Performing Manual Enrollment Certificate Security Windows Server 2003

Performing Manual Enrollment

Wed, 29 Jun 2011 14:45:46 | Certificate Security

The sections that follow detail the procedures for requesting certificates from a Windows Server 2003 CA. A Certificate Services installation includes the Certificate Services Web Enrollment pages. The Web pages are only accessible if Internet Information Services (IIS) 6.0 is also installed at the CA.

Note The IIS 6.0 installation must enable Active Server Pages (ASP) for Certificate Services Web Enrollment pages installation.

Note If you did not install IIS 6.0 before you install Certificate Services, you must install IIS 6.0 and then type certutil -vroot at a command prompt to create the required virtual roots and file shares required by the Certificate Services Web Enrollment pages.

Requesting a Certificate

Use the following procedure to request a certificate from the Certificate Services Web Enrollment pages:

1. Open Internet Explorer.

2. In Internet Explorer, open the URL http://CertServerDNS/certsrv (where CertServerDNS is the Domain Name System [DNS] name of the Windows Server 2003 CA).

Note The Certificate Server's DNS name should be added to the Local intranet site at all computers. If the Web site is not added to the Local intranet site, users are prompted for their user name and password. The process of adding the DNS name to the Local intranet site is described in Chapter 15, "Smart Card Deployment."

3. On the Welcome page, click the Request a certificate link.

4. On the Request a Certificate page, click the Advanced Certificate Request link.

Note This page only appears if the User certificate template is published at the CA. If the User certificate template is not published, step 4 does not occur.

5. On the Advanced Certificate Request page, click the Create and Submit a Request to this CA link.

6. On the Advanced Certificate Request page (see Figure 12-2), you can define the following options for the certificate request:

•5 Microsoft Certificate Services - Microsoft Internet Explorer		■ _ \|n\|x\|
File Edit View Favorites Tools Help		ir
1 Microsoft Certificate Services - Komar Consulting Issuing CA		home E£1
Advanced Certificate Request
1 Certificate Template:
	User jJ
Key Options:
	(* Create new key set f** Use existing key set
CSP:	Microsoft Enhanced Cryptographic Provider vl.O
Key Usage:	® Exchange
Key Size:	1VOA ¡J ": ^J ffioninai BW8 KS: S1Z 1IEi 2D4S 4!B6 81921S3Bi)
	f* Automatic key container name User specified key container name
	Mark keys as exportable
	D Export keys to file
	I- Enable strong private key protection
	Store certificate in the local computer certificate store
	Stores the certificate in the focal computer store
	instead of in the user's certificate store. Does not
	install the root CA's certificate. You must be an
	administrator to generate or use a key in the iocal
	machine store.
Additional Options
Request Format:	CMC C PKCS1Q
Hash Algorithm: \|	\| SHA-1 zl
	Only used to sign request
	I- Save request to a file
	J
Attributes:	J

Friendly Name:	User

	\| i Submit > j\|	d

Figure 12-2 The Advanced Certificate Request page

■ Certificate template drop-down list. Lists the certificate templates for which the user is assigned Read and Enroll permissions.

■ Key set. Allows you to choose between generating a new key set or using the existing key set.

■ CSP drop-down list. Allows you to select a CSP installed on the client computer to use for the certificate request.

■ Key size. The length of the key pair generated for the certificate request.

■ Container name. The key container where the certificate's key pair is stored.

■ Export options. Allows you to request that the certificate's private key be exportable.

■ Strong key protection. Requires a password each time the certificate's private key is accessed.

■ Store certificate in the local computer store. Enable this option for computer certificates only, not for user certificates.

■ Request format. You can choose between Certificate Management Message over Cryptographic Message Syntax (CMC) or Public Key Cryptography Standards (PKCS) #10 request formats. CMC is required for digitally signed requests and key archival requests.

■ Friendly name. A logical name assigned to the certificate. This name is not part of the certificate. Rather, it is the logical display name when the certificate is viewed with Microsoft tools that can be changed without invalidating the signature applied to the certificate.

7. Once all options are defined, click Submit on the Advanced Certificate Request page.

8. In the Potential Scripting Violation dialog box, allow the Web site to request a certificate on your behalf by clicking Yes.

9. On the Certificate Issued page, click the Install this Certificate link.

10. In the Potential Scripting Violation dialog box, accept that the Web site is adding a certificate to your computer by clicking Yes.

11. Ensure that the Certificate Installed page appears, indicating that the certificate has installed successfully.

12. Close Internet Explorer.

Note The default values shown on the Advanced Certificate Request page are based on the values defined in the certificate template.

Note Microsoft Knowledge Base Article "Flaw in Certificate Enrollment Control May Cause Digital Certificates to Be Deleted" describes the MS02-048 security update, which introduced the Potential Scripting Violation dialog box. This dialog box warns the user anytime a certificate request is submitted to a CA or a CA-issued certificate is installed in the user's store.

Retrieving a Pending Certificate Request

If the the CA Certificate Manager Approval option in the certificate template is enabled on the Issuance Requirements tab, the certificate request becomes pending until a certificate manager performs requestor validation. Once the certificate man ager verifies identity and issues the certificate, you can complete certificate installation as follows:

1. Open Internet Explorer at the same computer where the original request was submitted.

2. In Internet Explorer, open the URL http://CertServerDNS/certsrv (where CertServerDNS is the DNS name of the Windows Server 2003 CA).

3. On the Welcome page, click the View the Status of a Pending Certificate Request link.

4. On the View the Status of a Pending Certificate Request page, click the link for the pending certificate.

Note The computer where the certificate request is performed must have cookies enabled. If cookies are not enabled, the View the Status of a Pending Certificate Request page does not show any entries.

5. On the Certificate Issued page, click the Install this Certificate link.

6. In the Potential Scripting Violation dialog box, accept that the Web site is adding a certificate to your computer by clicking Yes.

7. Ensure that the Certificate Installed page appears, indicating that the certificate has installed successfully.

8. Close Internet Explorer.

Note If cookies are disabled in Internet Explorer, you cannot retrieve a pending certificate request.

Submitting a Certificate Request from Network Devices

In some cases, the certificate request is generated at a network device or in another operating system, such as Linux. In these cases, the certificate request is commonly generated in a PKCS #10 format. Certificate Services Web Enrollment pages provide a facility to submit the PKCS #10 certificate request and issue a certificate based on the subject information and public key in the request.

Use the following procedure to request a certificate with a PKCS #10 file created by a network device or alternate operating system.

1. Open Internet Explorer.

2. In Internet Explorer, open the URL http://CertServerDNS/certsrv (where CertServerDNS is the DNS name of the Windows Server 2003 CA).

3. In the Welcome page, click the Request a Certificate link.

4. On the Request a Certificate page, click the Advanced Certificate Request link.

5. On the Advanced Certificate Request page, click the Submit A Certificate Request By Using A Base-64-Encoded CMC Or PKCS #10 File, Or Submit A Renewal Request By Using A Base-64-Encoded PKCS #7 File link.

Reviewing the Certificate Request

A certificate manager should not accept any PKCS #10 request file without first reviewing the certificate request's contents. The certutil command allows you to review the contents by running certutil -dump request.req (where request.req is the name of the PKCS #10 request file).

402.203.0: 0x80070057 (WIN32: 87): ..CertCli Version PKCS10 Certificate Request: Version: 1 Subject:

CN=Andy Ruth

Public Key Algorithm:

Algorithm ObjectId: 1.2.840.113549.1.1.1 RSA Algorithm Parameters: 05 00

Public Key Length: 1024 bits Public Key: UnusedBits = 0

0000

0010

8 4

0020

0030

0040

0050

0060

f 8

0070

8 4

0080

4 attributes:

Request Attributes: 4

4 attributes:

Attribute[0]: 1.3.6.1.4.1.311.13.2.3 (OS Version) Value[0][0]: 5.1.2600.2

Attribute[1]: 1.3.6.1.4.1.311.21.20 (Client Information) Value[1][0]: Unknown Attribute type Client Id: = 1 XECI_XENROLL -- 1 User:

Machine: London.corp.microsoft.com Process: cscript

Attribute[2]: 1.2.840.113549.1.9.14 (Certificate Extensions) Value[2][0]: Unknown Attribute type Certificate Extensions: 5

2.5.29.15: Flags = 1(Critical), Length = 4 Key Usage

Digital Signature, Non-Repudiation, Key Encipherment, Data Encipherment (f0)

1.2.840.113549.1.9.15: Flags = 0, Length = 37 SMIME Capabilities

[1]SMIME Capability

Object ID=1.2.840.113549.3.2 Parameters=02 02 00 80

[2]SMIME Capability

Object ID=1.2.840.113549.3.4 Parameters=02 02 00 80

[3]SMIME Capability Object ID=1.3.14.3.2.7

[4]SMIME Capability

Object ID=1.2.840.113549.3.7

2.5.29.14: Flags = 0, Length = 16 Subject Key Identifier

7c 4e b0 7b ca b7 c1 66 a8 b5 c2 15 83 84 f2 7d a1 eb 43 ac

2.5.29.37: Flags = 0, Length = c Enhanced Key Usage

Client Authentication (1.3.6.1.5.5.7.3.2)

1.3.6.1.4.1.311.20.2: Flags = 0, Length = 16 Certificate Template Name ClientAuth

Attribute[3]: 1.3.6.1.4.1.311.13.2.2 (Enrollment CSP) Value[3][0]: Unknown Attribute type CSP Provider Info KeySpec = 1

Provider = Microsoft Enhanced Cryptographic Provider v1.0 Signature: UnusedBits=0

0000	9f	8 f	46	13	93	4c	a4	79	bb	10	82	53	70	12	b9	8f
0010	48	05	8b	76	07	c8	8c	d1	db	78	71	e3	44	c3	a3	2b
0020	c5	43	01	6d	15	1b	c2	d3	aa	29	3f	f5	3c	43	8a	fa
0030	e1	2d	6a	71	da	26	ff	97	a7	58	59	73	d8	db	8d	53
0040	e7	25	3a	bf	21	16	d5	1b	1c	bc	f7	1e	83	de	3e	92
0050	0a	f0	70	d0	b5	9a	11	79	44	7f	d6	aa	4d	70	4d	cd
0060	25	83	9f	3a	3c	59	30	03	d0	05	24	1b	19	74	5e	24
0070	76	7e	76	f 8	cb	39	14	8 4	66	19	84	45	d8	08	b0	0d
0080	00	00	00	00	00	00	00	00								Signature Algorithm: Algor Algor 05 00 Signature ithm ObjectId: 1.2.840.113549.1.1.5 sha1RSA ithm Parameters: 31 84 ff 5d e4 0f 32 69 27 ca e4 fb 6a 34 f9 9c 0010 53 6e ac d0 80 98 19 ba d6 55 8f 9f 7b dd 2c 0e 0020 32 a6 cc 18 0e 34 2f a3 dc 11 49 e3 54 69 08 ad 0030 fa 15 8e 52 7b 16 b4 ad 98 bc 4f 0d 00 7a 20 29 0040 a8 ac e2 c6 48 d6 c7 e7 dd 77 9a 0b 37 f9 ef 77 0050 09 b1 28 01 f6 a1 40 12 2e a8 98 9d 16 b9 99 ff 0060 8b b3 59 0d ac 50 ca 8a 1f d5 8c 38 ac 92 a8 71 0070 28 f0 34 07 dc fb d2 68 4e ee d7 fc 5a 34 9b 11 Signature matches Public Key Key Id Hash(sha1): 7c 4e b0 7b ca b7 c1 66 a8 b5 c2 15 83 84 f2 7d a1 eb 43 ac CertUtil: -dump command completed successfully. Before submitting the PKCS #10 request file to the CA, ensure that the subject information is correct, the correct key length and certificate template are selected, and the signature matches the public key. If these conditions are met, you can submit the certificate request to the CA. 6. On the Submit a Certificate Request or Renewal Request page, right-click the Saved Request box and click Paste. (See Figure 12-3.) Ensure that the Certificate Template drop-down list is set to the required certificate template and click Submit. Figure 12-3 Submitting a PKCS #10 certificate request file Note If the certificate is for a Secure Sockets Layer (SSL) accelerator or a third-party Web server, choose the Web Server certificate template. If the certificate request is generated by a Cisco virtual private network (VPN) client, choose the User certificate template. 7. On the Certificate Issued page, select Base-64 encoded or DER encoded and click the Download Certificate or Download Certificate Chain link. 8. In the File Download dialog box, click Save. 9. In the Save As dialog box, select a folder and file name for the certificate and click Save. 10. Close Internet Explorer. The issued certificate now must be installed on the network device or on the other operating system. The process to select depends on the network device or operating system where the PKCS #10 request file was generated.

Average user rating: 1 stars out of 2 votes

Windows Server Guides

» Certificate Security Windows Server 2003