Creating a new certificate template

Enough talk. It's time to get some work done. Now that our CA role has been installed, let's make it do something! The purpose of a certificate server is to issue certificates, right? So, shall we do that? Not so fast. When you issue a certificate from a CA server to a device or user, you are not choosing which certificate you want to deploy; rather you are choosing which certificate template you want to utilize to deploy a certificate based upon the settings configured inside that template. Certificate templates are sort of like recipes for cooking. On the CA server, you build out your templates and include all of the particular ingredients, or settings, that you want to incorporate into your final certificate.

Then, when the users or computers come to request a certificate from the CA server, they are sort of baking a certificate into their system by telling the CA which template recipe to follow when building that certificate. Certificates...

Issuing your new certificates

Next comes the part that trips up a lot of people on their first attempt. You now have a brand new template to issue, and we have verified that the permissions within that certificate template are appropriately configured so that any computer that is a member of our domain should be able to request one of these certificates, right? So our logical next step would be to jump onto a client computer and request a certificate, but there is first one additional task that needs to be accomplished in order to make that possible.

Even though the new template has been created, it has not yet been published. So at the moment, the CA server will not offer our new template as an option to the clients, even though security permissions are configured for it to do so. The process to publish a certificate template is very quick—only a couple of mouse clicks—but unless you know about the need to do this, it can be a very frustrating experience because nothing...

Obtaining a public-authority SSL certificate

We are now pretty comfortable with grabbing certificates from our own CA server inside our own network, but what about handling those SSL certificates for our webservers that should be acquired from a public certification authority? For many of you, this will be the most common interaction that you have with certificates, and it's very important to understand this side of the coin as well. When you need to acquire an SSL certificate from your public authority of choice, there is a three-step process to do so: create a certificate request, submit the certificate request, and install the resulting certificate.

We are going to use my WEB1 server, on which I have a website running. Currently, the site is only capable of handling HTTP traffic, but when we turn it loose on the internet, we need to enable HTTPS to keep the information that is being submitted to the site encrypted.

To use HTTPS, we need to install an SSL certificate onto the WEB1...

Exporting and importing certificates

I often find myself needing to use the same SSL certificate on multiple servers. This might happen in the case where I have more than one IIS server serving up the same website and I am using some form of load balancing to split the traffic between them. This need may also arise when working with any form of hardware load balancer, as you sometimes need to import certificates onto not only the webservers themselves but into the load balancer box. Another example is when using wildcard certificates; when you purchase a wildcard, you typically intend to install it onto multiple servers.

Does this mean that I need to generate a new CSR from each server, and request a new copy of the same certificate multiple times? Definitely not, and in fact doing so could cause you other problems: remember that when a public CA re-keys a certificate—in other words, if you have already requested a certificate with a particular name and then come back again later...

OpenSSL for Linux web servers

The information provided in this chapter should give you everything needed to protect websites with SSL certificates issued from a public CA….on a Windows webserver. While this is obviously a Microsoft-centric book, the majority of webservers out there are not running on Microsoft webserver platforms. Alas, you will likely run into just as many Linux-based webservers as you do instances of IIS, and it will be very helpful to your role as server administrator to be able to install certificates onto these webservers as well.

One significant difference between Windows and Linux webservers are the types of files used for certificates. IIS hides away the private key, you don’t really deal with it at all. When downloading certificate files for IIS, those are usually CER or CRT files. A Linux webserver, however, is expecting something else. On most Linux webservers, the certificate file and the private key are each an individual file which are quite...

Summary

Certificates often get a bad rep, and I believe this is because people think they are a headache to deal with. I see their point. Without knowing how to navigate through the various administrative consoles that deal with your certificate infrastructure, it would be difficult to make even the simplest items function. By walking through the most common certificate-related tasks that any server admin will eventually have to tackle within their own networks, I hope that you have now found some comfort and confidence to progress with those projects that might be currently sitting on hold, waiting for the certificate infrastructure to be built. In the next chapter, we will study networking with Windows Server 2022.

Questions

1. What is the name of the role inside Windows Server 2022 that allows you to issue certificates from your server? (Answer: Certification Authority)
2. What kind of CA server is typically installed first in a domain environment? (Answer: Enterprise Root CA)
3. Should you install the certification authority role onto a domain controller? (Answer: No, this is not a recommended scenario)
4. After creating a new certificate template, what next step needs to be taken before you can issue certificates to your computers or users from that new template? (Answer: The new certificate template must be published)
5. What is the general name of the GPO setting that forces certificates to be issued without manual intervention by an administrator? (Answer: Certificate Auto-enrollment)
6. An SSL certificate will only be able to validate traffic properly if it shares _______ key information with the webserver. (Answer: Private key)
7. What is the primary piece of information that a public certification authority...

Questions

1. How many bits in length is an IPv6 address?
2. Re-write the following IPv6 address in condensed form: 2001:ABCD:0001:0002:0000:0000:0000:0001.
3. What is the name of the command that is similar to tracert but displays the local NIC that traffic is flowing out of?
4. True or False—On a server with multiple NICs, you should input a default gateway address onto each of those NICs.
5. What is the PowerShell cmdlet that can be used to create new routes on Windows Server?
6. Which Windows Server operating systems can be used with Azure Network Adapter in order to connect them directly to Azure virtual networks?
7. Which connectivity method between a local datacenter and Azure provides the fastest, most robust, and most reliable connection?

Join our community on Discord

Join our community’s Discord space for discussions with the author and other readers:

https://packt.link/SecNet