http___microsoftguru.com.au_hr_tag_windows-server-2008__1.xml
1.1 2.1 3.1 3.2 4.1 5.1 6.1 7.1 8.1 9.1 10.1 11.1 12.1 13.1 14.1 15.1 16.1 17.1 18.1 19.1 20.1 21.1 22.1 23.1 24.1 25.1 27.1 28.1 29.1 30.1 31.1 32.1 33.1 34.1 35.1 35.2 36.1 37.1 38.1 38.2 39.1 40.1 41.1 42.1 43.1 44.1 44.2 45.1 45.2 45.3 45.4 45.5 45.6 46.1 46.2 47.1 48.1 49.1 50.1 50.2 51.1 52.1 52.2 53.1 54.1 55.1 56.1 57.1 58.1 59.1 60.1 61.1 62.1 64.1 66.1 68.1 68.2 70.1 71.1 72.1 73.1 74.1 75.1 75.2 76.1 77.1 77.2 78.1 79.1 79.2 80.1 80.2 81.1 81.2 82.1 83.1 84.1 85.1 86.1 86.2 87.1 88.1 89.1 89.2 90.1 91.1 92.1 93.1 94.1 95.1 96.1 97.1 98.1 99.1 99.2 99.3 100.1 101.1 101.2 101.3 102.1 103.1 103.2 104.1 104.2 104.3 105.1 105.2 105.3 106.1 107.1 108.1 109.1 110.1 111.1 112.1 113.1 114.1 114.2 115.1 115.2 116.1 116.2 117.1 118.1 119.1 120.1 120.2 121.1 122.1 123.1 124.1 125.1 125.2 126.1 127.1 129.1 131.1 132.1 133.1 134.1 135.1 136.1 137.1 138.1 139.1 140.1 141.1 142.1 143.1 144.1 145.1 146.1 147.1 148.1 148.2 149.1 150.1 151.1 153.1 155.1 156.1 156.2 157.1 157.2 158.1 158.2 159.1 159.2 160.1 160.2 161.1 161.2 161.3 162.1 164.1 166.1 168.1 170.1 172.1 172.2 174.1 174.2 176.1 177.1 178.1 180.1 181.1 182.1 182.2 182.3 182.4 183.1 183.2 184.1 184.2 184.3 184.4 184.5 184.6 184.7 185.1 186.1 187.1 189.1 189.2 191.1 193.1 194.1 196.1 198.1 200.1 200.2 202.1 204.1 206.1 206.2 206.3 208.1 208.2 208.3 208.4 209.1 210.1 211.1 211.2 211.3 211.4 211.5 212.1 214.1 216.1 218.1 219.1 220.1 222.1 224.1 225.1 225.2 225.3 226.1 227.1 228.1 229.1 230.1 231.1 232.1 233.1 234.1 235.1 236.1 237.1 237.2 238.1 240.1 242.1 242.2 244.1 246.1 246.2 248.1 248.2 250.1 252.1 254.1 255.1 255.2 256.1 256.2 256.3 257.1 258.1 260.1 262.1 264.1 266.1 267.1 269.1 269.2 271.1 273.1 274.1 275.1 277.1 277.2 279.1 281.1 283.1 283.2 285.1 285.2 287.1 289.1 291.1 291.2 293.1 294.1 295.1 297.1 297.2 299.1 301.1 303.1 303.2 305.1 307.1 307.2 309.1 309.2 311.1 311.2 313.1 314.1 315.1 316.1 317.1 318.1 320.1 320.2 322.1 322.2 324.1 326.1 326.2 328.1 328.2 330.1 330.2 332.1 332.2 332.3 334.1 336.1 337.1 337.2 337.3 338.1 338.2 339.1 341.1 343.1 343.2 345.1 347.1 347.2 347.3 348.1 348.2 349.1 350.1 350.2 351.1 352.1 354.1 356.1 356.2 357.1 357.2 357.3 358.1 359.1 359.2 360.1 361.1 361.2 362.1 363.1 363.2 363.3 363.4 363.5 363.6 364.1 364.2 364.3 364.4 364.5 364.6 364.7 365.1 366.1 367.1 368.1
Windows Server 2008 R2 Active Directory Certificate Services Deep Drive How to use the Certreq.exe utility to create and submit a certificate request that includes a SAN Create a text file using notepad. copy the following content and paste inside the text file and save as request.inf. ;copy from here [Version] Signature=”$Windows NT$ [NewRequest] Subject = “CN=myserver.microsoftguru.com.au” ; must be the FQDN of domain controller EncipherOnly = FALSE ; only for Win2k3 & WinXP Exportable = TRUE ; TRUE = Private key is exportable KeyLength = 2048 ; Common key sizes: 2048, 4096, 8192, 16384 KeySpec = 1 ; Key Exchange KeyUsage = 0xA0 ; Digital Signature, Key Encipherment MachineKeySet = True ProviderName = “Microsoft RSA SChannel Cryptographic Provider” ProviderType = 12 RequestType = CMC ; or PKCS10 ; Omit entire section if CA is an enterprise CA [EnhancedKeyUsageExtension] OID=1.3.6.1.5.5.7.3.1 ; Server Authentication OID=1.3.6.1.5.5.7.3.2 ; Client Authentication [Extensions] ; If your client operating system is Win2k8,Win Vista, Win7 ; SANs can be included in the Extensions section by using the following text format. ;Note 2.5.29.17 is the OID for a SAN extension. _continue_ = “dns=Exchange1.microsoftguru.com.au&” _continue_ = “dn=CN=Exchange1,OU=My Servers,DC=microsoftguru,DC=com,DC=au&” _continue_ = “url=http://myserver.microsoftguru.com.au&” _continue_ = “ipaddress=172.31.10.134&” _continue_ = “email=test@microsoftguru.com.au& “ _continue_ = “upn=test@microsoftguru.com.au&” _continue_ = “guid=f7c3ac41-b8ce-4fb4-aa58-3d1dc0e36b39&” ;Alternatively you create a SAN attribute using a script provided in KB ; use text format or encrypted format of SAN. 2.5.29.17=MCaCEnd3dzAxLmZhYnJpa2FtLmNvbYIQd3d3LmZhYnJpa2FtLmNvbQ== [RequestAttributes] ; Multiple alternative names must be separated by an ampersand (&). ;In the example I have shown two different types of SAN. Use only one type of SAN. ;Asterisk *.yourdomainname.com.au is used for Wildcard certificates. SAN=”dns=exchange1.microsoftguru.com.au&dns=www.microsoftguru.com.au&ipaddress=172.31.10.130″ SAN=”dns=webmail.microsoftguru.com.au&dns=*.microsoftguru.com.au&dns=autodiscover.microsoftguru.com.au” CertificateTemplate = WebServer ; change template name depending on your environment. ; remove “;” from request.inf file. file ends here. Important Note: Some third-party certification authorities (For examples ISPs who sell SSL certificate) may require additional information in the Subject parameter. Such information includes an e-mail address (E), organizational unit (OU), organization (O), locality or city (L), state or province (S), and country or region (C). You can append this information to the Subject name (CN) in the Request.inf file. For example: Subject=”E=test@microsoftguru.com.au, CN= , OU= My Servers, O=Microsoftguru, L=Perth, S=WA, C=AU.” Amend Request.inf as per your need. For a standard certificate request you can omit SAN, [Extensions] and[EnhancedKeyUsageExtension] section. Open a command prompt. At the command prompt, type the following command, and then press ENTER: certreq -new c:\request.inf c:\certnew.req At the command prompt, type the following command, and then press ENTER: certreq -submit c:\certnew.req c:\certnew.cer If there is more than one CA in the environment, the -config switch can be used in the command line to direct the request to a specific CA. If you do not use the -config switch, you will be prompted to select the CA to which the request should be submitted. certreq -submit -config “DC.microsoftguru.com.au\MYCA” c:\certnew.req c:\certnew.cer Use the Request ID number to retrieve the certificate. To do this, type the following command, and then press ENTER: certreq -retrieve RequestID c:\certnew.cer You can also use the -config switch here to retrieve the certificate request from a specific CA. At the command prompt, type the following command, and then press ENTER: certreq -accept c:\certnew.cer This command imports the certificate into the appropriate store and then links the certificate to the private key that is created in previous step. How to configure a CA to accept a SAN attribute from a certificate request certutil -setreg policy\EditFlags +EDITF_ATTRIBUTESUBJECTALTNAME2 net stop certsvc net start certsvc To repair a certificate If you are using a network HSM, complete steps 8 through 10 to repair the association between the imported CA certificate and the private key that is stored in the HSM. In the console tree, double-click Personal Certificates, and click the imported CA certificate. On the Action menu, click Open. Click the Details tab, copy the serial number to the Clipboard, and then click OK. Open a Command Prompt window, type certutil –repairstore My “{Serialnumber}” and then press ENTER. How to enable secure certificate enrolment in certificate authority Step1: Create request.inf file using WebServer template Step2: Generate a web server certificate request.req file using certreq.exe tools certreq -new c:\request.inf c:\request.req Step3: Submit the request.req file using certreq.exe or CA Management Console. Save certificate.cer Open CA MMC>Select CA server>Right click on CA Server>Click All Task>Submit a new request Point the location c:\request.req and submit. you will be prompted to save certificate. Step4: Import the certificate into certificate authority Start Microsoft Management Console (MMC). Add the Certificates snap-in that manages certificates on the local computer. Expand Certificates (Local Computer), expand Personal, and then expand Certificates. Right Click Import certificate you saved in previous steps. Step5: Open IIS Management Console>Select Default Web Site>Click Bindings from Action Pan>Click Add>Select HTTPS>Select the certificate you just imported in previous step. Click OK. Step6: Run iisreset /restart from command prompt Step7: Test https://MYCA/certsrv How to use secure Web enrollment pages to submit a certificate request to an enterprise CA To submit a certificate request that contains a SAN to an enterprise CA, follow these steps: - Open Internet Explorer. In Internet Explorer, connect to https://MYCA/certsrv. - Click Request a Certificate.>Click Advanced certificate request. - Click request a certificate - In the Certificate Template list, click Web Server. Note The CA must be configured to issue Web Server certificates. - Provide identifying information as required. - In the Name box, type the fully qualified domain name FQDN of the server. - Under Key Options, set the following options: - Create a new key set - CSP: Microsoft RSA SChannel Cryptographic Provider - Key Usage: Exchange - Key Size: 1024 – 16384 - Automatic key container name - Store certificate in the local computer certificate store Under Advanced Options, set the request format to CMC. In the Attributes box, type the desired SAN attributes. SAN attributes take the following form: san:dns=dns.name[&dns=dns.name] Multiple DNS names are separated by an ampersand (&). For example, if the name of the server is myserver.microsoftguru.com.au and the alias are autodiscover.microsoftguru.com.au and webamil.microsoftguru.com.au, these names must be included in the SAN attributes. The resulting attribute string appears as follows: san:dns=myserver.microsoftguru.com.au&dns=myweb.microsoftguru.com.au&dns=mysite.microsoftguru.com.au Click Submit. If you see the Certificate Issued Web page, click Install this Certificate. My preferred way to request a certificate is to create a .req file shown in previous steps. open .req file in a notepad and copy the contents. click submit a certificate request by using base 64-encode Paste the contents into base 64-encode. Select web server template. click submit. Now obtain certificate click yes. to download certificate with root CA CRL click Download certificate chain in p7b format to download only certificate click download certificate and save. How to configure Private Key in Certificate Authority and Export Private Key Open CA MMC from Administrative Tools>Right Click on Certificate Template>Click Manage Select WebServer Template>Right Click on WebServer Template>Click Duplicate Template>Select Win2k3 or Win2k8 OS Version>Type Template Name as WebServer With Private Key in General Tab Click Request Handling Tab>Check Allow private key to be exported Click Security Tab> Allow appropriate security for the person who will enroll and export the certificates Click Ok. Close CA MMC. Create a WebServer Request.inf. Create Request.req file Submit WebServer request to https://myca/certsrv . Download and install certificate. To export a certificate with the private key Open Certificate Manager by clicking the Start button>Search Box>Type certmgr.msc, and then pressing ENTER. Go to Certificates-Current User\Personal\Certificates>Select Certificate you would like to export. On the Action menu, point to All Tasks, and then click Export. In the Certificate Export Wizard, click Yes, export the private key. Note that this option will appear only if the private key is marked as exportable in request.inf file and you have access to the private key. Under Export File Format, do one or all of the following, and then click Next. - To include all certificates in the certification path, select the Include all certificates in the certification path if possible check box. - To delete the private key if the export is successful, select the Delete the private key if the export is successful check box. In Password, type a password to encrypt the private key you are exporting. In Confirm password, type the same password again, and then click Next. In File name, type a file name and path for the PKCS #12 file that will store the exported certificate and private key, click Next, and then click Finish. How to import Private Key Click Start Menu>Search Box>Click mmc.msc>Click Certificates>Add Computer Account>Click OK. Click a folder, click the Action menu, point to All Tasks, and then click Import. Browse to the location where you exported certificates>Select Certificate>Provide password to import the certificate. Click Next, and then follow the instructions. Playing with AD CS Administration Cmdlets in Windows PowerShell The following Windows PowerShell® cmdlets that are for use in administering the Active Directory Certificate Services (AD CS) certification authority (CA) role service in Windows Server® “8” Beta. - Import-Module ServerManager – Imports the Server Manager module that provides the Add-WindowsFeature cmdlet. - Add-WindowsFeature Adcs-Cert-Authority – Adds the Certification Authority role service binaries. - Add-WindowsFeature Adcs-Enroll-Web-Pol – Adds the Certificate Enrllment Policy Web Service binaries. - Add-WindowsFeature Adcs-Enroll-Web-Svc – Adds the Certificate Enrollment Web Service binaries. - Add-WindowsFeature Adcs-Web-Enrollment – Adds the Certification Authority Web Enrollment role service binaries. - Add-WindowsFeature Adcs-Device-Enrollment – Adds the Network Device Enrollment Service binaries. - Add-WindowsFeature Adcs-Online-Cert – Adds the Online Responder role service binaries. - Get-Command -Module AdcsDeployment – Displays all the cmdlets that are associated with AD CS Deployment. Disaster recovery or Migrate procedure of Active Directory Certificate Authority: Moving a CA from one computer to a second computer involves the following procedures: - Backing up the CA on the first computer - Restoring the CA on the second computer You must be a member of domain admins security group to perform the following operation. To move a CA from a server that is running Windows Server 2003 to a server that is running Windows Server 2008, you can either complete the Windows upgrade first and then move the CA or move the CA first and then upgrade Windows. - To upgrade Windows first: Upgrade the first server from Windows Server 2003 to Windows Server 2008, back up the CA on this server, and then restore the CA on a second server running Windows Server 2008. - To move the CA first: Back up the CA on a computer running Windows Server 2003, restore the CA on a second computer running Windows Server 2003, and then upgrade the second server to Windows Server 2008. To back up a CA Open the Certification Authority snap-in. In the Certification Authority snap-in, right-click the CA name, click All Tasks, and then click Back up CA to start the Certification Authority Backup Wizard. Click Next, and select the Private key and CA certificate and Certificate database and certificate database log check boxes. Specify the backup location, and then click Next. Type a password for the CA private key backup file, and type it a second time to confirm the password. then click Finish Click Start, click Run, type regedit, and then click OK. Locate and right-click the following registry subkey: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CertSvc\Configuration Click Export. Save the registry file in the CA backup folder that you used for the Certification Authority Backup Wizard. Backup the CA logs from the D:\Winnt\System32\Certlog folder, you must restore the backup to the D:\Winnt\System32\Certlog folder. After you restore the backup, you can move the CA database files to a different location. In addition of above steps back up CAPolicy.inf . If your source CA is using a custom CAPolicy.inf file, you should copy the file to the same location as the source CA backup files. The CAPolicy.inf file is located in the %SystemRoot% directory, which is usually C:\Windows. To back up a CA database and private key by using Certutil.exe Log on with local administrative credentials to the CA computer. Open a Command Prompt window. Type Certutil.exe –backupdb   and press ENTER. Type Certutil.exe –backupkey   and press ENTER. Type a password at the prompt, and press ENTER. You must retain a copy of the password to access the key during CA installation on the destination server. Type net stop certsvc and press ENTER to stop the Active Directory Certificate Services service. The service must be stopped to prevent issuance of additional certificates. After the backup completes, verify the following files in the location you specified: - CAName.p12 containing the CA certificate and private key - Database folder containing files certbkxp.dat, edb#####.log, and CAName.edb Copy all backup files to a location that is accessible from the destination server; for example, a network share or removable media. How to remove the CA role service from the source server It is important to remove the CA role service from the source server after completing backup procedures and before installing the CA role service on the destination server. Enterprise CAs and standalone CAs that are domain members store in Active Directory Domain Services (AD DS) configuration data that is associated with the common name of the CA. Removing the CA role service also removes the CA’s configuration data from AD DS. Because the source CA and destination CA share the same common name, removing the CA role service from the source server after installing the CA role service on the destination server removes configuration data that is required by destination CA and interferes with its operation. The CA database, private key, and certificate are not removed from the source server by removing the CA role service. Therefore, reinstalling the CA role service on the source server restores the source CA if migration fails and performing a rollback is required. Highly Recommended Tasks. Staging a certificate restore is most import part before you decommission existing certificate server. Create a isolated environment similar to your Active Directory Domain Services. Add new Certificate Authority and restore the database and private key. test certificates, templates, registry and private key whether it is similar to your Production infrastructure. Once you happy and restoration tasks complete successfully you can decommission certificate authority. if source certificate authority is virtual than I would recommend you to take a snapshot before you remove the CA role. - To remove the CA on a computer running Windows Server 2003, use the Add/Remove Windows Components wizard. - To remove the CA on a computer running Windows Server 2008, use the Remove Roles Wizard in Server Manager. To restore a CA on a new server from a backup copy Open Server Manager, and click Active Directory Certificate Services. Click Next two times. On the Select Role Services page, select the Certification Authority check box, and then click Next. On the Specify Setup Type page, click either Standalone or Enterprise, and then click Next. Note You must have a network connection to a domain controller in order to install an enterprise CA. On the Specify CA Type page, click the appropriate CA type, and then click Next. On the Set Up Private Key page, click Use existing private key, click Select a certificate and use its associated private key, and then click Next. On the Select Existing Certificate page, click Import, type the path of the . P12 file in the backup folder, type the password that you chose in the previous procedure to protect the backup file, and then click OK. In the Public and Private Key Pair dialog box, verify that Use existing keys is selected. Click Next two times. On the Configure Certificate Database page, specify the same location for the certificate database and certificate database log as on the previous CA computer. Click Next. On the Confirm Installation Options page, review all of the configuration settings> click Install and wait until the setup process has finished. Locate the registry file that you saved in the backup procedure, and then double-click it to import the registry settings. If the path that is shown in the registry export from the old CA differs from the new path, you must adjust your registry export accordingly. Verify the registry in the following location. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CertSvc Open the Services snap-in to stop the Active Directory Certificate Services (AD CS) service. Open the Certification Authority snap-in, right-click the CA name, click All Tasks, and then click Restore CA to open the Certification Authority Restore Wizard. 13 Click Next, and select the Private key and CA certificate and Certificate database and certificate database log check boxes. Type the backup folder location, and then click Next. Verify the backup settings. The Issued Log and Pending Requests settings should be displayed. Click Finish, and then click Yes to restart AD CS when the CA database is restored. To restore the CA database by using Certutil.exe Log on to the destination server by using an account that is a CA administrator. Open a Command Prompt window. Type certutil.exe -f -restoredb   and press ENTER. To Restoring the certificate templates list Log on with administrative credentials to the destination CA. Open a command prompt window. Type certutil -setcatemplates +  and press ENTER. Important ! Some registry parameters should be migrated without changes from the source CA computer, and some should not be migrated. If they are migrated, they should be updated in the target system after migration because some values are associated with the CA itself, whereas others are associated with the domain environment, the physical host, the Windows version, or other factors that may be different in the target system. Verify registry location and Configuration parameters are: HKEY_LOCAL_MACHINE\system\currentcontrolset\services\certsvc\Configuration - DBDirectory - DBLogDirectory - DBSystemDirectory - DBTempDirectory - DBSessionCount HKEY_LOCAL_MACHINE\system\currentcontrolset\services\certsvc\Configuration\CAname - CACertPublicationURLs - CRLPublicationURLs Granting permissions on AIA and CDP containers If the name of the destination server is different from the source server, the destination server must be granted permissions on the source server’s CDP and AIA containers in AD DS to publish CRLs and CA certificates. Complete the following procedure in the case of a server name change. To grant permissions on the AIA and CDP containers Open Active Directory Sites and Services> In the console tree, click the top node. On the View menu, click Show services node. In the console tree, expand Services, expand Public Key Services, and then click AIA. In the details pane, right-click the name of the source CA, and then click Properties. Click the Security tab, and then click Add. Click Object Types, click Computers, and then click OK. Type the name of the destination server, and click OK. In the Allow column, click Full Control, and click Apply. If the source server object is displayed in Group or user names, click the name of the source server, then click Remove, and then click OK. In the console tree, expand CDP, and then click the name of the source server. In the details pane, right-click the cRLDistributionPoint item at the top of the list, and then click Properties. Click the Security tab, and then click Add. Click Object Types, click Computers, and then click OK. Type the name of the destination server, and click OK. In the Allow column, click Full Control, and click Apply. If the source server object is displayed in Group or user names, click the name of the source server, then click Remove, and then click OK. Repeat steps 13 through 18 for each cRLDistributionPoint item. Additional procedures for failover clustering CA Role must be installed on both nodes Stop Active Directory Certificate Services from Services.msc Ensure shared storage is online. certificate store and logs must be placed in shared storage. To verify shared storage is online Log on to the destination server. Start Server Manager. In the console tree, double-click Storage, and click Disk Management. Ensure that the shared storage is online and assigned to the node you are logged on to. To configure AD CS as a cluster resource Follow Configure Microsoft Fail over Cluster URL to create and configure a cluster. Open Failover Cluster Manager from Administrative Tools> Right Click on newly created cluster node>click Configure a service or Application. If the Before you begin page appears, click Next. In the list of services and applications, select Generic Service, and click Next. In the list of services, select Active Directory Certificate Services, and click Next. Specify a service name, and click Next. Select the disk storage that is still mounted to the node, and click Next. To configure a shared registry hive, click Add, type SYSTEM\CurrentControlSet\Services\CertSvc, and then click OK. Click Next twice. Click Finish to complete the failover configuration for AD CS. In the console tree, double-click Services and Applications, and select the newly created clustered service. In the details pane, click Generic Service. On the Action menu, click Properties. Change Resource Name to Certification Authority, and click OK. If you use a hardware security module (HSM) for your CA, complete the following procedure. To create a dependency between a CA and the network HSM service Open the Failover Cluster Management snap-in. In the console tree, click Services and Applications. In the details pane, select the previously created name of the clustered service. On the Action menu, click Add a resource, and then click Generic Service. In the list of available services displayed by the New Resource wizard, click the name of the service that was installed to connect to your network HSM. Click Next twice, and then click Finish. Under Services and Applications in the console tree, click the name of the clustered services. In the details pane, select the newly created Generic Service. On the Action menu, click Properties. On the General tab, change the service name if desired, and click OK. Verify that the service is online. In the details pane, select the service previously named Certification Authority. On the Action menu, click Properties. On the Dependencies tab, click Insert, select the network HSM service from the list, and click OK. To grant permissions on public key containers: If you are migrating to a failover cluster, complete the following procedures to grant all cluster nodes permissions to on the following AD DS containers: - The AIA container - The Enrollment container - The KRA container To grant permissions on public key containers in AD DS Open Active Directory Sites and Services. In the console tree, click the top node. On the View menu, click Show services node. In the console tree, expand Services, then Public Key Services, and then click AIA. In the details pane, right-click the name of the source CA, and then click Properties. Click the Security tab, and then click Add. Click Object Types, click Computers, and then click OK. Type the computer account names of all cluster nodes, and click OK. In the Allow column, select the Full Control check box next to each cluster node, and click OK. In the console tree, click Enrollment Services. In the details pane, right-click the name of the source CA, and then click Properties. Click the Security tab, and then click Add. Click Object Types, click Computers, and then click OK. Type the computer account names of all cluster nodes, and click OK. In the Allow column, select the Full Control check box next to each cluster node, and click OK. In the console tree, click KRA. In the details pane, right-click the name of the source CA, then click Properties. Click the Security tab, and then click Add. Click Object Types, click Computers, and then click OK. Type the names of all cluster nodes, and click OK. In the Allow column, select the Full Control check box next to each cluster node, and click OK. To check the DNS name for a clustered CA in AD DS Log on to the active cluster node as a member of the Enterprise Admins group. Open ADSI Edit. On the Action menu, click Connect to. click Configuration, and click OK. In the console tree, expand Configuration\Services\Public Key Services\Enrollment Services. Double click on CN and check check dNSHostName mentioned same as Failover Cluster Management in the Failover Cluster Manager snap-in, and click OK. if not add proper FQDN DNS of cluster as shown on the screenshot. Click OK to save changes. Open dnsmgmt.msc from the start menu>run. Verify a Host (A) DNS record has been added with the same name and IP address of the Cluster. Configuring CRL distribution points for failover clusters When a CA is running on a failover cluster, the server’s short name must be replaced with the cluster’s short name in the CRL distribution point and authority information access locations. To publish the CRL in AD DS, the CRL distribution point container must be added manually. The following procedures must be performed on the active cluster node. To change the configured CRL distribution points Open registry edit and Locate the registry key \HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CertSvc\Configuration. Click the name of the CA. In the right pane, double-click CRLPublicationURLs. In the second line, replace %2 with the service name specified in step 6 of the procedure “To configure AD CS as a cluster resource.” The service name also appears in the Failover Cluster Management snap-in under Services and Applications. Restart the CA service. Open a command prompt, type certutil -CRL, and press ENTER. To create the CRL distribution point container in AD DS At a command prompt, type cd %windir%\System32\CertSrv\CertEnroll, and press ENTER. The CRL file created by the certutil –CRL command should be located in this directory. To publish the CRL in AD DS, type certutil -f -dspublish “CRLFile.crl” and press ENTER. To setup Audit on CA. Open CA MMC>Select the Certificate Server>Right Click>Click Property Check desired Events to audit>Click Ok. restart CA Services. To deploy Enterprise root CRL using GPO. Create a new group policy or use and existing GPO. Click Edit. Expand to Computer Configuration\Windows Settings\Security Settings\Public Key Policies. Right Click on trusted Root Certificates>Click Import>Locate root certificate and import the certificate. Click Close. To request Automatic Certificate request. Create a new group policy or use and existing GPO. Click Edit. Expand to Computer Configuration\Windows Settings\Security Settings\Public Key Policies. Right Click Automatic Certificate Request >Click New >Click Automatic certificate Request>Configure Certificate template and request. Follow the screenshot. Note that Auto Enroll must be allowed in the security tab of certificate template in CA. Additional references How to extend root certificate authority and subordinate CA Configure Microsoft Fail over Cluster Active Directory Certificate Services Overview
1.1 2.1 3.1 4.1 5.1 6.1 7.1 8.1 9.1 10.1 11.1 12.1 13.1 14.1 15.1 16.1 17.1 18.1 19.1 20.1 21.1 22.1 23.1 24.1 25.1 27.1 28.1 29.1 30.1 31.1 32.1 33.1 34.1 35.1 35.2 36.1 37.1 38.1 38.2 39.1 40.1 41.1 42.1 43.1 44.1 44.2 44.3 44.4 44.5 44.6 45.1 45.2 46.1 47.1 48.1 49.1 49.2 50.1 51.1 51.2 52.1 53.1 54.1 55.1 56.1 57.1 58.1 59.1 60.1 61.1 62.1 63.1 64.1 64.2 65.1 66.1 67.1 68.1 69.1 70.1 70.2 71.1 72.1 73.1 74.1 74.2 75.1 75.2 76.1 76.2 77.1 78.1 79.1 80.1 81.1 81.2 82.1 83.1 84.1 84.2 85.1 86.1 87.1 88.1 89.1 90.1 91.1 92.1 93.1 94.1 94.2 94.3 95.1 96.1 96.2 96.3 97.1 98.1 98.2 99.1 99.2 99.3 100.1 100.2 101.1 102.1 103.1 104.1 105.1 106.1 107.1 108.1 109.1 109.2 110.1 110.2 111.1 111.2 112.1 113.1 114.1 115.1 115.2 116.1 117.1 118.1 119.1 120.1 120.2 121.1 122.1 123.1 124.1 125.1 126.1 127.1 128.1 129.1 130.1 131.1 132.1 133.1 134.1 135.1 136.1 137.1 138.1 139.1 140.1 141.1 141.2 142.1 143.1 144.1 145.1 146.1 147.1 147.2 148.1 149.1 149.2 150.1 150.2 151.1 151.2 152.1 152.2 152.3 153.1 154.1 155.1 156.1 157.1 158.1 158.2 159.1 159.2 160.1 161.1 161.2 162.1 162.2 162.3 163.1 164.1 165.1 165.2 165.3 165.4 166.1 166.2 167.1 167.2 167.3 167.4 167.5 168.1 169.1 170.1 171.1 171.2 172.1 173.1 174.1 175.1 176.1 177.1 177.2 178.1 179.1 180.1 180.2 180.3 181.1 181.2 181.3 181.4 182.1 183.1 184.1 184.2 184.3 184.4 184.5 185.1 186.1 187.1 188.1 189.1 190.1 191.1 192.1 193.1 193.2 193.3 194.1 195.1 196.1 197.1 198.1 199.1 200.1 201.1 202.1 203.1 204.1 205.1 205.2 206.1 207.1 208.1 208.2 209.1 210.1 210.2 211.1 211.2 212.1 213.1 214.1 215.1 215.2 216.1 216.2 216.3 217.1 218.1 219.1 220.1 221.1 222.1 223.1 224.1 224.2 225.1 226.1 227.1 228.1 229.1 229.2 230.1 231.1 232.1 232.2 233.1 233.2 234.1 235.1 236.1 236.2 237.1 238.1 239.1 240.1 240.2 241.1 242.1 243.1 243.2 244.1 245.1 245.2 246.1 246.2 247.1 247.2 248.1 249.1 250.1 251.1 252.1 253.1 254.1 254.2 255.1 255.2 256.1 257.1 257.2 258.1 258.2 259.1 259.2 260.1 260.2 260.3 261.1 262.1 263.1 263.2 263.3 264.1 264.2 265.1 266.1 267.1 267.2 268.1 269.1 269.2 270.1 270.2 271.1 272.1 272.2 273.1 274.1 275.1 276.1 276.2 277.1 277.2 278.1 279.1 279.2 280.1 281.1 281.2 282.1 283.1 283.2 283.3 283.4 283.5 283.6 284.1 284.2 284.3 284.4 284.5 284.6 284.7 285.1 286.1 287.1 288.1 289.1 290.1 291.1 292.1 293.1 293.2 294.1 295.1 296.1 297.1 298.1
Windows Server 2008 R2 Active Directory Certificate Services Duboko Pogon Kako koristiti Certreq.exe utility za stvaranje i podnijeti zahtjev za certifikat koji uključuje SAN Napravite tekstualnu datoteku koristeći Notepad. kopirajte sljedeći sadržaj i zaljepite unutar tekstualnu datoteku i spremite kao request.inf. ; Primjerak iz ovog [Verzija] Potpis = "$ Windows NT $ [NewRequest] Tvrtka = "CN = myserver.microsoftguru.com.au"; mora biti FQDN domene kontroler EncipherOnly = FALSE; samo za Win2k3 & WinXP Izvozni = TRUE; TRUE = Privatni ključ je izvozni KeyLength = 2048; Zajednički ključ veličine: 2048, 4096, 8192, 16384 KeySpec = 1; Key Exchange KeyUsage = 0xA0; Digitalni potpis, Ključ Šifriranje MachineKeySet = True ProviderName = "Microsoft RSA SChannel Kriptografski pružatelj" ProviderType = 12 RequestType = CMC; ili PKCS10 ; Izostaviti cijeli dio ako je CA poduzeće CA [EnhancedKeyUsageExtension] OID = 1.3.6.1.5.5.7.3.1; Server Authentication OID = 1.3.6.1.5.5.7.3.2; autentifikaciju klijenta [Proširenja] ; Ako vaš klijent operativni sustav je Win2k8, Win Vista, Win7 ; SAN mogu biti uključeni u Extensions dijelu pomoću sljedeće tekstualni format. ; Napomena 2.5.29.17 je OID za SAN proširenje. _continue_ = "dns = Exchange1.microsoftguru.com.au &" _continue_ = "DN = CN = Exchange1, OU = Moji poslužitelji, DC = microsoftguru, DC = com, DC = au &" _continue_ = "url = http://myserver.microsoftguru.com.au &" _continue_ = "IPADDRESS = 172.31.10.134 &" _continue_ = " e = test@microsoftguru.com.au & " _continue_ = " UPN = test@microsoftguru.com.au & " _continue_ = "GUID = f7c3ac41-b8ce-4fb4-aa58-3d1dc0e36b39 &" ; Alternativno možete stvoriti SAN atribut koristeći skriptu dane u KB ; Koristiti format teksta ili šifriranom obliku San. 2.5.29.17 = MCaCEnd3dzAxLmZhYnJpa2FtLmNvbYIQd3d3LmZhYnJpa2FtLmNvbQ == [RequestAttributes] ; Više alternativna imena mora biti odvojen od strane ampersand (&). ; U primjeru Pokazao sam dvije različite vrste SAN. Koristite samo jednu vrstu SAN. Asterisk * yourdomainname.com.au se koristi za zamjenske potvrde. SAN = "dns = exchange1.microsoftguru.com.au & dns = www.microsoftguru.com.au&ipaddress=172.31.10.130" CertificateTemplate = Webserver ; Promijeniti naziv predloška ovisno o vašem okruženju. ; Ukloniti "," iz request.inf datoteku. file završava ovdje. Važna napomena: Neki third-party certificiranja (Na primjer ISP koji prodaju SSL certifikat) može zahtijevati dodatne informacije u temu parametra. Takve informacije uključuju e-mail adresu (e), Organizacijska jedinica (OU), Organizacija (O), lokalitete ili grad (L), država ili pokrajina (S), a zemlja ili regija (C). Možete dodati ovu informaciju Predmet ime (CN) u Request.inf datoteku. Na primjer: Tvrtka = ". E = test@microsoftguru.com.au, CN =  , OU = Moji poslužitelji, O = Microsoftguru, L = Perth, S = WA, C = AU" Izmijeniti Request.inf kao i po vašim potrebama. Za standardni certifikat zahtjev možete izostaviti SAN, [Proširenja] i [EnhancedKeyUsageExtension] odjeljak. Otvorite redak naredbe. U naredbeni redak upišite sljedeću naredbu, a zatim pritisnite tipku ENTER: certreq novi c: \ request.inf c: \ certnew.req U naredbeni redak upišite sljedeću naredbu, a zatim pritisnite tipku ENTER: certreq-podnijeti c: \ certnew.req c: \ certnew.cer Ako postoji više od jednog CA u okruženju,-config prekidač može se koristiti u naredbenog retka usmjeriti zahtjev na određenu CA. Ako ne koristite-config prekidač, od vas će biti zatraženo da odaberete CA na koje se zahtjev treba podnijeti. certreq-submit-config "DC.microsoftguru.com.au \ MYCA" c: \ certnew.req c: \ certnew.cer Koristite ID broj Zahtjev za preuzimanje certifikata. Da biste to učinili, upišite sljedeću naredbu, a zatim pritisnite tipku ENTER: certreq-retrieve RequestID c: \ certnew.cer Također možete koristiti-config prebaciti ovdje za preuzimanje certifikata zahtjev iz određenog CA. U naredbeni redak upišite sljedeću naredbu, a zatim pritisnite tipku ENTER: certreq prihvati c: \ certnew.cer Ova naredba uvozi potvrdu u odgovarajući dućan i onda povezuje certifikat s privatnim ključem koji se stvorio u prethodnom koraku. Kako konfigurirati CA prihvatiti SAN atribut iz certifikata zahtjev certutil-setreg politika \ EditFlags + EDITF_ATTRIBUTESUBJECTALTNAME2 net stop certsvc net start certsvc Za popravak potvrdu Ako koristite mrežu HSM, kompletan korake 8 do 10 za popravak povezanost između uvozne CA certifikat i privatni ključ koji je pohranjen u HSM. U stablu konzole, dvokliknite osobnih potvrda, i kliknite na uvezenu CA certifikat. Na izborniku Akcija, kliknite Otvori. Kliknite podaci karticu, kopirati serijski broj u međuspremnik, a zatim kliknite U redu. Otvorite prozor naredbenog retka, upišite certutil-repairstore moj "{Serialnumber}", a zatim pritisnite tipku ENTER. Kako bi se omogućilo sigurno certifikat upis u izdavatelj Korak1: Stvaranje request.inf datoteku koristeći Webserver predložak Korak2: Generirajte certifikat web server request.req datoteku koristeći certreq.exe alate certreq novi c: \ request.inf c: \ request.req Korak3: Podnesite request.req datoteku koristeći certreq.exe ili CA upravljačke konzole. Spremi certificate.cer Otvoreno CA MMC> Odaberite CA poslužitelja> Desni klik na CA Server> Kliknite All Zadatak> Podnijeti novi zahtjev Usmjerite mjesto c: \ request.req i podnijeti. vas će se zatražiti da spremite potvrdu. Step4: Uvoz certifikata u izdavatelj Početak Microsoftove konzole za upravljanje (MMC). Dodajte Potvrde ugriz-u da upravlja certifikate na lokalnom računalu. Proširi Potvrde (lokalno računalo), proširiti Osobno, a zatim proširite certifikate. Pravo Kliknite Uvezi certifikat ste spremili u prethodnim koracima. Step5: Otvorena IIS Management Console> Odaberite Default Web Site> Kliknite Vezovi iz Akcijskog Pan> Kliknite Dodaj> Odaberite HTTPS> Odaberite certifikat samo uvezen u prethodnom koraku. Kliknite OK. Step6: Run iisreset / ponovno pokretanje iz naredbenog retka STEP7: Test https://MYCA/certsrv Kako koristiti sigurne stranice upisa web podnijeti zahtjev za certifikat poduzeće CA Da biste poslali zahtjev certifikat koji sadrži SAN poduzeću CA, slijedite ove korake: - Otvorite Internet Explorer. U Internet Exploreru, povezati https://MYCA/certsrv . - Kliknite Zahtjev za certifikat.> Kliknite Advanced zahtjev certifikat. - Kliknite zatražiti potvrdu - Na popisu Certificate Template, kliknite Web-Server. Napomena CA mora biti konfiguriran za izdavanje certifikata Web poslužitelja. - Osigurati identificiranje informacija kao što zahtijeva. - U okviru Naziv upišite potpuno kvalificirani FQDN domene na server ime. - Pod Key Mogućnosti, postavite sljedeće mogućnosti: - Napravite novi set tipki - CSP: Microsoft RSA SChannel Kriptografski pružatelj - Korištenje ključa: Razmjena - Ključ Veličina: 1024 - 16384 - Automatski ključ kontejner ime - Spremite certifikat u lokalne računalne certifikata trgovine Pod naprednim opcijama, podešavanje formata zahtjev za CMC. U Atributi upišite željene SAN atribute. SAN pripisuje se u sljedećem obliku: san: dns = dns.name [& dns = dns.name] Više DNS imena su razdvojeni ampersand (&). Na primjer, ako naziv poslužitelja je myserver.microsoftguru.com.au i alias su autodiscover.microsoftguru.com.au i webamil.microsoftguru.com.au, ta imena moraju biti uključeni u SAN atributa. Rezultiralo atribut string pojavljuje se kako slijedi: san: dns = myserver.microsoftguru.com.au & dns = myweb.microsoftguru.com.au & dns = mysite.microsoftguru.com.au Kliknite Submit. Ako vidite potvrda izdavanja web-stranicu, kliknite Instalirajte ovo certifikat. Moj preferirani način zatražiti potvrdu je stvoriti. REQ datoteku prikazano u prethodnim koracima. otvoriti. REQ datoteku u notepad i kopirati sadržaj. kliknite podnijeti zahtjev za certifikat pomoću bazu 64-kodiranje Lijepljenje sadržaja u bazu 64-kodirati. Odaberite predložak za web-poslužitelje. kliknite submit. Sada dobivanje certifikata kliknite da. preuzeti certifikat s root CA CRL kliknite Preuzimanje certifikata lanac u p7b formatu preuzeti samo potvrdu kliknite preuzeti certifikat i spasiti. Kako konfigurirati privatni ključ Certificate Authority i izvoz privatni ključ Otvoreno CA MMC iz Administrativni alati> Desni klik na Certifikat Template> Kliknite Upravljanje Odaberite Webserver predložak> Desni klik na Webserver Template> Kliknite Dvostruki predlošku> Odaberite Win2k3 ili Win2k8 OS Version> Vrsta Naziv predloška kao Webserver s privatnim ključem u Glavnoj Tab Kliknite karticu obrade zahtjeva> Provjerite Dopustite privatni ključ koji se izvoze Kliknite Security Tab> Dopustite odgovarajuće osiguranje za osobu koja će se upisati i izvoz certifikata Kliknite U redu. Zatvorite CA MMC. Stvaranje Request.inf poslužitelja. Stvaranje Request.req datoteku Slanje Webserver zahtjev https://myca/certsrv . Preuzmite i instalirajte potvrdu. Za izvoz certifikat s privatnim ključem 1.Open Upravitelj certifikata klikom gumb Start> Okvir za pretraživanje> Vid certmgr.msc, a zatim pritisnite tipku ENTER. Idi na Certifikati-trenutni korisnik \ Osobna \ Certifikati> Odaberite potvrda želite izvoziti. Na izborniku Akcija, pokažite na Svi zadaci, a zatim kliknite Izvoz. U čarobnjaku za izvoz certifikata, kliknite Da, izvesti privatni ključ. Imajte na umu da je ova opcija će se pojaviti samo ako je privatni ključ označen kao izvozni u request.inf datoteku i imate pristup privatnim ključem. Pod Export File Format, učinite jedno ili sve od sljedećeg, a zatim kliknite Dalje. - Da su sve certifikate u certificiranja putu, odaberite Uključi sve certifikate u certificiranja put, ako je to moguće okvir. - Za brisanje privatni ključ, ako izvoz je uspješna, odaberite Izbriši privatni ključ, ako izvoz je uspješan potvrdni okvir. U lozinku, upišite lozinku za šifriranje privatni ključ se izvozi. U Potvrdi lozinku, upišite istu lozinku, a zatim kliknite Dalje. U File name upišite naziv datoteke i stazu za PKCS # 12 datoteke koje će pohraniti izvezenu certifikat i privatni ključ, kliknite Dalje, a zatim kliknite Završi. Kako uvesti osobni ključ Kliknite izbornik Start> Okvir za pretraživanje> Kliknite mmc.msc> Kliknite Certifikati> Dodaj Računalo račun> Kliknite OK. Kliknite na mapu, kliknite Akcijski izbornika, pokažite na Svi zadaci, a zatim kliknite Uvoz. Dođite do mjesta gdje se izvozi certifikate> Odaberite potvrda> Osigurati lozinku za uvoz certifikata. Kliknite na Next, a zatim slijedite upute. Igranje s AD CS uprave cmdlets u Windows PowerShell Sljedeći Windows PowerShell ® cmdlets da su za korištenje u administriranje Active Directory Services certifikat (AD CS) Certification Authority (CA) Uloga usluga u sustavu Windows Server ® "8" Beta. - Uvoz-Modul ServerManager - Uvoz modul Server Manager koji pruža Add-WindowsFeature cmdlet. - Add-WindowsFeature ADC-Cert-tijelo - Dodaje Certification Authority ulogu usluge binaries. - Dodaj WindowsFeature ADC-Upisati-web-Pol - Dodaje certifikata Enrllment privatnosti web usluga binaries. - Dodaj WindowsFeature ADC-Upisati-web-SVC - Dodaje certifikata upis web usluga binaries. - Dodaj WindowsFeature ADC-web-Upis - Dodaje Certification Authority web upis ulogu usluga binaries. - Dodaj WindowsFeature ADC-uređaja-Upis - Dodaje Network Device upis Usluga binaries. - Dodaj WindowsFeature ADC-Online-Cert - Dodaje Online responder ulogu usluge binaries. - Get-Command-Modul AdcsDeployment - Prikazuje sve cmdleta koje su povezane s AD CS Deployment. Disaster recovery ili seliti postupak Active Directory Certificate Authority: Premještanje CA s jednog računala na drugo računalo uključuje sljedeće postupke: - Backup CA na prvom računalu - Vraćanje CA na drugom računalu Morate biti član domene administratori grupe sigurnosti za obavljanje sljedeću operaciju. Za premještanje CA s poslužitelja sa sustavom Windows Server 2003 na poslužitelju sa sustavom Windows Server 2008, možete završiti Windows nadogradnju, a zatim premjestiti CA ili premjestiti CA prvi, a zatim nadograditi Windows. - Za nadogradnju sustava Windows prvi: Nadogradnja prvi poslužitelj s Windows Server 2003 Windows Server 2008, back up CA na ovom poslužitelju, a zatim vratiti CA na drugom poslužitelju sa sustavom Windows Server 2008. - Za pomicanje CA prvi: Back up CA na računalu sa sustavom Windows Server 2003, vraćanje CA na drugom računalu sa sustavom Windows Server 2003, a zatim nadograditi drugi poslužitelj na Windows Server 2008. Za back up CA Otvorite Certification Authority ugriz-u. U Certification Authority ugriz-u, desnom tipkom kliknite CA ime, kliknite na Svi zadaci, a zatim natrag do CA početi Certification Authority čarobnjak Backup. Kliknite na Dalje i odaberite privatni ključ i certifikat CA i potvrda podataka i potvrda podataka dnevnik okvire. Navedite rezervnu lokaciju, a zatim kliknite Dalje. Unesite lozinku za CA privatni ključ backup datoteku i upišite ga drugi put za potvrdu zaporke. zatim Završi Kliknite Start, zatim Run, upišite regedit, a zatim kliknite U redu. Pronađite i desnom tipkom miša sljedeće potključ: HKEY_LOCAL_MACHINE \ SYSTEM \ CurrentControlSet \ Services \ CertSvc \ konfiguracije Kliknite Export. Spremite datoteku registra u mapi CA backup koji ste koristili za backup Certification Authority čarobnjaku. Backup CA rezanje iz D: \ WinNT \ System32 \ Certlog mapu, morate vratiti backup na D: \ Winnt \ System32 \ Certlog mape. Nakon što vratite backup, možete premjestiti CA datoteke baze podataka na drugo mjesto. Osim toga od gore navedenih koraka natrag gore CAPolicy.inf. Ako je vaš izvor CA koristi prilagođeni CAPolicy.inf datoteku, trebali kopirati datoteku na istom mjestu kao izvor CA backup datoteka. CAPolicy.inf datoteka nalazi u direktoriju% systemroot%, što je obično C: \ Windows. Za kopiju CA baze podataka i privatni ključ pomoću Certutil.exe Prijavite se s lokalnim upravnim vjerodajnicama za CA računalo. Otvorite prozor naredbenog retka. Tip Certutil.exe-backupdb   i pritisnite ENTER. Tip Certutil.exe-backupkey   i pritisnite ENTER. Unesite lozinku na brz i pritisnite ENTER. Morate zadržati kopiju lozinku za pristup ključ tijekom CA instalacije na odredište poslužitelju. Tip net stop certsvc i pritisnite ENTER za zaustavljanje Active Directory Certificate Services uslugu. Usluga mora biti zaustavljen kako bi se spriječilo izdavanje dodatnih certifikata. Nakon backup završi, provjerite sljedeće datoteke u lokaciji koju ste naveli: - CAName. P12 sadrži CA certifikat i privatni ključ - Baza mapa sadrži datoteke certbkxp.dat, EDB # # # # #. Dnevnik, i CAName. EDB Kopirajte sve datoteke backup na mjesto koje je dostupno od odredišnog poslužitelja, na primjer, mrežni udio ili izmjenjivi medij. Kako ukloniti uslugu CA ulogu iz izvornog poslužitelja Važno je da uklonite uslugu CA ulogu iz izvornog poslužitelja nakon završetka sigurnosne procedure, a prije instalacije uslugu CA ulogu na odredište poslužitelju. Enterprise CA i samostalne CA koje su domene članovi dućan u Active Directory Services domenu (AD DS) podatke o konfiguraciji koja je povezana sa zajedničkim imenom CA. Uklanjanje uslugu CA ulogu također uklanja CA je konfiguracijske podatke iz AD DS. Jer izvor CA i odredište CA dijele isti zajednički naziv, uklanjanjem uslugu CA ulogu iz izvornog poslužitelja nakon instalacije uslugu CA ulogu na mjestu poslužitelja uklanja konfiguracijske podatke koji se zahtijevaju odredište CA i ometa njegov rad. CA baze podataka, privatni ključ, a potvrdu nisu uklonjeni iz izvornog poslužitelja uklanjanjem uslugu CA ulogu. Stoga, reinstalirati uslugu CA ulogu na izvornom poslužitelju vraća izvorni CA, ako ne uspije migracija i obavljanje rollback je potrebno. Visoko preporučeno Zadaci. Uprizorenja potvrdu vraćanja je najviše uvoz dio prije nego što dekomisije postojećeg certifikata poslužitelja. Stvaranje izolirani okoliš sličan svoje Active Directory Domain Services. Dodaj novi potvrde ovlasti i vraćanje baze podataka i privatni ključ. ispitni certifikati, predlošci, registra i privatni ključ da li je slična vašoj proizvodnje infrastrukture. Jednom ste sretni i obnova zadatke uspješno se možete dekomisije potvrda. ako izvor potvrda je virtualna nego ja bih vam preporučiti da se snimak prije nego što uklonite CA ulogu. - Za uklanjanje CA na računalu sa sustavom Windows Server 2003, koristiti Add / Remove Windows Components čarobnjaka. - Za uklanjanje CA na računalu sa sustavom Windows Server 2008, koristite Ukloni uloge čarobnjaka u Server Manager. Za vraćanje CA na novi server iz sigurnosne kopije Otvorite Server Manager i kliknite Active Directory Services certifikata. Kliknite Dalje dva puta. Na Select Role Services stranici, potvrdite okvir tijelo za izdavanje certifikata, a zatim kliknite Dalje. Na Type Navedite stranici za postavljanje, kliknite bilo samostalni ili Poduzetništvo, a zatim kliknite Dalje. Napomena Morate imati mrežnu vezu s kontrolerom domene kako bi se instalirati poduzeća CA. Na Određivanje CA Type stranici, kliknite odgovarajući CA tip, a zatim kliknite Dalje. Na Postavljena Private Key stranici, kliknite Koristi postojeći privatni ključ, kliknite Odaberite certifikat i koristiti svoje pridružene privatni ključ, a zatim kliknite Dalje. Na Odabir postojeće Svjedodžbe stranici, kliknite Uvoz, upišite putanju. P12 datoteke u backup mapu, upišite lozinku koju ste odabrali u prethodnom postupku za zaštitu backup datoteku, a zatim kliknite U redu. U javnog i privatnog par ključeva dijaloškom okviru, provjerite koje koriste postojeći ključevi je odabran. Kliknite Dalje dva puta. Na Database Konfiguracija certifikata stranici, navesti istu lokaciju za potvrdu podataka i certifikata baze prijaviti kao na prethodnoj CA računalo. Kliknite Dalje. Na Confirm Installation Options stranici, pregledati sve postavke konfiguracije> kliknite Instaliraj i pričekajte postava je proces završen. Pronađite registra datoteku koju ste spremili u backup postupka, a zatim dvokliknite ga uvesti postavke registra. Ako put koji je prikazan u registru izvoz iz starog CA razlikuje od novog puta, morate prilagoditi svoj registra izvoz u skladu s tim. Provjerite registra na sljedećem mjestu. HKEY_LOCAL_MACHINE \ SYSTEM \ CurrentControlSet \ Services \ CertSvc Otvorite Services ugriz-u da zaustavi Active Directory Services certifikat (AD CS) usluga. Otvorite tijelo za certifikaciju ugriz-u, desnom tipkom kliknite CA ime, kliknite na Svi zadaci, a zatim kliknite Vrati CA otvoriti Certification Authority Restore Wizard. Kliknite Dalje, a zatim i privatni ključ i certifikat CA i potvrda baze podataka i potvrdu baze dnevnik okvire. Unesite rezervnu lokaciju mape, a zatim kliknite Dalje. Provjerite sigurnosne postavke. Izdano Zapisnik i neriješenih zahtjeva postavke bi trebao biti prikazan. Kliknite Završi, a zatim Da za ponovno pokretanje AD CS kada CA baza podataka je obnovljena. Za vraćanje CA bazu podataka pomoću Certutil.exe Prijavite se na odredišnom poslužitelju pomoću računa da je CA administrator. Otvorite prozor naredbenog retka. Tip certutil.exe-f-restoredb   i pritisnite ENTER. Za Vraćanje popisa certifikata predložaka Prijavite se s administratorskim ovlastima na odredište CA. Otvorite prozor naredbenog retka. Tip certutil-setcatemplates +   i pritisnite ENTER. Važno! Neki registra parametri trebaju biti premješten bez promjena iz računala izvora CA, a neki ne bi trebao biti premješten. Ako su oni doselili, oni bi trebali biti ažurirana u ciljnom sustavu nakon migracije, jer su neke vrijednosti povezane s CA sama, dok su ostali povezani s domenskog okruženja, fizičkog host, Windows verziju, ili drugih čimbenika koji mogu biti različiti u meta sustav. Provjerite registra položaj i Konfiguracijski parametri su: HKEY_LOCAL_MACHINE \ System \ CurrentControlSet \ Services \ certsvc \ konfiguracije - DBDirectory - DBLogDirectory - DBSystemDirectory - DBTempDirectory - DBSessionCount HKEY_LOCAL_MACHINE \ System \ CurrentControlSet \ Services \ certsvc \ Configuration \ CAname - CACertPublicationURLs - CRLPublicationURLs Davanje dozvole na AIA i CDP kontejnera Ako naziv odredišnog poslužitelja razlikuje od izvornog poslužitelja, poslužitelj odredište mora biti odobren dozvole na izvoru poslužitelja CDP i AIA kontejnera u AD DS objaviti CRLs i CA certifikate. Ispunite sljedeći postupak u slučaju promjene imena poslužitelja. Za dodjelu dozvole za AIA i CDP kontejnera Otvorite Active Directory stranice i usluge> U stablu konzole, kliknite gornji čvor. Na izborniku Pogled, kliknite Pokaži mi usluge čvor. U stablu konzole proširite usluge, proširiti Public Key Services, a zatim AIA. U oknu detalja, desnom tipkom miša kliknite naziv izvora CA, a zatim kliknite Svojstva. Kliknite karticu Sigurnost, a zatim kliknite Dodaj. Kliknite vrste objekata, kliknite Računala, a zatim kliknite U redu. Unesite naziv odredišne server, i kliknite OK. U Dopusti stupcu, kliknite na punu kontrolu, i kliknite Apply. Ako objekt izvor poslužitelja je prikazana u grupe ili korisnik imena, pritisnite naziv izvornog poslužitelja, a zatim kliknite Ukloni, a zatim kliknite U redu. U stablu konzole proširite CDP, a zatim kliknite naziv izvornog poslužitelja. U oknu detalja, desnom tipkom miša kliknite stavku cRLDistributionPoint na vrhu popisa, a zatim kliknite Svojstva. Kliknite karticu Sigurnost, a zatim kliknite Dodaj. Kliknite vrste objekata, kliknite Računala, a zatim kliknite U redu. Unesite naziv odredišne poslužitelja, a zatim kliknite OK. U Dopusti stupcu, kliknite na punu kontrolu, i kliknite Apply. Ako objekt izvor poslužitelja je prikazana u grupe ili korisnik imena, pritisnite naziv izvornog poslužitelja, a zatim kliknite Ukloni, a zatim kliknite U redu. Ponovite korake 13 do 18 za svaku stavku cRLDistributionPoint. Dodatne procedure za failover clustering CA Uloga mora biti instaliran na oba čvorova Zaustavite Active Directory Services iz services.msc certifikata Osigurati zajednički prostor za pohranu je online. Potvrda trgovine i trupci moraju biti postavljeni u zajedničkom pohranu. Da biste provjerili zajedničku pohranu je online Prijavite se na odredišnom poslužitelju. Početak Server Manager. U stablu konzole, dvokliknite prtljage, i kliknite Disk Management. Uvjerite se da zajednički prostor za pohranu je online i dodijeljen čvora ste prijavljeni na. Za konfiguriranje AD CS kao klaster resurs Slijedite Konfiguracija Microsoft Fail preko klastera URL stvoriti i konfigurirati klastera. Otvoreno Failover Cluster Manager od Administrativni alati> Desni klik na novonastale čvoru klastera> kliknite Konfiguriraj uslugu ili aplikacija. Ako Prije nego što počnete Pojavit će se stranica, kliknite Dalje. Na popisu servisa i aplikacija, odaberite Generic usluga, a zatim kliknite Dalje. Na popisu usluga, odaberite Active Directory Services certifikata, a zatim kliknite Dalje. Navedite naziv usluge, a zatim kliknite Dalje. Odaberite disk za pohranu podataka koji se još uvijek je priključena na čvoru, a zatim kliknite Dalje. Za konfiguriranje zajedničku grozd registra, kliknite Dodaj, putovanja SYSTEM \ CurrentControlSet \ Services \ CertSvc, a zatim kliknite U redu. Kliknite Sljedeća dva puta. Kliknite Završi da biste dovršili failover konfiguraciju za AD CS. U stablu konzole, dvokliknite Usluge i aplikacije, a zatim novostvoreni klaster uslugu. U oknu s detaljima, kliknite Generic usluga. Na izborniku Akcija, kliknite Svojstva. Promijenite naziv resursa za Certification Authority, i kliknite OK. Ako koristite modul hardverski sigurnosti (HSM) za CA, provedite sljedeći postupak. Da biste stvorili ovisnost između CA i mreže HSM uslugu Otvorite Upravljanje Failover ugriz-u klaster. U stablu konzole, kliknite uslugama i aplikacijama. U oknu detalja, odaberite prethodno stvorili ime grupirani uslugu. Na izborniku Akcija, kliknite Dodaj resurs, a zatim Generic usluga. U popisu dostupnih usluga prikazanih od strane New Resource čarobnjaka, kliknite naziv usluge koja je instalirana na spajanje na mrežu HSM. Kliknite Sljedeća dva puta, a zatim kliknite Završi. Pod uslugama i aplikacijama u stablu konzole, kliknite na ime u klasterima usluga. U oknu detalja, odaberite novostvoreni Generic usluga. Na izborniku Akcija, kliknite Svojstva. Na kartici Općenito, promijeniti naziv usluge po želji i kliknite OK. Provjerite da je usluga online. U oknu detalja, odaberite uslugu prethodno nazivom tijela za izdavanje certifikata. Na izborniku Akcija, kliknite Svojstva. Na Ovisnosti kartici, kliknite Umetni, odaberite mrežnu HSM uslugu s popisa, a zatim kliknite U redu. Za dodjelu dozvole na javnim ključnih kontejnera: Ako ste migraciju na failover cluster, dovršiti sljedeće postupke za odobrenje svih klastera čvorova dozvole da na sljedećem AD DS kontejnere: - AIA kontejner - Upis kontejner - KRA kontejner Za dodjelu dozvole na javnim ključnih kontejnera u AD DS Otvorite Active Directory stranica i servisa. U stablu konzole, kliknite gornji čvor. Na izborniku Pogled, pritisnite Pokaži usluge čvor. U stablu konzole proširite usluge, onda Public Key Services, a zatim AIA. U oknu detalja, desnom tipkom miša kliknite naziv izvora CA, a zatim kliknite Svojstva. Kliknite karticu Sigurnost, a zatim kliknite Dodaj. Kliknite vrste objekata, kliknite Računala, a zatim kliknite U redu. Upišite imena računala svih klastera čvorova računa, i kliknite OK. U Dopusti stupcu, odaberite Cijeli okvir za upravljanje potvrdni pored svake čvoru klastera, i kliknite OK. U stablu konzole, kliknite učlanjenja Services. U oknu detalja, desnom tipkom miša kliknite naziv izvora CA, a zatim kliknite Svojstva. Kliknite karticu Sigurnost, a zatim kliknite Dodaj. Kliknite vrste objekata, kliknite Računala, a zatim kliknite U redu. Upišite imena računalnih računa svih klastera čvorova, a zatim kliknite U redu. U Dopusti stupcu, odaberite Cijeli okvir za upravljanje pored svake čvoru klastera, i kliknite OK. U stablu konzole, kliknite KRA. U oknu detalja, desnom tipkom miša kliknite naziv izvora CA, a zatim kliknite Svojstva. Kliknite karticu Sigurnost, a zatim kliknite Dodaj. Kliknite vrste objekata, kliknite Računala, a zatim kliknite U redu. Upišite imena svih klastera čvorova, i kliknite OK. U Dopusti stupcu, odaberite Cijeli okvir za upravljanje pored svake čvoru klastera, i kliknite OK. Za provjeru DNS ime za klasteriranoj CA u AD DS Prijavite se na aktivnom čvoru klastera kao član grupe Enterprise admina. Otvorite ADSI Edit. Na izborniku Akcija, kliknite Povezivanje. kliknite Configuration, a zatim kliknite U redu. U stablu konzole proširite konfiguracije \ Usluge \ Public Key Usluge \ Services učlanjenja. Dvaput kliknite na CN i provjerite provjerite dNSHostName spominje isti kao Failover Cluster Management u upravitelju Failover Cluster ugriz-u, a zatim kliknite U redu. ako ne dodati odgovarajuće FQDN DNS u klasteru kao što je prikazano na slici. Kliknite OK za spremanje promjena. Otvoreno dnsmgmt.msc iz izbornika Start> run. Provjerite Host () DNS zapis je dodala s istim imenom i IP adresa klasteru. Konfiguriranje CRL distribucijske točke za failover clustera Kada CA radi na failover cluster, poslužitelj je kratko ime mora biti zamijenjen sa grozda kratkom ime u CRL distribucijske točke i ovlasti informacijskog pristupa lokacijama. Za objavljivanje CRL u AD DS, CRL distribucija točka kontejner moraju biti dodan ručno. Sljedeći postupci moraju biti izvedena na aktivnom čvoru klastera. Da biste promijenili konfigurirani CRL distribucijske točke Otvoreno registar uređivanje i pronađite ključ registra \ HKEY_LOCAL_MACHINE \ System \ CurrentControlSet \ Services \ \ CertSvc Configuration. Kliknite na naziv CA. U desnom oknu dvokliknite CRLPublicationURLs. U drugom redu, zamijenite% 2 s imenom usluge navedene u koraku 6. postupka "Za konfiguriranje AD CS kao klaster resurs." Usluge Naziv se također pojavljuje u upravljanju Failover Cluster ugriz-u pod uslugama i aplikacijama. Ponovo CA uslugu. Otvorite naredbeni redak upišite certutil-CRL, i pritisnite ENTER. Za izradu CRL distribucijske točke kontejner u AD DS U naredbeni redak upišite cd% windir% \ System32 \ CertSrv \ CertEnroll, a zatim pritisnite ENTER. CRL datoteka stvorio certutil-CRL naredbe bi trebao biti smješten u ovaj direktorij. Za objavljivanje CRL u AD DS, vrsta certutil-f-dspublish "CRLFile.crl" i pritisnite ENTER. Za postavljanje revizije na CA. Otvoreno CA MMC> Odaberite certifikat Server> kliknite desnom tipkom> Kliknite nekretnine Provjerite željene Događanja za reviziju> Kliknite OK. ponovo CA Services. Za implementaciju CRL Enterprise root koristeći GPO. Stvoriti novu grupu politiku ili korištenje i postojeće GPO. Kliknite na Uredi. Proširi na Computer Configuration \ Windows Settings \ Security Settings \ Public Key politike. Pravo Kliknite na Pouzdane korijenske potvrde> Kliknite Import> Pronađite root certifikat i uvesti certifikat. Kliknite Zatvori. Da biste zatražili Automatski zahtjev za izdavanje potvrda. Stvaranje nove grupe politiku ili korištenje i postojeće GPO. Kliknite na Uredi. Proširi na Computer Configuration \ Windows Settings \ Security Settings \ Public Key politike. Pravo Kliknite automatski zahtjev Certifikat> Kliknite New> Kliknite Automatski certifikat Zahtjev> Konfiguracija certifikata predložak i zahtjev. Slijedite screenshot. Imajte na umu da Auto Upisati mora biti dopušteno u sigurnosnom kartici potvrde predložak u CA. Dodatne reference Kako produžiti ovlasti root certifikat i podzakonskih CA Konfiguracija Microsoft Fail preko Klastera System Center Virtual Machine Manager 2012 Beta prvi pogled Sustavi Zahtjev: - Windows Server 2008 R2 x64 član domene - Windows Remote Management (WinRM) 2,0 - Windows PowerShell 2,0 - Microsoft. NET Framework 3.5 Service Pack 1 (SP1) - Windows AIK za Windows 7 - SQL Server 2008 ili SQL Server 2008 R2 - WDS i WSUS uloge instalirani Instalacija System Center Virtual Machine Manager 2012: System Center Virtual Machine Manager 2012 Beta - Procjena (VHD)