Chapter 11. Installation and the Client Side of Certificate Management

Microsoft Identity Management certificate management can be a bit hard to get going, and this is why we have focused on it in multiple chapters. In this chapter, we will discuss the installation of the certificate management solution in full detail.

The topics covered in this chapter are as follows:

• Installation and configuration:

  • Extending the schema

  • Database permission

  • Configuring the CA

  • Configuring the templates and permission

  • CM update service configuration

• The certificate management client

  • Modern App deployment and configuration

Installation and configuration

MIM certificate management (CM) can be used in many ways, but to show you a little bit about how we can use its basics, The Financial Company will use it to allow managers (such as Jeff) to issue smart cards to users (such as David) with the help from the Modern App. We will also configure autoenrollment for EFS certificates using the policy module to recap the accounts being used in this setup.

Extending the schema

Before we can do anything, we need to extend the Active Directory schema to support MIM CM. We will go over multiforest configurations later in this chapter under various scenarios.

Note

All schema changes in Active Directory should be planned carefully.

If we don't, the configuration wizard will stop and tell us to extend the Active Directory schema if we try to run it. As you can see in the following screenshot, the installer is reminiscent of the branding transition:

Note

Remember that all modifications to the schema require the schema admin's permissions...

Certificate management clients

MIM comes with two options for enterprises to allow users to enroll or manage certificates. We have the classic ActiveX plugin that has been with us since the CLM (Certificate Lifecycle Manager) days of the CM smart card enrollment. Now, we also have a new option using the Modern App with the new REST API. In this chapter, we will go over the installation of these components and also the configuration of the MIM CM Modern App depending on your environment.

Installing the MIM CM client

On the client computers where users manage smart cards (in some cases, all workstations), you will need to install some client components.

Note

You should install the x86 client software, even if the operating system is a 64-bit one. You have to match your MIM CM client with the type of Internet Explorer that the users are using. (Even on 64-bit Windows, we almost always use the 32-bit version of IE.)

The installation can be automated and settings controlled using GPOs, but showing...

Summary

In this chapter, we covered a lot of ground on the installation of the certificate management solution. We are well on our way to have a great certificate solution for The Financial Company. We also looked in grave detail the Modern App from deployment to the signing and customizing of the Modern App.

The next chapter will be the final documentation of the scenarios and configuration to include the ADFS setup and typical models.