Category: PKI

Posted on

Microsoft PKI – Decommission CA Server

Abbreviated mostly  from: https://docs.microsoft.com/en-us/troubleshoot/windows-server/windows-security/decommission-enterprise-certification-authority-and-remove-objects

Several notes:

These instructions assume that all issued certificates are expired.

If the issued certificates still exist and are active within the expire time or are revoked, you will need to go through a set of steps to revoke the remaining issued certificates and update/transfer the revocation list to the current PKI systems. Generally you can just remove the certificate templates from the old server and let the certificates expire or be re-issued by the newer issuing servers. It all depends on how quickly the old PKI server needs to be removed from inventory.

Steps are different on a single-tier PKI set up, so don't do this unless you are sure!

Get and pair the server name and CA name. This will show all info about all CA servers, so choose the server name wisely. From PowerShell or CMD terminal as admin:

certutil

Shutdown certificate services on the server being decommissioned:

certutil -shutdown

Delete CA private key using the name gathered from above (I have had issues with this step and probably is not important if you securely erase the drive immediately after server decommissioning):

certutil -delkey <"ca name">

Uninstall Certificate Services:

"Server Manager", "Manage", "Remove Roles and Features"
Click through wizard and de-select "Active Directory Certificate Services"

Restart the server.

ONLY do the following if issued objects like CRL and AIA no longer matter! DO NOT remove the Certificate Templates if you are replacing this PKI server!

Remove CA Objects from AD:

"Server Manager", "Tools", "Active Directory Sites and Services"

Select appropriate icon in left window pane, "View", "Show Services Node"

"Services", "Public Key Services"

Under the "AIA", "CDP", "Certification Authorities", and "Enrollment Services":

Delete the CA object
NOTE: should already be missing under "Enrollment Services" because it is removed during the removal of certificate services.

There are more advanced cleanup procedures in the link at the top if you feel that these deletion steps did not work properly.

There is also a method to recover the certificate templates if they are deleted.

Posted on

IIS SSL/TLS Certificate Setup – Internal MS CA

Simplistic, works for me when adding a certificate for WSUS.

Create Certificate Request:

From the IIS server needing the new certificate, open IIS Manager:

- In the left window pane, select the server.
- In the center window pane, select "Server Certificates".
- In the right window pane, select "Create Domain Certificate Request".
- Enter the information in the pop up window.
- Cryptographic Service Provider:
	"Microsoft RSA SChannel Cryptographic Provider"
- Bit Length:
	2048

This should submit a request to the domain CA and automatically return a certificate. This will of course depend on how your CA is setup for approving similar requests.

Bind to the new certificate to the web site:

- In the left window pane, select the web site 
	Possibly "Default Web Site", or maybe not.
- In the right window pane, select "Bindings…".
- In the "Site Bindings:" pop up, choose add or edit.  I'm doing edit here.
- Select "HTTPS" and click the "Edit" button.
- Select the new certificate.
- In the right window pane, restart the service.

The new certificate expiration date can be viewed in “Server Certificates” (see step one above) .

Posted on

Microsoft PKI – Change the Issuing Server’s Certificate Validity Period

The following are assumed in this scenario:

 - The root server is a standalone (off the domain) root CA server
 - The issuing server is an enterprise (on the domain) issuing CA server

By default, the issuing CA server certificate is good for one year. This is controlled by the root CA and is set to one year by default.

This can be verified on the root CA server:

Open PowerShell as admin:
     Certutil -getreg CA\ValidityPeriodUnits
     Certutil -getreg CA\ValidityPeriod

To change the issuing server’s certificate validity period to 5 years:

On the root standalone CA:
	Open PowerShell as admin
		Certutil -setreg CA\ValidityPeriodUnits 5

If ValidityPeriod is set to years already , no need to do the next command, but just in case:

Certutil -setreg CA\ValidityPeriod "Years"

For good measure:

restart-service certsvc

Verify the settings are what you want them to be:

Certutil -getreg CA\ValidityPeriodUnits
Certutil -getreg CA\ValidityPeriod

When you renew the enterprise issuing server’s certificate, it should be good for 5 years. Verify this by looking at the certificate properties.