Chapter 12. Certificate Management Scenarios

The Financial Company is interested in the management of its certificates and has decided to deploy MIM Certificate Management (CM). This chapter will discuss step-by-step instructions to implement and test various CM scenarios and models. We will cover configuration files, permissions, and error files and provide some of our personal feedback on what to avoid. Furthermore, we will discuss new features not found in earlier versions of the product, such as enabling one forest to provide certificates to another forest.

In this chapter, we will cover the following topics:

• Virtual smart card with TPM (Modern App)

• Using support for non-MIM CM

• Multi-forest configuration

• Active Directory Federation Services (ADFS) configuration

• Models at a glance

Modern app and TPM virtual smart card

In the previous chapter, we configured the Modern App for The Financial Company. Our next step is to allow the enrollment of the virtual smart card deployment by deploying the certificate template and updating the policy template.

First, enable the MIM CM REST API by setting CLM.WebApi.Enabled to true inside the web.config file and make sure CLM.WebApi.Enabled is set to true, as follows:

Another useful setting is adding error logging for the REST API controllers under <system.diagnostics> of web.config, as follows:

<add name="Microsoft.Clm.Web.API" value="4" />

This setting allows errors from the REST interface to be written to the event log along with a correlation ID. The correlation ID is sent to the client, and you can trace the error all the way back to its origin. More information on the REST API for CM can be found at http://bit.ly/MIMCMRestAPI.

Creating a certificate template

We will now create a certificate template in the CA. Open CA...

Using support for Non-MIM CM

Most organizations want auto-enrolment of certain certificate templates, while still having MIM CM capabilities. In the following example, The Financial Company will use the EFS certificate for enrolment and recovery.

Creating the software certificate

The first step in this process is to set up the certificate template. We will navigate to the CA to duplicate the Basic EFS template, as depicted in the following screenshot:

In the template screen, enter the following information:

• The General tab:

  • Template Display Name: Archive EFS

  • Validity Period: 2 years

  • Renewal Period: 6 weeks

  • Publish certificate in Active Directory: Enabled

  • Do not automatically re-enrol if a duplicate certificate exists in Active Directory: Enabled

  • Leave all the other settings at default values

• The Request Handling tab:

  • Archive subject's encryption private key: Enabled

  • Leave all the other settings at default values

• The Subject Name, Server, Issuance Requirements, and Extensions tabs:

  • Leave all the settings...

Multiforest configuration

We will now discuss the new multiforest CM capabilities. Multiforest CM enables an enterprise to issue certs to users from another forest that is trusted by TFC. The Financial Company is bringing on a new UK domain called TFCUK.LOCAL, which only hosts users. The UK group plans to use CM in the future, but it needs to issue certs immediately.

First, we will verify that our requirements are working properly, such as DNS and the trust; then, we will extend the schema.

Step 1 – CM DNS setup

Perform the following steps:

1. Go to the domain controller hosting DNS, open the DNS manager, and add conditional forwarders to The Financial Company.

2. Expand the server name in the left-hand side pane and right-click on Conditional Forwarders.

3. Select New Conditional Forwarder and click on Next on the first wizard page:

   

4. Then, in the DNS domain, type tfcuk.local.

5. In the next section, select DNS Domain.

6. On the next page, select To all DNS … on this forest and click on Next.

7. In IP Address, enter...

ADFS configuration

MIM CM configuration for ADFS installation is quite similar to the Windows Authentication configuration. We will outline the installation to the existing CM configuration of The Financial Company.

The ADFS installation requires a dedicated server because the web administration portal is not compatible with the ADFS authentication model's claims-based authentication. This setup assumes that you already have ADFS set up within your environment, so we will not go through this configuration. The Financial Company has already set up ADFS, but if you need help with setting it up, visit http://bit.ly/MIMCMADFSGuides.

Step 1 – the CM installation and prerequisites

The first step is to install CM software on the CM2 (TFCCM02) server. Request a domain certificate for the IIS website and call it cm2.thefinacialcompany.net:

Once we have the certificate, we will make sure it is tied to the default site by navigating to IIS <Server name> | Sites | Default Web Sites. Open the Bindings...

Models at a glance

There are some high-level models that most environments use to manage certificates. In the next few sections, we will uncover these models and the requirements and permissions needed to succeed with them. The Financial Company has already applied the self-service registration model as part of the manager-initiated model. The models are not explicit, but they are flexible, and TFC could use a mixture of both. Let's now look at the centralized management model.

The centralized management model

The centralized management model works well when there is a tightly controlled HR process or a security officer enrolls a smart card for the user, and in general cases where a random PIN is assigned to the card. When the card is received by the subscriber (that is, the user), then they would perform the initial online unblock. The helpdesk would be able to assist if an offline unblock operation is needed. In the centralized model, the following permissions would be needed:

Service Connection...

Summary

As you can see, certificate management provides a company with many options and features. In this chapter, we discussed implementing the enrollment of virtual smart cards, support for non-MIM CM scenarios, and the configuration and requirements necessary for multi-forest CM capabilities. We also walked you through the installation of CM with ADFS and its prerequisites. We ended the chapter by looking at three CM models and their required permissions.

In the next chapter, we will explore one of the new features in Identity Manager 2016, the built-in reporting support.