: http://wwwca/CertEnroll/MyCA.mydomain.com_MyCA.crt
- Click OK and allow the CA server to restart its services.
- From the “Certification Authority” left pane, right click on “Revoked certificates”-> All tasks -> Publish -> click OK.
- Close the “Certification Authority” snap-in
- Copy the files bellow from the Root CA to the subordinate CA (same location):
C:\Windows\System32\CertSrv\CertEnroll\*.crl
C:\Windows\System32\CertSrv\CertEnroll\*.crt - Logoff the subordinate CA server.
- Login to a domain controller in the forest root domain, with account member of Domain Admins and Enterprise Admins.
- Copy the file bellow from the subordinate CA server to a temporary folder on the domain controller:
C:\Windows\System32\CertSrv\CertEnroll\*.crt – copy the newest file - Start -> Administrative Tools -> Group Policy Management.
- From the left pane, expand the forest name -> expand Domains -> expand the relevant domain name -> right click on “Default domain policy” -> Edit.
- From the left pane, under “Computer Configuration” -> expand Policies -> expand “Windows Settings” -> expand “Security Settings” -> expand “Public Key Policies” -> right click on “Intermediate Certification Authorities” -> Import -> click Next -> click Browse to locate the CRT file from the subordinate CA server -> click Open -> click Next twice -> click Finish -> click OK.
- Logoff the domain controller.
Unbelieveable install guide!
This helped me more than you will ever know.
Thank you!!!!!!!!!!!!!!
Thank you so much.
Your step-by-step guide saved me from read a book of 900 pages. Easy to understand
Richard
Nice work 🙂
Friend…You have done a great job.Enterprise Subordinate CA – Certificate Authority server installation phase is more effective and valuable information.Thanks for your amazing work.
I am receiving an error when requesting a certificate. “In order to complete certificate enrollment, the web site for the CA must be configured to use HTTPS authentication.” Also, the CNAME record wwwca does not seem to work for the CRL and delta. If these instructions were followed with the exception of the CNAME being setup before hand, what implications would that hold if it was added afterwards?
Thanks
Very nice windows 7 artcle. I like it so much.Please keep update your artcle about windows 7. thanks for sharing.
I take my hat off!!! Thank you!
hello sir thankyou but i need windows system. i dont want to have server core.. how can i create .crt file in windows ?
You can install Windows 2008 R2 (full installation) and from Server Manager -> Add new feature, add the Certificate Authority server.
Once you have the management interface, you work the same.
Thank you very much!
You did a great job!
Hello,
nice tutorial. But from step 12. I got an Error:
Access denied. 0x5 (WIN32 5)
Do you have an idea?
br,
Thomas
Make sure the built-in administrator’s password on the Offline CA and administrator’s password on the subordinate are the same.
Many thanks for the post.
Out of interest . . Did you add the “Offline CA” to the domain? as it would appear to be Microsoft best practice to have this as part of a workgroup.
However if I don’t add this to the domain, step 12 on the sub setup obviously fails.
Offline CA must be outside the domain and shutdown when not in use.
As long as you keep the built-in administrator’s password the same as the administrator on the subordindate server, all the steps will work.
Thank you very much! Is there a quick or easy way to test afterward to confirm that all was complete?
point 19) to configure the Offline Root CA to publish in the active-directory:
Why must be run on offline Root CA if core server is not joined to active directory ? can i use a simple openssl ca as my offline root ca ?
I guess it can work, but I doubt if Microsoft is going to officially support this configuration.
Would not using a FQDN for your CRL and AIA distribution points be an issue for non-domain clients?
As long as all clients share the same DNS server, all clients should be able to resolve the CRL and AIA distribution points.
Your article is very good and I really appreciate its quality. I have also read a few more articles on your site and am very pleased with the quality of those articles.