Root CA migration

-

we have domain controller "dc01" has enterprise certificate services role installed , ca on domain controller named "dc01"
the cdp location on ca "dc01" <servername> it's ldap://dc01 (only ldap published on certificates, no http etc.)
the ca "dc01" issues version1 "computer" certificates autoenrollment clients , our internal clients , external clients have "computer" certificate ca "dc01"

now have uag sp3 server direct access , our clients connect successfull direct access it's setup now
in uag configuration (wizard) on ipsec certificate authentication screen on option "use certificate trusted root ca" "dc01" root ca certificate selected

as microsoft best-practises want move enterprise certificate services new member server "cs01" , create new root ca "cs01"

as use version1 "computer" certificate template cannot select "reenroll certificate holders"
so idea duplicate "computer" certificate template v2 template supersedes version1 computer template, replaces current computer certificates based on old v1 computer template on clients.
then clients new "computer" certificate new root ca in uag direct access configuration "ipsec certificate authentication" "use certificate trusted root ca" old "dc01" root ca certificate still selected

question1; lock out clients have new computer certificate new root ca uag direct access configuration still use root ca certificate old dc01 ca?

another idea not supersede the version1 computer certificate autoenroll new v2 duplicated computer template.
this means clients have computer certificate old ca "dc01" computer certificate new ca "cs1"

question2; can client have 2 computer certificates (1 old dc01 ca , 1 new cs01 ca) , connect direct access , still work?

for clarification say:

"the cdp location on ca "dc01" <servername> it's ldap://dc01 (only ldap published on certificates, no http etc.)"

i suspect may misinterpreting configuration. ldap entry default not tied specific dc, file placed in ad named after server. clients go domain controller retrieve information. not way me know sure, highly unusual if ldap entry changed specific dc only.

question 1: not clear if intending keep old ca. list original root ca dc01 reference new ca cs01. can not rename ca, if reading correctly, creating new root ca , abandoning old one. on related note, recommend more descriptive names cas aren't tied server. contoso root ca example. 

if creating new ca, old uag rule has specific trusted ca listed not work new ca. either need create new rule or migrate old ca , keep old name , keypair/certificate. 

the supersede best way clients re-enroll increase speed of moving clients new ca. not necessary if migrating root.

question 2: yes, clients can have more 1 certificate in store 1 or more cas. however, connection profiles "stick" last used certificate until no longer available or authentication has failed. further, if go the supersede route, old certificate no longer in personal store use.

mark b. cooper, president , founder of pki solutions inc., former microsoft senior engineer , subject matter expert microsoft active directory certificate services (adcs). known “the pki guy” @ microsoft 10 years. connect mark @ http://www.pkisolutions.com



Windows Server  >  Security



Comments

Post a Comment

Popular posts from this blog

Edit Group Policy

-
i have pc has power settings pushed out default domain policy in ad environment. of course on local machine "some settings managed system adminstrator". the machine temporarily no longer in contact domain controller (it's been physically moved , not on same network now) can't updated gpo settings. i believe if edit local group policy won't make difference because of group policy processing , precedence. since it's temporary away ad network, still want use settings of ad user. is there somewhere in registry stored can edit power plan manually until can sync domain? (i need prevent sleeping while plugged in - it's set 1 hour) thanks! allen crist i found site: http://gpsearch.azurewebsites.net/#7916 i able add policy to hkey_local_machine\software\policies\microsoft\power using specs found on site. looks solved issue. i'll report if didn't. thanks! allen crist ...
Read more

Hyper-V VM not reaching OS 'Logon' screen

-
i trying migrate vm vmware hyper-v. so far have done following (seemingly successfully): prepare vmware vm conversion hyper-v format (vhd) within vmware workstation 8.0 environment following steps guide: http://social.technet.microsoft.com/forums/en/winserverhyperv/thread/ef8c12f7-c45d-442e-9a30-c43cd87df3b3   (i.e. remove vm tools, add new ide hard disk…) use vmdk2vhd application convert individual vmdk files vhd ones create new vm in hyper-v exporting in 3 newly converted vhd files at point have checked settings , powered on vm in hyper-v find although windows begins load expected manages reach screen prior login screen saying either of following messages: “windows starting up…” “the active directory rebuilding indices… please wait” to knowledge, albeit limited in area, vm should present me login screen since appears in vmware. if start vm in safe mode can login not desired affect. below details of vm: operating system: windows server 2003 (enterprise edit...
Read more

DNS question...

-
i new setting dns server....my domain name expl. "domain.com"....i set "a" record in forward lookup for  www.domain.com itself...."server's local ip"....i've added no other zones , i seem able resolve names except own....www.domain.com.....also, do i put my isp's dns ip's....for external dns's server can't resolve?....forwarding or in nic setup?......i want setup in my dns server don't have include them on client side..... thanks mark     not put isp dsn server address in settings on nic dc or clients. should point local dns server on dc. set dns forward public dns, such isp. bill Windows Server  >  Network Infrastructure Servers
Read more