Install Active Directory Certificate Services

IT Certification

Active Directory Certificate Service (AD CS) provides a number of customizable services related to public key infrastructures and certificates used in software security systems. It is comprised of components such as certificate authorities, CA web enrollment, online responder, and network device enrollment service.

It allows you to encrypt data files, encrypt remote communications, secure email messages, secure logons, secure servers, secure wireless communications, and protect all data from tampering. The AD CS can run in both corporate network and outside the corporate network. It can be integrated with AD DS to provide automated certificate enrollment.

AD CS deployments are hierarchical in nature and form a chain of trust from lowest to
top most point of a hierarchy. AD CS supports two CA types:

Install AD CS as a Standalone Root CA

  1. Click Start-> Administrative Tools->Server Manager-> Roles Summary-> Add Roles
  2. Click Next on the first page of the Add Roles Wizard that appears.
  3. Select Active Directory Certificate Services and then click Next on the Select Server Roles page that appears.
  4. Select Certification Authority on the Select Role Services page and click Next. Because this is a root CA you need not assign other services and roles to it, as shown in Figure 7-1:
    Figure 7-1
  5. Select Standalone on the Specify Setup Type page that appears and click Next.
  6. Select Root CA on the Specify CA Type page that appears and click Next.
  7. Select Create a new private key radio button on the Set Up Private Key and then select Next.You need to create a new private key because you are creating a new root CA. If you are reinstalling a CA due to some reason then you can select the existing key option.The Configure Cryptography for CA page appears with a number of cryptography options to configure.

    CSP are the engines that MS crypto API uses to generate key pair for the root CA CSP can be software or hardware based. For example The RSA#Microsoft Software Key Storage Provider CSP is software based and RSA#Microsoft Smart Card Storage Provider CSP is hardware based.

  8. Select the suggested cryptographic service provider from the Select the cryptographic service provider (CSP) dropdown.The Key character length field allows you to select the length of the cryptography keys in pair. Before selecting the key length, you must know that longer the key length the more processing time the server will take
  9. Select the appropriate key length from the Key character length field.The Hash algorithms are used to produce and assign hash value on the keys in pair. The hash value on key pairs ensures that the no tempering has been done with the data in the transit.
  10. Select the SHA1 hash algorithm from the Select the hash algorithm for signing certificates issued by this CA dropdown to ensure the backward-compatibility with old versions.The Use strong private key protection features provided by the CSP option further ensures the protection of the root CA. This is because if this option is selected the CA will require only administrative access to work with, as shown in Figure 7-2.
  11. Keep Use strong private key protection features provided by the CSP option deselected for this example and click Next
    Figure 7-2
  12. Modify the Common name of the CA in the Common name for this CA field and leave the Distinguished name suffix field as is. For this example modify the name to Inscription-Root-CA, as shown in Figure 7-3.The common name that you specify here will be embedded in each subordinate certificate issued by the name.
  13. Click Next.
    Figure 7-3
  14. Modify the validity period of the CA in the Select validity period for the certificate generated for this CA fields if required on the Set Validity Period page, as shown in Figure 7-4 and then click Next.
    Figure 7-4
  15. Accept the default values for the certification database or modify them if required on the Configure Certificate Database page, as shown in Figure 7-5 and click Next.
    Figure 7-5
  16. Click Install on the Confirm Installations Selections pageThe installation process starts and you will now never be able to change the name of the server unless you uninstall AD CS first.

The AD FS is usually deployed in medium to large organizations that use multiple domains and have computers that run various operating systems. AD FS allows you to create a highly secure, extensible and Internet-scalable solution that can operate across both Windows and non-Windows multiple platforms.

AD FS can be installed if the domain runs either AD DS or AD LDS. It is tightly integrated with Microsoft Office SharePoint Server 2007 and AD RMS. AD FS is integrated with AD RMS in such a way that organizations can collaborate with external partners using the existing federated trust relationship.

To install the Federation Service, you need to:
  1. Click Start-> Administrative Tools->Server Manager-> Roles Summary-> Add Roles
  2. Click Next on the first page of the Add Roles Wizard that appears.
  3. Click Active Directory Federation Services option on the Select Server Roles page, as shown in Figure 4-32:
    Figure 4-32
  4. Select the Federation Service check box on the Select Role Services page and then click Add Required Role Services if the additional Web Server (IIS) or Windows Process Activation Service role services are not installed already, as shown in Figure 4-33.
    Figure 4-33
  5. Select the certificate displayed on the Choose a Server Authentication Certificate for SSL Encryption page that appears and then click Next, as shown in Figure 4-34 .
    Figure 4-34
  6. Click Create a self-signed certificate for SSL encryption option and then click Next. The Choose a Token-Signing Certificate page appears.
  7. Click Create a self-signed token-signing certificate option and then click Next, as shown in Figure 4-35:
    Figure 4-35

    The Select Trust Policy page appears, as show in Figure 4-36.

  8. Click Create a new trust policy and then click Next twice.
    Figure 4-36

    The Select Role Services page appears, as shown in Figure 4-37.

  9. Accept the default values and then click Next. The Confirm Installation Selections page appears.
    Figure 4-37
  10. Click Install. The Installation Results page appears.
  11. Verify the installation and then click Close.