In this video from ITFreeTraining I will look at the new features that are available in
Active Directory Certificate Services in Windows Server 2008 R2.
There are 3 new features included in Active Directory Certificate Services in Windows
Server 2008 R2. These are Web Enrollment, Certificate Enrollment across forests and
better support for high volume CAs. I will look at each of these features individually,
starting with Web Enrollment. To understand how Web Enrollment works and
thus how it can be used, consider how a standard client communicates with other domain members.
When you add a computer to the domain, security settings are configured on the client and
in Active Directory that allows the client to establish a secure connection between the
client and the server they are communicating with.
The problem occurs when the client is outside the domain boundary. This could be for two
reasons, firstly the client may not be able to get a direct connection back to the network,
that is the client is mobile and cannot access the company due to a firewall. Most companies
would allow the user to connect back to the network using a VPN, but perhaps this is not
available or perhaps the company wants the user to access certificate services without
having to worry about using a VPN. The second scenario is when you have a client
outside the domain that is not a member of the domain. Perhaps the company has a business
partner that they do a lot of work with and they want to give them a certificate. In this
case, the business partner will never be a member of the domain.
Web enrollment works by having a server that is available on the internet using HTTP. Web
enrollment provides a proxy-like service to the certificate authority. Since the Web Enrollment
Service is on a server that is part of the domain, it can use a secure channel to communicate
back to the Certificate Authority. This means that the Certificate Authority is never connected
directly to the internet and thus is protected from attack.
Before you can start using the new Active Directory Web Services component, your network
needs to meet a few requirements. First, your forest functional level needs to be Windows
Server 2008 R2 forest level. In order to raise your forest functional level to Windows Server
2008 R2, this essentially means that all Domain Controllers in your domain need to be Windows
Server 2008 R2 or above. The next requirement is that your CA needs
to be running Windows Server 2003 or above. For the clients you require Windows 7 or above.
There is one more requirement if you are using certificates across forests. If you do this,
the CA needs to be running Enterprise or Datacenter edition of Windows Server.
Certificate services now supports enrollment across forests. Before this, if you wanted
to use certificates in two different forests you would need to deploy a separate certificate
infrastructure in each forest. Now you can install Active Directory Certificate Services
in the one forest and use it in both forests. In order to do this, you require a two way
transitive trust between the two forests. This essentially means that both forests need
to be at least Windows Server 2003 functional level. This will allow one forest to issue
certificates to the other forest, however in order to support enrollment, your forest
functional level needs to be Windows Server 2008 R2. Enrollment means that the client
can automatically obtain a certificate, install it and start using it. Without Enrollment,
the user would need to manually obtain the certificate and install it manually themselves.
If you already have two forests with a separate certificate infrastructure, using enrollment
across forests will allow you to remove one of certificate infrastructure making your
certificate environment a lot simpler. The next new feature is better support for
CAs that issue a lot of certificates or high volume CAs. To understand how this feature
works, consider what happens when a certificate is issued by a CA. When a new certificate
is generated, a copy is given to the client that requested it and another copy is stored
in the certificate database. If you have a CA that issues a lot of certificates this
means a lot of certificates need to be stored in the local certificate database. A larger
certificate database means more load on the server.
An example of this is Network Access Protection or Nap. Nap issues health certificates to
clients. When a client connects to the network, Nap checks the client to see it meets the
minimum requirements to access the network. Checks that are performed are that anti-virus
software is running and a firewall is enabled. The health certificates that are issued have
a short lifespan. This means that multiple certificates could be requested by the same
client in the same day. If you have a large network with a lot of clients that all use
Nap, that would be a lot of certificates that need to be issued on a daily basis.
In order to reduce the load on the CA, the high-volume CA option can be enabled. This
essentially means that when a certificate is issued it is not stored in the certificate
database on the Certificate authority. This reduces the load on the CA.
The disadvantage with this option is that if a certificate is issued and you later on
want to revoke this certificate, revoking simply means canceling the certificate so
it can no longer be used, you will not be able to do this. Revoking a certificate requires
a copy of the certificate to be present in the certificate database.
In the case of Nap certificates, the certificates are not valid for very long so the period
of time a certificate could be used or misused is very small. In order to improve performance,
a company may decide to switch on the high volume option and accepted the risk associated
with not being able to revoke a certificate once it is issued.
If you do decide to switch on this option, it is referred to as non-persistent certificate
processing and requires Windows Server 2008 R2 or above. If you have a performance problem
on one of your certificate authority servers, this option should improve performance of
that CA. This covers the new features included with
Windows Server 2008 R2 for Active Directory certificate Services. I hope you enjoyed this
video and have a look at some of our other free videos.
For more free videos for this course and others, please feel free to subscribe or visit our
web site. Thanks for watching and see you next time.