TechNet Home > Windows Server System Reference Architecture > Certificate Services

Introduction

Published: March 31, 2005

This guide provides instructions for installing and configuring a public key infrastructure (PKI) and multiple certificate authorities (CAs) in the WSSRA environment. Detailed information about the various options and decisions that were made regarding these services is provided in the Certificate Services Planning Guide.

The design calls for four certificate authorities, one IIS server that is used for certificate revocation list distribution, and a domain environment that can be accessed through at least one domain controller.

FFL-SA-CA-01 is installed as an offline root CA, and is disconnected from the network. The offline root CA is a workgroup member only, and does not belong to any domain (which would require network connectivity).

FFL-SA-CA-02 is an offline standalone intermediate CA that also runs on a workgroup server that is disconnected from the network.

Servers FFL-RT-CA-01 and FFL-RT-CA-02 will issue CAs, as they are connected to the network and participate as domain members.

Note: Appendix 14.16 provides a summary of all the parameters that where used in the building of the certificate service.

Knowledge Prerequisites

Successful completion of the steps detailed in this guidance requires a certain level of technical knowledge. The guidance in this document is written assuming the following level of experience and knowledge:

•	Two years of NT 4.0 experience in a networked environment
•	Three months of experience with the type of service or technology being built.
•	Access (including Web site links) to existing manuals/guides for the specific service, technology, or product being built or operated.

Top of page

Roles

The following tables show the relationships between the different certificate services roles and the accounts that serve in those roles.

ID	Task	Server	Account/Permissions Required	Role	MOF Quadrant
0.1	Preparing the Internal Management Server	FFL-NA-MGT-01	Local Administrator The account must have permissions to create a file folder and copy files to the system.	Server Owner	Build
0.2.1	Creating Active Directory Groups and Users	CI Management Server	Administrator@na.corp.contoso.com The account requires user and group maintenance permissions.	OU Owner	Build
0.2.2	Granting Permissions to the Public Key Services Container	CI Management Server	Administrator@corp.contoso.com The account must have change permissions in the Active Directory configuration container that maintains the Public Key Infrastructure configuration (CN=Public Key Services, CN=Services, CN=Configuration, DC=...)	Forest Owner - Enterprise Admin	Operate
0.2.3	Installing V2 Certificate Templates	CI Management Server	Administrator@corp.contoso.com To install certificate templates, the account must be a member of the Enterprise Admin group.	Forest Owner - Enterprise Admin	Build
0.3	Preparing the Perimeter Management Server for CA Certificate and CRL Publication	CP Management Server	Local Administrator The account must have permissions to create a file folder and copy files to the system.	Server Owner	Build
0.4	Creating An Internal Web Site for CA Certificate and CRL Publication	Web-Server	Local Administrator	IIS Admin	Build
0.5	Creating an External Web Site for CA Certificate and CRL Publication	Web-Server	Local Administrator	IIS Admin	Build
0.6	Creating DNS Records for Your CRL Distribution Points	DNS-server	Local Administrator	DNS owner	Build
0.7	Verifying DNS Configuration With a Sample Certificate Practice Document	CI Management Server	EntPKIpublisher01@na.corp.contoso.com The task needs to be performed with an account that has write permissions on the publication location.	Enterprise PKI publisher	Build

Table 1. Certificate Services-General Roles and Accounts

ID	Task	Performed at Computer	Account/Permissions Required	Role	MOF Quadrant
1.1.1, 2.1.1	Verifying Workgroup Membership	FFL-SA-CA-01	Local Administrator The account must be a member of the server’s Everyone security group. The local administrator has this permission by default and is the only user account that is available at this time.	Server Owner	Build
1.1.2, 2.1.2	Disabling All Network Interfaces at the CA Computer	FFL-SA-CA-01	Local Administrator Any account that is a member of the server’s Network Configuration Operators group or Administrators group. The local administrator has this permission by default and is the only user account that is available at this time.	OS Network Configuration Owner	Build
1.1.3	Preparing the capolicy.inf File	FFL-SA-CA-01	Local Administrator Write permissions in the Windows directory are required. The local administrator has this permission by default and is the only user account that is available at this time.	Server Owner	Build
1.1.4	Installing the Software Components	FFL-SA-CA-01	Local Administrator Only members of the local Administrators security group can install Windows components. The local administrator has this permission by default and is the only user account that is available at this time.	Server Owner	Build
1.1.5	Verifying the CA Installation	FFL-SA-CA-01	Local Administrator Technically, any account with read permissions on the CA object can perform this operation. The local administrator has this permission by default and is the only user account that is available at this time.	Server Owner	Build
1.1.6	Configuring the CA Service	FFL-SA-CA-01	Local Administrator Write permissions in the registry hive HKEY_LOCAL_MACHINE\SYSTEM\ CurrentControlSet\Services\CertSvc are required. Members of the local Administrators and Server Operators security groups can maintain the CA configuration in the registry. The local administrator has this permission by default and is the only user account that is available at this time.	Server Owner	Build
1.1.7	Verifying the CA Configuration	FFL-SA-CA-01, FFL-SA-CA-02	Local Administrator Technically, any account with read permissions on the CA object can perform this operation. The local administrator has this permission by default and is the only user account that is available at this time.	Server Owner	Build
1.1.8	Preparing Local Security Groups	FFL-SA-CA-01	Local Administrator User and group management permission are required to maintain local user accounts. Technically, the account requires “Act as part of the operating system” permissions on the local system. The local administrator has this permission by default and is the only user account that is available at this time.	Server Owner	Operate
1.1.9	Delegating CA Permissions	FFL-SA-CA-01	Local Administrator Technically, any account with manage permissions on the CA object can perform this operation. The local administrator has this permission by default and is the only user account that is permitted at this time.	Server Owner	Operate
1.1.10	Delegating Local Auditing Permissions	FFL-SA-CA-01	Local Administrator The account requires permissions to configure local security policies. Members of the local Administrators group have this permission by default.	Server Owner	Operate
1.1.11	Enabling Local Object Access Auditing	FFL-SA-CA-01, FFL-SA-CA-02	Local Administrator The account requires permissions to configure local security policies. Members of the local Administrators group have this permission by default.	Server Owner	Operate
1.2.1	Copying the CA Certificate to Removable Media	FFL-SA-CA-01, FFL-SA-CA-02	Local caAdmin01 To retrieve the CA certificate from the CA, read permissions are required on the CA object. The CA service must be started.	CA Owner	Operate
1.2.2	Copying the CRL to Removable Media	FFL-SA-CA-01, FFL-SA-CA-02	Local caAdmin01 Manage permissions are required to generate a new CRL version.	CA owner	Operate
1.3.1	Publishing a CA Certificate and CRL to An Internal Facing Web Server	CI Management Server	EntPKIpublisher01@na.corp.contoso.com The account requires local logon permissions at the CI Management server, which is ensured by membership of the custom security group Management Server Users. Also, write permissions are required for the C:\WWWPKIpub directory and the corresponding shared folder on the internal Web servers.	Enterprise PKI publisher	Operate
1.3.2	Publishing a CA Certificate and CRL to An External Facing Web Server	CI Management Server	EntPKIpublisher01@na.corp.contoso.com The account requires local logon permissions at the CI Management server and the CP Management server, which is ensured by membership of the custom security group Management Server Users. Also, write permissions are required for the C:\WWWPKIpub directory and the corresponding shared folder on the perimeter Web servers.	Enterprise PKI publisher	Operate
1.3.3	Publishing a Root CA Certificate in Active Directory Manually	CI Management Server	EntPKIpublisher01@na.corp.contoso.com The account that is used to publish the root CA certificate manually into Active Directory requires write permissions corresponding to the "General: Granting Permissions to the Public Key Services Container" section in this guide.	Enterprise PKI publisher	Operate

Table 2. Certificate Services-Root CA Roles and Accounts

ID	Task	Computer	Account/Permissions Required	Role	MOF Quadrant
2.1.1	Verifying Workgroup Membership	FFL-SA-CA-02	Refer to Root CA ID 1.1.1	Server Owner	Build
2.1.2	Disabling All Network Interfaces at the CA Computer	FFL-SA-CA-02	Refer to Root CA ID 1.1.2	OS Network Configuration Owner	Build
2.1.3	Preparing the capolicy.inf File	FFL-SA-CA-02	Refer to Root CA ID 1.1.3	Server Owner	Build
2.1.4	Installing the CA Software Components	FFL-SA-CA-02	Refer to Root CA ID 1.1.4	Server Owner	Build
2.2	Certificate Request Submission at Parent CA	FFL-SA-CA-01	Submitting a certificate request requires enrollment permissions on the CA object. This is an operations task because it has to be repeated each time when the CA certificate requires a renewal. With delegated CA permissions: CertRequester01 - Members of the custom security group CertRequesters can submit certificate requests to the CA because they have been permitted to request certificates. Without delegated CA permissions: Administrator - Any account that is a member of the Everyone group has read and certificate request permissions by default. The Administrator is a member of Everyone and is able to submit the certificate request.	Certificate requestor	Operate
2.3	Certificate Approval at Parent CA	FFL-SA-CA-01	Approving a certificate request requires certificate manager permissions on the CA object. This is an operations task because manual certificate approval is a usual operation. With delegated CA permissions: CertManager01 - A member of the Certificate Managers group must approve the CA certificate request when the request has been submitted. Without delegated CA permissions: Administrator - The computers administrators group has certificate management permissions by default.	Certificate Manager	Operate
2.4.1	Importing a CRL Into the Local Certificate Store	FFL-SA-CA-02	Local Administrator The registry hive that maintains certificates in the local computer certificate store limits write permissions to members of the local administrators group by default. Because of the restrictive permissions on the certificate store, the account must be a member of the local Administrators group to perform this operation. The local administrator is also the only user account that is available at this time.	Server Owner	Operate
2.4.2	Installing the Root CA Certificate	FFL-SA-CA-02	Local Administrator The registry hive that maintains the CA certificates limits write permissions to members of the local administrators group by default. Because of the restrictive permissions on the certificate store, the account must be a local administrator to perform this operation. The local administrator is also the only user account that is available at this time.	Server Owner	Operate
2.4.3	Configure the CA Service	FFL-SA-CA-02	Local Administrator Write permissions in the registry hive HKEY_LOCAL_MACHINE\ SYSTEM\ CurrentControlSet\ Services\ CertSvc are required. Members of the local Administrators and Server Operators security groups can maintain the CA configuration in the registry. The local administrator has this permission by default and is the only user account that is available at this time.	Server Owner	Build
2.4.3	Installing the CA Certificate	FFL-SA-CA-02	Local Administrator To install a CA certificate, local administrator permissions are required because only the administration is allowed to add certificates to the machine’s certificate store.	Server Owner	Build
2.4.4	Verifying the CA Configuration	FFL-SA-CA-02	Local Administrator Technically, any account with read permissions on the CA object can perform this operation. The local administrator has this permission by default and is the only user account that is available at this time.	Server Owner	Build
2.4.5	Configuring Different CA Roles	FFL-SA-CA-02	Local Administrator Technically, any account with manage permissions on the CA object can perform this operation. The local administrator has this permission by default and is the only user account that is available at this time.	Server Owner	Operate
2.5	Copying the CA Certificate to Removable Media	FFL-SA-CA-02	Only Accounts with manage permissions can create a new CRL version. Without delegated CA permissions: Administrator - The local administrator is usually responsible for CA maintenance tasks and has Manage permissions on the CA object by default. With delegated CA permissions: caAdmin01 - Members of the caAdmins security group are responsible to manage the CA and have manage permissions to publish the CA.	CA owner	Operate
2.6	Copying the CA CRL to Removable Media	FFL-SA-CA-02	caAdmin01@na.crop.contoso.com Everyone has permissions to read the CRL file, but CA management permissions are required to initiate a CRL publication.	CA owner	Operate
2.7.1	Publishing a CA Certificate and CRL to An Internal Facing Web Server	CI Management Server	EntPKIpublisher01@na.corp.contoso.com The account must have write permissions on the distribution point.	PKI publisher	Operate
2.7.2	Publishing a CA Certificate and CRL to An External Facing Web Server	CI Management Server	EntPKIpublisher01@na.corp.contoso.com The account must have write permissions on the distribution point.	PKI publisher	Operate

Table 3. Certificate Services-Intermediate CA Roles and Accounts

ID	Task	Computer	Account/Permissions Required	Role	MOF Quadrant
3.1.1	Configuring Network Adapters and IP Addresses	FFL-RT-CA-01, FFL-RT-CA-02	Local Administrator		Build
3.1.2	Disabling Unnecessary Bindings	FFL-RT-CA-01, FFL-RT-CA-02	Local Administrator Any account that is a member of the server’s Network Configuration Operators or Administrators groups. The local administrator has this permission by default and is the only user account that is available at this time.		Build
3.1.3	Configuring NIC Teaming	FFL-RT-CA-01, FFL-RT-CA-02	Local Administrator Any account that is a member of the server’s Network Configuration Operators or Administrators groups. The local administrator has this permission by default and is the only user account that is available at this time.	OS Network Configuration Owner	Build
3.1.4	Joining the Computer to the Domain	FFL-RT-CA-01, FFL-RT-CA-02	Local Administrator Any authenticated user has permissions to join a computer with the domain.	User Role	Build
3.2.1	Preparing the capolicy.inf File	FFL-RT-CA-01, FFL-RT-CA-02	Local Administrator Write permissions in the WINDOWS directory are required. The local administrator has this permission by default and is the only user account that is available at this time.	Server Owner	Build
3.2.2	Installing the CA Software Components	FFL-RT-CA-01, FFL-RT-CA-02	Administrator@corp.contoso.com Installing the first enterprise CA in a forest must have Root Domain Administrator, Enterprise Administrator, and local Administrator permissions; all subsequent CA installs require Enterprise Administrator and local Administrator permission because the installation procedure must register the CA as an enrollment service in Active Directory. When the first CA is installed, also base objects are created in Active Directory. These objects are leveraged by subsequent CAs.	Forest Owner - Enterprise Admin	Build
3.3.1	Generating a Unique OID	FFL-RT-CA-01	EntPKIadmin01@na.corp.contoso.com To create a new OID, the current account must have write permissions to the OID configuration container in Active Directory. Enterprise Administrators have this permission by default. Members of the custom EntPKIAdmins security group have appropriate permissions per the “General: Creating Active Directory Groups and Users” section in this guide.	Enterprise PKI Administrator	Build
3.3.2	Injecting the Policy Into the Certificate Request	FFL-RT-CA-01, FFL-RT-CA-02	EntPKIadmin01@na.corp.contoso.com Technically, any account that has read and write permissions on the file folders that store to request and inf-files can prepare the certificate request.	Enterprise PKI Administrator	Build
3.4	Certificate Request Submission at Parent CA	FFL-SA-CA-02	Local certRequester01 Submitting a certificate request requires enrollment permissions on the CA object. Without delegated CA permissions: Administrator-Any account that is a member of the Everyone group has certificate request permissions by default. The Administrator is a member of Everyone and is able to submit the certificate request. With delegated CA permissions: CertRequesters-Members of the custom security group CertRequesters can submit certificate requests to the CA because they have been permitted to request certificates.	Certificate requester	Operate
3.5	Certificate Approval at Parent CA	FFL-SA-CA-02	Local CertManager01 Approving a certificate request requires certificate manager permissions on the CA object. Without delegated CA permissions: Administrator-The computers administrators group has certificate management permissions by default. With delegated CA permissions: CertManagers-A member of the Certificate Managers group must approve the CA certificate request when the request has been submitted.	Certificate Manager	Operate
3.6	Verifying CA and CRL Accessibility	FFL-RT-CA-01, FFL-RT-CA-02	Local Administrator This task requires read permissions on the CA and CRL distribution point. The distribution point is configured to allow anonymous read access. Because the local administrator is not a domain account, it behaves as an anonymous account.	CA owner
3.7	Denying Certificate Request Permissions	FFL-RT-CA-01, FFL-RT-CA-02	Local Administrator Managing CA permissions requires CA manager permissions on the CA object. The local administrator has this permission by default and is the only user account that is available at this time.	CA owner	Operate
3.8.1	Configuring the CA Service	FFL-RT-CA-01, FFL-RT-CA-02	Local Administrator Write permissions in the Registry hive HKLM\SYSTEM\ CurrentControlSet\Services\CertSvc are required. Members of the local Administrators and Server Operators security groups can maintain the CA configuration in the registry. The local administrator has this permission by default and is the only user account that is available at this time.	Server Owner	Build
3.8.2	Installing a CA Certificate	FFL-RT-CA-01, FFL-RT-CA-02	Local Administrator The registry hive that maintains the CA certificates limits write permissions to members of the local administrators group by default. Because of the restrictive permissions on the certificate store, you must be a local administrator to perform this operation. The local administrator is also the only user account that is available at this time. The CA certificate installation is an operational task because it needs to be repeated every time when the CA certificate needs to be renewed.	CA owner	Operate
3.8.3	Post Configuration Tasks	FFL-RT-CA-01, FFL-RT-CA-02	Local Administrator Permissions are required to start the CA service. Management permissions are required to detach the default certificate templates.	CA owner	Build
3.8.4	Verifying the CA Configuration	FFL-RT-CA-01, FFL-RT-CA-02	Local Administrator Technically, any account with read permissions on the CA object can perform this operation. The local administrator has this permission by default and is the only user account that is available at this time.	Server Owner	Build
3.9.1	Verifying the CRL Publication On the Fileshare	CI Management Server	EntPKIpublisher01@na.corp.contoso.com Any account with read permissions on the publication file-share can verify the publication.	Enterprise PKI publisher	Operate
3.9.2	Verify Information in Active Directory	CI Management Server	EntPKIadmin01@na.corp.contoso.com Any account that is treated as authenticated user can be used to perform this task.	Enterprise PKI Administrator	Operate
3.10	Creating Local CA Management Accounts	FFL-RT-CA-01, FFL-RT-CA-02	Local Administrator Members of the local administrators group only can create local user accounts.	Server owner	Build
3.11	Configuring Different CA Roles	CI Management Server	Administrator@corp.contoso.com The account requires CA management permissions and must be an authenticated domain user.	CA owner	Operate
3.12	Enforcing Role Separation	FFL-RT-CA-01, FFL-RT-CA-02	Local Administrator Write permissions in the Registry hive HKLM\SYSTEM\ CurrentControlSet\Services\CertSvc are required. Members of the local Administrators and Server Operators security groups can maintain the CA configuration in the registry. The local administrator has this permission by default.	Server Owner	Operate
3.13	Issuing CA: Publishing the CA Certificate	FFL-RT-CA-01, FFL-RT-CA-02	EntPKIpublisher01@na.corp.contoso.com The account requires logon locally permissions at the <PKIciManagementServer> and <PKIexManagmentServer> and file creating permissions on the Web server file shares.	Enterprise PKI publisher	Operate
3.14	Allowing Certificate Requests	FFL-RT-CA-01, FFL-RT-CA-02	caAdmin01@na.corp.contoso.com The account requires manage permissions on the CA object and must have read permissions on the templates that should be assigned.	CA owner	Operate
3.15	Moving Servers to the Domain Organizational Unit	CI Management Server	Administrator@corp.contoso.com The account must have create and delete object permissions in the source and destination container/OU.	OU owner	Operate
3.16	Enabling Certificate Autoenrollment	CI Management Server	Administrator@na.corp.contoso.com The account requires domain Group Policy management permissions.	Domain Administrator	Operate
3.17	Configuring Certificate Authority Service Permissions	CI Management Server	Administrator@na.corp.contoso.com The account requires domain Group Policy management permissions.	Domain Owner	Operate

Table 4. Certificate Services-Issuing CA Roles and Accounts

ID	Task	Computer	Account/Permissions Required	Role	MOF Quadrant
4.1.1	Creating Certificate Templates for RAS Clients	CI Management Server	EntPKIadmin01@na.corp.contoso.com The account must have change permissions in the Active Directory configuration container that maintains the certificate templates CN=Certificate Templates, CN=Public Key Services, CN=Services, CN=Configuration, DC=...	Certificate Template Administrator	Build
4.1.2	Creating a Certificate Template for VPN Servers	CI Management Server	Refer to ID 4.1.1	Refer to ID 4.1	Build
4.1.3	Creating a Certificate Template for IAS Servers	CI Management Server	Refer to ID 4.1.1	Refer to ID 4.1	Build
4.1.4	Creating a Certificate Template for IIS Servers That Are Not Domain Members	CI Management Server	Refer to ID 4.1.1	Refer to ID 4.1	Build
4.1.5	Creating a Certificate Template for Domain Member IIS Servers	CI Management Server	Refer to ID 4.1.1	Refer to ID 4.1	Build
4.1.6	Attaching Certificate Templates	CI Management Server	EntPKIadmin01@na.corp.contoso.com The account must have read permissions for the template and must have manage permissions at the CA.	Certificate Template Administrator	Operate
4.1.7	Verifying a Certificate Template for a Specific Attribute from the Command Line	CI Management Server	EntPKIadmin01@na.corp.contoso.com Any account that has read permissions for the template can read the certificate templates details.	Certificate Template Administrator	Operate
4.2	IIS Certificate Request Submission	CI Management Server	IISadmin@na.corp.contoso.com Submitting a certificate request requires enrollment permissions on the CA object. Everyone has this permission by default.	Web server administrator	Operate
4.3	IIS Certificate Approval at an Online CA	CI Management Server	Caadmin01@na.corp.contoso.com Approving a certificate request requires certificate manager permissions on the CA object. Without delegated CA permissions: Administrator-The computers administrators group has certificate management permissions by default. With delegated CA permissions: CertManagers-A member of the Certificate Managers group must approve the CA certificate request when the request has been submitted.	Certificate Manager	Operate
4.4	Manual VPN Server Certificate Request Submission at an Issuing CA	CI Management Server	Any account that has enrollment permissions on the CA and can read the template can submit a request.	Certificate Manager	Operate
4.5.1	VPN Server Certificate Approval	CI Management Server, FFL-RT-CA-03	certmanager01@na.corp.contoso.com, Administrator Any account that has certificate management permissions can approve the certificate request.	Certificate Manager	Operate
4.5.2	Exporting the CA1 Root Certificate	CI Management Server	certmanager01@na.corp.contoso.com Read permissions on the PFX file that was created in the previous step.	Certificate Manager	Operate
4.6.1	Verifying Certificate Autoenrollment Settings at a VPN Client Computer	VPN client computer	VPN_certificate_users member Authenticated user permissions are required to examine group policies that have been applied.	User	Operate
4.6.2	Verifying VPN Client Certificate Auto-enrollment	VPN client computer	VPN_certificate_users member Authenticated user permissions are required to examine group policies that have been applied.	User	Operate
4.7	Verifying IAS Server Certificate Auto-enrollment	ISA server	IAS and RAS Administrator	IAS and RAS administrator	Operate

Table 5. Certificate Services-Additional Role/Account Considerations

Top of page

Service Prerequisites

The following table contains a list of those services that are required for implementing certificate services as described in this guide.

Prerequisite Element	Prerequisite Check	Verified
Network Devices	Ensure that the network is in place and configured as defined in the Network Devices Build Guide.
Computing Devices	Ensure that all servers are installed and powered on as defined in the Computing Devices Build Guide.
Deployment Services	Ensure that all the servers have the operating system and base configuration completed as defined in the Deployment Services Build Guide.
Directory Service	Ensure that the appropriate domains, organizational units, and group policies have been created and are operational as defined in the Directory Service Build Guide.
Firewall Services	Ensure that the interior and perimeter firewall devices have been installed, configured, and are operational as defined in the Firewall Services Build Guide.
DNS Services	Ensure that the interior and perimeter DNS servers are configured and operational as defined in the "DNS" section in the Network Services Build Guide.
Web Application Services	Ensure that the interior and perimeter web servers are configured and operational as defined in the Web Application Services Build Guide.
Infrastructure Management Services	Ensure that the interior and perimeter management servers are configured and operational as defined in the Infrastructure Management Services Build Guide.

Table 6. Certificate Services Service Prerequisites

Top of page

Download

Windows Server System Reference Architecture (WSSRA)

40,677 KB
Compressed Word file

Get Office File Viewers

Solution Accelerator Notifications

Feedback

Send us your comments or suggestions

The Reference Architecture Home Page

Overview Documents

Architecture Blueprints

IT Service Documents

•	Network Devices
•	Computing Devices
•	Storage devices
•	Deployment Services
•	Network Services
•	Firewall Services
•	Directory Services
•	File and Print Services
•	Data Services
•	Web Application Services
•	Infrastructure Management Services
•	Backup and Recovery Services
•	Certificate Services
•	Remote Access Services
•	Middleware Services
•	Messaging Services

Introduction

On This Page

Knowledge Prerequisites

Roles

Service Prerequisites

Download