In this video from ITFreeTraining I will look at the components that are available in Active
Directory Certificate Services. Before you start installing Active Directory Certificate
Services in your organization, it is worth taking the time to understanding what components
are available. This video will help you make the right decision on which servers to install
which components of Active Directory Certificate Services.
When deciding which components you want to install and where, there are two main factors
that you need to consider. First, where the user or device is located that is going
to be using certificate services. Is that user or device on a local network or connecting
via a Wide Area Network. The next point to consider is what type of
user or device is accessing certificate services. The main consideration to think about is does
the user or device have domain access. If it does not, additional components many need
to be deployed in order to provide a bridge between Active Directory and the user or device
requiring the certificate. These additional components provide the means for users and
devices to obtain and use certificates when they are not members of the domain.
Active Directory Certificate Services consists of 6 different components. These components
can be installed on any server. The components may require other components to work, however
these components do not need to be installed on the same server. I will quickly go through
each of the components available before looking at each component in more detail.
Even though there are 6 components, they can be grouped into 4 areas. The first one is
Certificate Authority or CA. A certificate Authority is responsible for creating certificates.
They form the distribution point for certificates if you will.
The next component is online responder. Before a certificate is used, a CA or online responder
needs to confirm the certificate is valid. Having a system like this allows a certificate
to be canceled or in certificate terminology revoked after it has been issued.
The next component, network device enrollment service, provides certificates to devices
on the network like routers and switches. This allows these devices to use certificates
even though they are not part of the domain. The last 3 components I have grouped under
the one heading of Web Enrollment. The first two, Certificate Enrollment Web Service and
Certificate Enrollment Policy Web Service work together to provide web enrollment services.
This essentially means that non-domain members, including users and computers in a different
forest, can obtain certificates using the web protocol.
The last component, Certification Authority Web Enrollment, provides a web interface that
users can access to obtain certificates. I will now have a closer look at these components
to see how you would use these and some of the decisions that need to be made on where
to deploy these components on your network. The first component that I will look at is
the Certificate Authority component. A Certificate Authority is also known as a CA. This is the
main component of Active Directory Certificate Services. This component is responsible for
creating certificates that will be used by users, computers and devices on the network.
In order to start using certificate services on your network, you need to install a root
CA. As we will see in later videos, the root CA is the top of the hierarchy of the network.
There can also be other CAs below the root CA known as subordinate CAs. Later in the
course we will look at how these subordinate CAs work and also how to install a subordinate
CA. It is important that when you install the
root CA, you take care which settings you choose. Once the settings have been decided,
these settings will have any effect on the certificates that are issued from the subordinate
CAs. You may also see the term CA used with 3rd
party companies which you can purchase certificates from. It is important to remember that certificates
are a standard and Active Directory Certificate Services is just Microsoft's implementation
of this standard. The next component that I will look at is
the online responder. The online responder job is to check if a certificate is valid.
To understand how an online responder works, consider what happens when you do not have
an online responder. In this example, a Certificate Authority has issued a certificate to a web
server. It is later realized this was a mistake and
the certificate needs to be canceled or, to put in certificate terminology, the certificate
needs to be revoked. So when this certificate is presented to a client computer, how does
the client know this certificate is not to be used?
In order to do this, the Certificate Authority creates a Certificate Revocation List or CRL.
This CRL needs to be downloaded to any location that needs to check to see if the certificate
is valid. There are two problems with this approach. The CRL must contain a list of all
the certificates that have been revoked. If there are a lot of certificates that have
been revoked, this list can become quite large. The second problem is the client will need
access to the certificate authority in order to obtain this CRL. In some cases, this may
not be ideal. This is where the online responder can be
used. The online responder's job is to check if a certificate is valid. Rather than the
client keeping a list of revoked certificates, it simply asks the online responder if the
certificate is valid or not. The online responder has a connection back to the certificate authority
so it can contact the CA as required meaning it can download the CRL rather than the client
having to. This means the client does not need a direct connection back to the Certificate
Authority. The advantage of an online responder is that
is can be installed on a server local to the client. In a lot of cases, this is a better
option than installing a Certificate Authority local to the client. The next advantage is
since the online responder is simply supplying a yes or no answer if the certificate is valid,
it response is always the same size it does not vary like the CRL does.
The next component that I want to look at is the Network Device Enrollment Service.
This component issues certificates to network devices on the network. It should be remembered
that the certificates are created by the Certificate Authority. What occurs is the Network Device
Enrollment Services provides the bridge between the CA and the device requiring the certificate.
It does this by using Simple Certificate Enrollment Protocol. Any hardware devices that are on
your network that supports this protocol will be able to obtain certificates from the Network
Device Enrollment Service. The advantage of this component is that the
device does not need to have an active directory account in order to obtain a certificate it
only needs to support the Simple Certificate Enrollment Protocol.
The last 3 components that I will look at all have to do with Web Enrollment so I have
grouped them together. The first one, Certificate Enrollment Web Service allows clients to obtain
certificates using the HTTP protocol. This means that a client could obtain a certificate
using the web service that is not a member of the domain. This is useful if you have
a business partner that needs to access certificates but you do not want to give them direct access
to the certificate authority. It should be remembered that this means certificates are
obtained using the HTTP protocol, this component does not provide a web interface.
The next component, Certificate Enrollment Policy Web Service works hand in hand with
Certificate Enrollment Web Service. It essentially provides policy information to clients using
HTTP. Policy information gives the client information about the Certificates used in
the organization. The last component is the Certification Authority
Web Enrollment. This component provides a simple web interface that can be used to access
certificates. For example, using the web interface a user could request a certificate to be generated
on the CA. The point to remember that is different between this component and the last two components
is this component essentially provides a web page for a user to access. The last two components
only use the HTTP protocol to communicate with the client.
I hope this video has helped you understand the core components of Active Directory Certificate
Services. In the upcoming videos I will have a closer look at these components and how
to install and configure them to meet the needs of your organization. Thanks for watching
and see you next time.