Implementing Public Key Infrastructure

An Overview on the Public Key Infrastructure (PKI)

A set of components, standards, and protocols make up the Public Key Infrastructure (PKI), which protects data as it is transmitted over the network. The PKI is an integral aspect of security within a network. Digital certificates form the basis of the PKI because these certificates use cryptographic algorithms and key lengths to protect data as it is transmitted over the network.

The more important components of the PKI are summarized below:

While you can use third party entity CAs for the PKI implementation within your organization, the management of certificates through such entities could become complicated, and take quite some time. This is especially true for organizations which are quite large in size. With a Windows PKI implementation, you can create and manage your own internal PKI structure in the organization. This would enable you to create, manage, and audit digital certificates in your environment. Tools are available for creating and managing digital certificates in Active Directory. You can monitor certificates, and revoke them as the need arises. The strategy that you would use for your PKI implementation is ultimately determined by the security requirements of the organization, and the location of its users.

The Windows Server 2003 Public Key Infrastructure (PKI) is based on the following standards:

The remainder of this Article focuses on implementing and configuring a PKI in your organization, using the available graphical interface tools. There are command-line utilities which you can use to manage certificates and CAs. The Certification Authority management console is however considered the best tool for managing the CAs within your PKI implementation. The command-line utilities which you can use are listed below:

How to install Windows Server 2003 certificate services (enterprise root CA)

  1. Place the Windows 2003 CD-ROM into the CD-ROM drive.
  2. Select Install optional Windows components.
  3. This action launches the Windows Components Wizard.
  4. On the Wizard Components page, select Certificate Services.
  5. Click Yes in the message dialog box that warns that you would not be able to modify the name of the server.
  6. In the CA Type page, select Enterprise Root CA. Click Next.
  7. In the CA Identifying Information page, set the common name for the CA. This name will be used in Active Directory, and in the enterprise.
  8. In the Validity Period boxes, enter the lifetime for the CA. Click Next.
  9. On the Certificate Database Settings page, verify that the locations specified for the database file and log files are correct.
  10. At this stage IIS services are stopped, and the certificate service is installed and the CA database started. IIS is restarted after this.
  11. Click OK when a message dialog box appears, warning that ASP must be enabled for Web enrollment.
  12. Click Finish.

How to use Web enrollment to request a certificate

  1. Use Internet Explorer 5.0 or later to connect to the CA.
  2. In the Web browser’s Address windows, enter http:// <servername>/certsrv, and press Enter.
  3. On the Certification Services Welcome page, click Request a Certificate.
  4. The following page presents the User certificate option with an Advanced Certificate Request option for acquiring a smart card certificate.
  5. Click the Advanced Certificate Request option.
  6. When the Advanced Certificate Request page appears, click Create And Submit A Request To This CA.
  7. Select Web Server from the Certificate Template list box.
  8. Proceed to provide the necessary information in the Identifying Information For Offline Template section of the page.
  9. Click Submit.
  10. Click Yes if a message is displayed on a potential scripting violation.
  11. After the server processes the certificate, you are presented with a Certificate Issued page that allows you to install the certificate on the Web server.
  12. Click Install This Certificate to complete the process.

How to install a stand-alone root CA

  1. Click Start, Control Panel, and click Add Or Remove Programs.
  2. Select Add/Remove Windows Components in the Add Or Remove Programs dialog box.
  3. When the Windows Components Wizard starts, click Certificate Services, and click Details.
  4. In the Certificate Services dialog box, enable the Certificate Services CA checkbox, and enable the Certificate Services Web Enrollment Support checkbox.
  5. Click Yes to the message warning that the name of the CA cannot be changed.
  6. Click OK to close the Certificate Services dialog box.
  7. Click Next in the Windows Components Wizard.
  8. When the CA Types page appears, select Stand-alone Root CA. Click Next.
  9. On the CA Identifying Information page, enter a name for the CA in the Common Name For This CA box. Click Next.
  10. You can accept or change the default settings in the Certificate Database Settings page. Click Next.
  11. The certificate service is installed and the CA database started. IIS is restarted after this.
  12. Click OK if a message dialog box appears, warning that ASP must be enabled for Web enrollment.
  13. Click Finish.

An Overview on Certificate Templates

With a Windows PKI implementation, certificate templates are used to assign certificates, according to the purpose for which they are to be used. Certificate templates can be defined as a set of rules and settings which specify the content and format of certificates that are issued, based on intended use. You configure certificate templates on the CAs within your PKI implementation. The certificate template is applied when a user requests a certificate from the CA. When a user requests a certificate, the user basically selects types of certificates as specified by certificate templates. You should customize the default certificate templates according to its intended use before you deploy them within your environment. The security requirements of your organization, ultimately determines which types of security templates should be deployed within your organization. Default certificates are provided for users, computers, code signing, and Encrypting File System (EFS).

The certificate templates also stipulate how a valid certificate request should be submitted to the CA. From this short discussion, you can conclude that certificate templates ease the management process of certificates, because it can be used to automate the process of issuing certificates, based on the requirements set by the Administrator. Windows Server 2003 includes the new auto-enrollment feature which allows for the issuing of User certificates when the user logs on to a Windows Server 2003 client.

Certificate templates are also used to manage whether security principals are allowed to enroll, auto-enroll, or read certificates, according to the particular certificate template. Each certificate template has an access control list (ACL) which specifies permissions for security principals for the particular certificate template. The Certificate Templates snap-in is used to define permissions for certificate templates.

Because different certificate templates can be used for different users, and they can be used by an assortment of applications; you can define application policies. An application policy allows you to specify the manner in which a certificate template can be used, and with what applications. In order to use a certificate template, the certificate template's definition has to be published in Active Directory, so that it is available to all CAs in your Active Directory forest. To enable this, certificate template information should be stored in Active Directory. Active Directory replication would distribute the certificate template's definition to each CA within your PKI implementation.

Windows Server 2003 supports the following certificate template types:

The methods which can be used to modify an existing version 2 certificate template are listed below:

As mentioned preciously, Windows Server 2003 includes default user certificate templates. These certificate templates are Version 1 certificate templates, and are listed below:

Windows Server 2003 also includes default computer certificate templates. Some of these certificate templates are Version 1 certificate templates, while others are Version 2 certificate templates:

A few other default templates are also available in Windows Server 2003:

As mentioned previously, the permissions defined on certificate templates determine what actions security principals can perform on the certificates.

How to configure certificate templates for auto-enrollment requests

The requirements listed below have to be met, before you can use the auto-enrollment feature included with Windows Server 2003.

To configure auto-enrollment:

  1. Click Start, Administrative Tools, and then click Certification Authority.
  2. Right-click Certificate Templates and then click Manage to open the management tool for certificate templates.
  3. To create a certificate template for auto-enrolled users, you can choose to create a new certificate template, or you can alternatively modify an existing certificate template.
  4. Right-click User Template, and then click Duplicate Template on the shortcut menu.
  5. When the Properties of New Template dialog box appears, enter a suitable name in the Template Display Name box.
  6. Click the Security tab, choose the users, or groups that should be allowed to auto-enroll; and set the appropriate permissions (Autoenroll, Enroll, Read).
  7. Click OK.
  8. Exit the certificate templates management tool.
  9. The following step is to configure the CA to issue auto-enrollment certificates to the users/groups that you specified.
  10. In the Certification Authority management tool, right-click Certificate Templates, and click New, and then Certificate Template to Issue on the shortcut menu.
  11. Select User Autoenrollment from the list of available certificate templates.
  12. Click OK.
  13. The following step is to enable users in the Group Policy Object (GPO) to auto-enroll.
  14. Click Start, Administrative Tools, and open the Active Directory Users and Computers console.
  15. Proceed to locate and right-click the appropriate domain, and then click Properties on the shortcut menu.
  16. When the Properties dialog box for the domain opens, click the Group Policy tab, and click Edit.
  17. In the console tree, open Public Key Policies by clicking User Configuration, Windows Settings, Security Settings, and then clicking Public Key Policies.
  18. Double-click Autoenrollment Settings in the details pane.
  19. When the Autoenrollment Settings Properties dialog box opens, verify that the Enroll Certificates Automatically option is selected.
  20. Proceed to enable the Renew expired certificates, update pending certificates, and remove revoked certificates checkbox, and also enable the Update certificates that use certificate templates checkbox.
  21. Click OK.
  22. Exit the Active Directory Users and Computers console.

How to supersede existing certificate templates

  1. Click Start, Administrative Tools, and then click Certification Authority.
  2. Right-click Certificate Templates and then click Manage to open the management tool for certificate templates.
  3. Right-click User Template, and then click Duplicate Template on the shortcut menu.
  4. When the Properties of New Template dialog box appears, enter a name in the Template Display Name box.
  5. Set the validity period.
  6. Click the Extensions tab.
  7. Click Application Policies. Click Edit.
  8. When the Edit Application Policies Extension dialog box opens, click Add.
  9. When the Add Application Policy dialog box opens, under Application Policies, choose the appropriate application policy. Click OK.
  10. The application policy which you chose should now be displayed in the Edit Application Policies Extension dialog box.
  11. Click the Superseded Templates tab, and click Add.
  12. When the Add Superseded Template dialog box opens, click the appropriate application policies, including the one you have previously selected, and then click OK.
  13. Click the Security tab, click Add, choose the appropriate group and then set the appropriate permissions (Read, Enroll, and Autoenroll). Click OK.
  14. Open the Certification Authority console.
  15. Right-click Certificate Templates, and click New, and then select Certificate Template To Issue on the shortcut menu.
  16. Select the group you previously selected in the Enable Certificate Templates dialog box.
  17. Click OK.

How to revoke a certificate

The following methods can be used to revoke a certificate:

  1. The Certification Authority snap-in
  2. The Certutil.exe command-line utility

To revoke a certificate:

How to publish revoked certificates through CRLs

The CRL has to be published so that your users are aware that the certificate has been revoked. Windows Server 2003 includes two methods for the publishing a CRL.

The default configuration with regard to the scheduled publication of revoked certificates is as follows:

To change these default settings

  1. Click Start, Administrative Tools, and then click Certification Authority.
  2. Right-click Revoked Certificates, and click Properties on the shortcut tab.
  3. Click the CRL Publishing parameters tab.
  4. Change the settings to suit your requirements.
  5. Click OK.

Working with Public Key Group Policy

While it is not a requirement to use PKI Group Policy settings within an organization, there are some features available when using it. These are briefly discussed below:

How to Configure Key Archival and Recovery

If key archival is enabled for a Version 2 certificate template, the associated CA can store the private key of the certificate in the CA database. Because the key pair is created by the client, it has to be returned to the CA for it to be stored in the CA database. Before the private key is transmitted to the CA for archival, it is encrypted with the public key of the CA. When the CA receives the private key, it decrypts the key. Before the CA stores the private key in its CA database, it encrypts it by using a random 3DES symmetric key. Once the key is encrypted, it is archived in the CA database.

A key recovery agent (KRA) is used to recover a key that is lost. The encrypted file which contains the certificate and private key is obtained from the CA database. The KRA decrypts the private key, and then submits the private key and certificate to the user.

The following requirements exist for implementing key archival and recovery:

The steps that need to be performed to enable key recovery and archival are listed below:

How to create a key recovery agent (KRA):

  1. Click Start, Administrative Tools, and then click Certification Authority.
  2. Right-click Certificate Templates, and click New, and then Certificate Template To Issue from the shortcut menu.
  3. When the Enable Certificate Templates dialog box opens, click Key Recovery Agent, and then click OK.
  4. The template should now be displayed in the right pane.
  5. Access the workstation for the key recovery agent.
  6. Open the Certificates snap-in, and expand the Personal node, and then expand the Certificates node.
  7. Right-click Certificates, and select New, and then Request New Certificate from the shortcut menu.
  8. When the Certificate Request Wizard starts, click Next.
  9. On the Certificate Types page, choose Key Recovery Agent. Click Next.
  10. On the Certificate Friendly Name and Description page, enter the appropriate information, and click Next.
  11. When the summary page is displayed, click Next.
  12. Click Finish.
  13. In the Certification Authority console, choose Pending Requests.
  14. Right-click the certificate request, and click All Tasks, and then Issue from the shortcut menu.
  15. The certificate should now be displayed under Issued Certificates.

How to configure a CA to archive certificates

  1. Click Start, Administrative Tools, and then click Certification Authority.
  2. Right-click the server and then select Properties from the shortcut menu.
  3. Click the Recovery Agents tab.
  4. Click Archive The Key, and then click Add.
  5. When Key Recovery Agent Selection dialog box opens, select the KRA certificate, and click OK.
  6. Click OK to start key recovery.
  7. Restart the CA service.

How to create a certificate template to issue archival keys:

  1. Click Start, Administrative Tools, and then click Certification Authority.
  2. Right-click Certificate Templates and then click Manage to open the management tool for certificate templates.
  3. Right-click User Template, and then click Duplicate Template on the shortcut menu.
  4. When the Properties of New Template dialog box appears, enter a name in the Template Display Name box.
  5. Enable the Publish Certificate In Active Directory checkbox.
  6. Click the Request Handling tab.
  7. Enable the Archive Subject's Encryption Private Key checkbox.
  8. Enable the Allow Private Key to be Exported checkbox.
  9. Click the Issuance Requirements tab.
  10. Uncheck the CA Certificate Manager Approval checkbox to enable the CA to issue the certificate.
  11. Click OK.
  12. Close the Certificate Template console.
  13. Open the Certification Authority console.
  14. Right-click the Certificate Templates node, and click New, and then Certificate Template To Issue from the shortcut menu.
  15. In the Enable Certificate Templates dialog box, select Archive User.
  16. Click OK.

How to recover an archived key:

  1. Click Start, Administrative Tools, and then click Certification Authority.
  2. Expand Issued Certificates to find the key which you want to recover.
  3. Double-click the certificate icon.
  4. In the Certificates dialog box, click the Details tab.
  5. Document the serial number of the certificate.
  6. Open a command prompt, and use the Certutil command-line utility to extract the key to an output file. The output file is called a blob file, and it holds the private key, in the in PKCS #7 format. You can use the syntax listed below:
    • certutil - getkey <serial_number> <blob_file>
  7. The following step is to convert the file to a file with a .pfx extension. You can use the syntax listed below:
    • certutil -recoverkey -f <blob_file> <pfx_file>
  8. When prompted to provide a password for the file, set a strong password.
  9. Proceed to transfer the file to the desktop of the user.
  10. Log on, and then in Windows Explorer, double-click the file.
  11. The Certificate Import Wizard initiates.
  12. Through the prompts of the wizard, locate the key in the certificate repository of the user.

How to export keys

You can manually export private keys, certificates, and certificate chains; and store it in a secure location. You can use one of the following tools or utilities to export keys:

The following export formats can be used when exporting private keys and certificates:

One requirement that exists for exporting keys; is that a certificate template is enabled which permits exporting of private keys. You can do this by enabling the Allow Private Key To Be Exported checkbox for the particular certificate template.

The options that are available when exporting certificates and keys are listed below:

To export a certificate:

  1. Click Start, Run, enter mmc, and click OK.
  2. Click Add/Remove Snap-In from the File menu.
  3. Click Add in the Add/Remove Snap-In dialog box.
  4. When the Add Standalone Snap-In dialog box opens, click Certificates, from the Available Standalone Snap-Ins list, and then click Add.
  5. Close all open dialog boxes.
  6. In the Certificates snap-in, expand the Personal node, and then expand the Certificates node.
  7. Click Certificates, right-click the certificate that you want to export, and click All Tasks, and then Export from the shortcut menu.
  8. The Welcome To The Certificate Export Wizard initiates next. Click Next.
  9. When the Export Private Key page opens, click Yes, Export The Private Key. Click Next.
  10. On the Export File Format page, enable the Include All Certificates In The Certification Path If Possible checkbox.
  11. Select the Enable Strong Protection option. Click Next.
  12. When the Password page opens, enter a strong password in the Password and Confirm Password text boxes. Click Next.
  13. On the File To Export page, enter the details for the file. Click Next.
  14. On the Completing The Certificate Export Wizard page, click Finish.

How to retrieve an exported certificate:

  1. In the Certificates snap-in, expand the Personal node, and then expand the Certificates node.
  2. Right-click Certificates and click All Tasks, and then Import from the shortcut menu.
  3. When the Certificate Import Wizard starts, click Next.
  4. Enter the details of the certificate that you want to import in the File Name box. Click Next.
  5. Enter the password needed to import the certificate. Click Next.
  6. When the Certificate Store page appears, enable the Automatically Select The Certificate Store Based On The Type Of Certificate option. Click Next.
  7. Click Finish.

Performing Additional CA Administrator Tasks

How to approve or deny a certificate in the CA pending queue:

  1. Click Start, Administrative Tools, and then click Certification Authority.
  2. Expand Certification Authority, <CA Server>, and Pending Requests.
    • To approve a certificate, right-click the particular certificate, select All Tasks, and then Issue from the shortcut menu.
    • To deny a certificate, right-click the particular certificate, select All Tasks, and then Deny from the shortcut menu.
  3. If you selected to approve the certificate, the certificate is moved from Pending Requests to the Issued Certificates folder.

How to renew keys

Public and private key pairs usually need to be renewed when they expire, or when they have been compromised. To renew keys:

  1. Click Start, Administrative Tools, and then click Certification Authority.
  2. Select Certification Authority, and <CA Server>.
  3. Click All Tasks, and then click Renew CA Certificates from the Action menu.
  4. When the Install CA certificate message dialog box appears, click Yes to stop Certificate Services on the server.
  5. On the Renew CA Certificate dialog box opens, click Yes for a new public and private key pair to be generated.
  6. Restart the CA server.

How to enable auditing on the CA server

  1. Click Start, Administrative Tools, and then click Certification Authority.
  2. Select Certification Authority, and <CA Server>.
  3. Right-click the CA, and click Properties from the shortcut menu.
  4. When the Properties dialog box opens, click the Auditing tab. The events that you can specify for auditing are listed below:
    • Back up and restore the CA database
    • Change CA configuration
    • Change CA security settings
    • Issue and manage certificate requests
    • Revoke certificates and publish CRLs
    • Store and retrieve archived keys
    • Start and stop Certificate Services
    After enabling the desired event checkboxes for auditing, click Apply.
  5. Click OK
  6. The events which you specified for auditing can be viewed in the Event Viewer tool.

How to back up the CA server

  1. Click Start, Administrative Tools, and then click Certification Authority.
  2. Right-click the CA server that should be backed up, and click All Tasks, and then Back Up CA from the shortcut menu.
  3. The Certification Authority Backup Wizard launches.
  4. On the Welcome screen of the wizard, click Next.
  5. On the Items to Back Up page, you can select the following options:
    • Private key and CA certificate
    • Certification database and certification database log
  6. In the Backup To This Location text box, enter a location for the backup files. Click Next.
  7. In the Password and Confirm Password text boxes, enter a strong password. Click Next.
  8. Click Finish.


Top 5 Free Networking Tools

Bookmark Implementing Public Key Infrastructure

Latest Blog Posts


English English GermanGerman SpanishSpanish FrenchFrench ItalianItalian PortuguesePortuguese RussianRussian DutchDutch
GreekGreek HindiHindi JapaneseJapanese KoreanKorean ChineseChinese Chinese (Simplified)Chinese (Simplified) ArabicArabic

Copyright 2009 Tech-FAQ. All rights reserved. Privacy Policy.