Reader small image

You're reading from  Mastering Active Directory, Third Edition - Third Edition

Product typeBook
Published inNov 2021
PublisherPackt
ISBN-139781801070393
Edition3rd Edition
Concepts
Right arrow
Author (1)
Dishan Francis
Dishan Francis
author image
Dishan Francis

Dishan Francis is an IT professional with over 15 years of experience. He was a six-time Microsoft MVP in enterprise mobility before he joined Microsoft UK as a security consultant. He has maintained the RebelAdmin technology blog over the years, with lots of useful articles that focus on on-premises Active Directory services and Azure Active Directory. He has also written for other Microsoft-managed blogs such as canitpro and ITopsTalk. When it comes to managing innovative identity infrastructure solutions to improve system stability, efficiency, and security, his level of knowledge and experience places him among the very best in the field.
Read more about Dishan Francis

Right arrow

Active Directory Certificate Services

The two-man rule in security is used to secure high-valued assets and operations. As an example, many banks provide safe deposit box facilities. People can rent safe deposit boxes to store valuable assets. Most of these safe deposit boxes are designed to support a two-man rule. This means that each safe deposit box has two locks. One key to the lock is held by the bank, and another key for a second lock is issued to the customer. To open it, customers and bank agents need to use their keys at the same time. When a customer shows up at the bank, there is a process to follow to get access to safe deposit boxes. Banks will verify the customer's identity first. They will ask for a passport or driving license to verify the customer's identity. Following successful verification, the bank will assign a member of staff to go with the customer and open the box using the bank's and the customer's keys. The end goal of these layers...

PKI in action

In general, we know "encryption" is more secure and that it requires secure sockets layer (SSL) certificates. But the question is, do we really know what the role of a certificate is and how this encryption and decryption works? It is very important to know how these all work, as it makes deployment and management of PKI easy.

Symmetric keys versus asymmetric keys

There are two types of cryptographic methods used to encrypt data:

  • Symmetric keys: Symmetric methods work in exactly the same way as your door lock works. You have one key to lock or open. This method is also known as the shared secret method or private key method. Virtual private network (VPN) connections and backup software are good examples of systems that use symmetric keys to encrypt data.
  • Asymmetric keys: This method, on the other hand, uses a key pair to perform the encryption and decryption. It includes two keys: one is a public key, and the other one is a private...

SSL certificates

So far, we have talked about how asymmetric key pairs and symmetric keys work in PKI. But when we talk about PKI, it is the SSL certificates that come to mind. So, what is the role of the certificates?

I travel regularly between London and Seattle. When I reach Seattle-Tacoma International Airport, border security officers ask for my passport to verify my identity. They do not know me personally, but the passport I hold is issued by an authority that operates under international migration laws, and they certify that the person who owns the passport is "Dishan Francis." If they want to check its authenticity, they can confirm with the authority who issued my passport. Once they have confirmed my identity, they can also check the visa status to decide on my entry to the country.

Similarly, when looking at public-key cryptography, we know that a public key can be used by many applications and services. But how exactly can it be published, and how can...

AD CS components

AD CS is a collection of role services, and they can be used to design the PKI for your organization. Let's look into each of these role services and their capabilities.

The CA

CA role service is responsible for issuing, storing, managing, and revoking certificates. The PKI setup can have multiple CAs. There are two main types of CAs:

  • The root CA: The root CA is the most trusted CA in the PKI setup. A compromised root CA will compromise an entire PKI. Therefore, the security of the root CA is crucial. Best practice is to bring the root CA online only when required. By considering the security and hierarchy of the PKI, it is recommended to use the root CA only to issue certificates to subordinate CAs.
  • Subordinate CAs: In PKI, subordinate CAs are responsible for issuing, storing, managing, and revoking certificates for users, devices, or services. Once a CA receives a certificate request, it will process it and issue the certificate. A...

Planning PKI

By now, we understand what PKI is and how it works. You have also learned about AD CS components and their capabilities. The next thing is to plan the deployment of the PKI. In this section, we will look into the things we need to consider during the PKI planning process.

Internal or public CAs

AD CS is not just a role that we can install on a server and leave to run. It requires knowledge to set up and operate. It needs to be maintained like any other IT system. We also need to consider high availability. All this comes at a cost. Public CA certificates need to be purchased through a service provider. Each provider has many different types of certificates with different price ranges. It is important to evaluate these associated costs against your company's requirements. If the company is looking for a few web service certificates, there is no point in maintaining a few servers internally just for that. If a public CA can offer the same thing for $15, it...

PKI deployment models

At several points in this chapter, I have mentioned the PKI hierarchy and components such as root CAs, intermediate CAs, and issuing CAs. Based on the business and operational requirements, the PKI topology will also change. There are three deployment models that we can use to address the PKI requirements. In this section, we will look into these models and their characteristics.

The single-tier model

The single-tier model is also referred to as the one-tier model, and it is the simplest deployment model for a PKI. This is not recommended for use in any production network as it's a single point of failure for the entire PKI:

Figure 13.11: Single-tier model

In this model, a single CA will act as a root CA and issuing CA. As explained previously, the root CA is the most trusted CA in the PKI hierarchy. A compromised root CA will compromise the entire PKI. In this model, it's a single server, so any breach of the server will easily...

Setting up a PKI

Now we have finished the theory part of this chapter and are moving on to the deployment part. In this section, I am going to demonstrate how we can set up a PKI using the two-tier model. I have used this model as it is the most commonly used model for medium and large organizations:

Figure 13.14: Planned PKI setup

The preceding diagram explains the setup I am going to configure. Here, I have one domain controller, one standalone root CA, and one issuing CA. All are running with Windows Server 2022 with the latest updates.

Setting up a standalone root CA

The first step is to set up the standalone root CA. This is not a domain member server and is operating on the workgroup level. Configuring it on a separate VLAN will add additional security to the root CA.

Once the server is ready, log in to the server as a member of the local administrator group. The first task is to install the AD CS role service. This can be done using the following command...

Certificate templates

Now we have a working PKI, and we can turn off the standalone root CA. It should only be brought online if the issuing CA certificates are expired or the PKI is compromised.

The CA comes with predefined certificate templates. These can be used to build custom certificate templates according to the organization's requirements and can be published to AD.

CA certificate templates are available under the Certificate Templates MMC. They can be accessed using Run | MMC | File | Add/Remove Snap-in... | Certificate Templates.

  1. To create a custom template, right-click on a template and click on Duplicate Template:

    Figure 13.22: Duplicate certificate template

  2. This will open up the Properties window, where you can change the settings of the certificate template to match the requirements. Some common settings to change in templates are listed here:
    • Template display name (the General tab): The display name of the template...

Requesting certificates

Based on the certificate templates published, users can request certificates from the issuing CA. I have logged in to an end user's PC and I am going to request a certificate based on the template we created in the previous step.

  1. To do that, go to Run, type MMC | Add/Remove Snap-in... | Certificates, and click on the Add button.
  2. From the list, select the computer account. Once selected, in the next window, select Local computer as the target.

    If the user is not an administrator and only has default permissions, the user will only be allowed to open the Current User snap-in. To open the computer account, MMC needs to be Run as administrator.

  3. Once MMC is loaded, go to the Personal container, right-click, and then follow All Tasks | Request New Certificate.
  4. This will open a new window. Click Next until you reach the Request Certificates window. In there, we can see the new template. Click on the checkbox...

Migrating AD CS from Windows Server 2008 R2 to Windows Server 2022

Windows Server 2008 R2 extended support ended on January 14, 2020.

This raised interest in migrating various Windows Server roles from Windows Server 2008 R2 to the latest version.

I thought it would be useful if I include steps for migrating AD CS roles from Windows Server 2008 R2 to Windows Server 2022. We also can use the same steps to migrate an AD CS role from Windows Server 2012/2012R2/2016/2019.

Demo setup

The following diagram shows the demo environment that I will be using for this particular task:

Figure 13.28: Demo environment

As illustrated in the preceding diagram, in the demo environment, I have 4 servers/PCs. The role of each server/PC is as follows:

...

AD CS disaster recovery

Like any other computer system, CA also may face disasters due to operating system issues, hardware failures, and so on. Depending on the CA's role in the infrastructure, we can plan how to recover from such failure. There are certain things we need to consider when developing a disaster recovery plan for the CA.

  • Role of the CA: The importance of the CA in infrastructure has a major impact on the disaster recovery plan. If an organization is using certificates for day-to-day activities such as computer authentication and Wi-Fi connection, this means the CA's availability is crucial for carrying on operations.

    On the other hand, if the CA is only used to issue certificates for a few internal applications or systems that are renewed every few years, CA availability is not as crucial as in the first scenario.

    In the event of a disaster, even a redeployment of the CA may not have a huge impact. As we can see, the role of the CA will...

Summary

Digital certificates are increasingly used in modern infrastructure as additional layers of security to prove that objects and services are genuine. In this chapter, you learned what a PKI is and how it works exactly. Then, we looked into AD CS components and their responsibilities.

After that, we moved into the planning of a PKI and discussed what needs to be considered when building it. Then, we looked into PKI deployment models and evaluated their pros and cons. Later, we went through a step-by-step guide to setting up a two-tier PKI. Windows Server 2008 is out of support now and it is important to know how we can migrate the CA configuration from Windows Server 2008 to Windows Server 2022. This scenario has also been covered in this chapter. Last but not least, we learned how to recover the CA from a disaster.

In the next chapter, you are going to learn about another AD role service—AD Federation Service—and see how identities are handled in a federated...

lock icon
The rest of the chapter is locked
You have been reading a chapter from
Mastering Active Directory, Third Edition - Third Edition
Published in: Nov 2021Publisher: PacktISBN-13: 9781801070393
Register for a free Packt account to unlock a world of extra content!
A free Packt account unlocks extra newsletters, articles, discounted offers, and much more. Start advancing your knowledge today.
undefined
Unlock this book and the full library FREE for 7 days
Get unlimited access to 7000+ expert-authored eBooks and videos courses covering every tech area you can think of
Renews at $15.99/month. Cancel anytime

Author (1)

author image
Dishan Francis

Dishan Francis is an IT professional with over 15 years of experience. He was a six-time Microsoft MVP in enterprise mobility before he joined Microsoft UK as a security consultant. He has maintained the RebelAdmin technology blog over the years, with lots of useful articles that focus on on-premises Active Directory services and Azure Active Directory. He has also written for other Microsoft-managed blogs such as canitpro and ITopsTalk. When it comes to managing innovative identity infrastructure solutions to improve system stability, efficiency, and security, his level of knowledge and experience places him among the very best in the field.
Read more about Dishan Francis

Host Name

Operating System

Role