Welcome to the ITFreeTraining video on installing an Enterprise CA on Windows Server 2008 R2
for use with Active Directory Federation Services. This video will perform a very basic install
of an Enterprise CA and configure it to deploy certificates for Active Directory Federation
Services. If you already have an Enterprise CA on your network, this video will help you
add a certificate template to that server. If you are planning to deploy a certificate
solution on your network, you should perform additional research to make sure you use the
correct settings. This video only uses the basic settings and once you deploy a certificate
solution, it is not easy to change later on. I will now change to my computer running Windows
Server 2008 R2 to perform the install of an Enterprise Certificate Authority.
To start the install of the Enterprise Certificate Authority or Enterprise CA, I will first open
Server Manager from the quick launch bar. Once Server Manager has opened, I will next
select Roles, and then select the option on the left hand side “Add Roles” to start
the add roles wizard.
Once I am past the welcome screen, on the next screen I need to select the top role
“Active Directory Certificate Services”. Once selected, additional options will be
added to the wizard for the configuration of the role.
Once I press next, the next screen will display the welcome screen for the Certificate Services
role. Once I move on to the next screen, I need to decide which components of certificate
services I want to install. To issue certificates, all I need to do is install the component
“Certification Authority”, as the other components are not required to issue certificates.
Once I press next, on the next screen I need to decide which type of certificate authority
I want to install. In this case I will leave it on the default option of Enterprise. In
a later video I will configure Active Directory Federation Service in the HighCostTraining
domain, and in that video I will use the standalone option.
Once I move onto the next screen, I need to select if I want to install a root CA or a
subordinate CA. In this case I will select the option “Root CA”. On a production
environment, in most cases, I would not use a Root CA for an Enterprise CA. In this video,
I will install a root CA to provide the basic services to issue certificates for Federation
Services. On your network you may want to install a standalone Root CA and the enterprise
CA as a subordinate CA for additional security.
For the rest of the wizard, I will accept all the defaults. In a production environment,
you will want to do your own research so you can decide the best options to choose for
your needs.
The last screen of the wizard will display a summary of the options that have been selected
in the wizard. Once I press install, the role will be installed and configured. The process
does take a few minutes to complete, so I will pause the video and return shortly.
Once the role has finished installing, I can close the wizard. The next step is to configure
the certificate authority to issue certificates. To do this, I will open the start menu and
select “Certification Authority” from under Administrative Tools.
Once open, I will expand down to "Certificate Templates”, right click it and select the
“manage” option. This will bring up a Window with all the available certificate
templates. In this case there is no certificate for Active Directory Federation Services,
so I will select the “Web Server” template, which is similar to what I require, and copy
it. To do this, I will right click the template and select the option “Duplicate Template”
to make another copy of the template which I will modify.
A Window will appear asking which version of Windows I want to be able to use this template
with. In this case the CA on my network is running Windows Server 2008 Enterprise and
I do not have any servers running operating systems before Windows Server 2008, so I will
select the second option “Windows Server 2008 Enterprise”. If the certificates were
being used with Window Server 2003, you would need to select the Windows Server 2003 option.
Once I press o.k., the properties for template will be opened. It is just a matter of making
the required changes. First, I will change the display name of the certificate. This
will make it easier for other administrators to know what this template is for.
For the next change I will select the “Subject Name” tab. Active Directory Federation Services
requires the subject field in the certificate to be set correctly. To do this, I will select
the option “Build from this Active Directory information”.
Next I need to select from the pull down the option “Common name”. This will determine
how the subject data in the certificate will be formatted. Below this are four tickboxs.
The only tickbox that needs to be ticked is “DNS Name”, all the other tick boxes can
be cleared.
Next I need to select the “Security” tab to configure who can use this template. In
order for the Active Directory Federation Server to obtain a certificate, it needs to
have permission to do so. To add the required permissions, I will press the add button.
For the server to have access, the computer account for the Active Directory Federation
Server needs to be added. To do this, I need to press the “Object Types” button and
then tick the box for computers. Otherwise when I search for the computer account, it
will not be found. If I go back to the previous screen, I can now enter in the computer name
for the server that I will use later on to install Active Directory Federation Services
on.
Once this is added to the permissions list, it will be given the read permission; however,
I will also need to tick the permission for “Enroll”. These are all the permissions
that are required for the server to obtain a certificate and use it.
Once I press o.k., the certificate will be saved with the required changes. You will
notice that it has been added to the list of templates and appears at the bottom. The
next step is to make this certificate available to be used to issue certificates. To do this,
I will close this Window and go back to “Certification Authority”, right click “Certificate Template”
and select the option “Certificate Template to Issue” under new. This will allow me
to enable the certificate template to be used to issue certificates.
To make the certificate template available for issue, I need to select it from the list
and then press o.k. You will notice that the certificate template is now listed as an available
certificate template.
That’s it, the Enterprise CA has been installed and is ready to issue a certificate to the
Active Directory Federation Server. The next step is to setup and configure that server,
but for that I will leave to another video. Until then, thanks for watching and see you
next time.