2

I am working on seeing if Active Directory Certificate Services can be used to manage the trust infrastructure for a data center environment. I have a series of different services that are run on web hosts using various different service accounts. I want these services to be able to authenticate with each other via mTLS and can easily configure the service users to get certificates to authenticate themselves when talking to other services, but the certificate naming only includes the name of the service user and not the server on which the service is running. This is not particularly desirable as it makes it hard to see what host we are actually dealing with.

Using a computer certificate is not ideal as only the service itself (and the underlying service user) should have access to the certificate, not all services on the computer, but I can't seem to find a way to get the host details I need in to the cert as a user cert.

Does anyone know if what I'm trying to do is possible and/or have a better way to accomplish my objective?

1 Answer 1

1

The problem you'll have here is in proving the identity of the subscriber and its authority to subscribe.

In ADCS computers and users prove their identity through Kerberos, and ACLs provide the authorisation. This isn't available for services.

The only option you have is to manually generate the certification request (using certreq.exe or OpenSSL, for example) and submit them to the CA (with certreq.exe), but that would mean your Certificate Manager would need to check each request and somehow define a process to verify the identity of the subscribing service and its authority to enrol. That would need to be a manual process.

The alternative is to set up the templates to automatically issue (no need for Certificate Manager approval), but that would leave your CA open to abuse - anyone could submit a request and automatically receive an issued cert. Once that is known, your CA would have no trust value.

5
  • The service runs as a known AD service user, so only that user should be able to request a certificate. It's very similar to a user certificate, however we need to know both the user and the host that the certificate is being issued to. If we have an AD validated combination of host and service account, then the certificate manager can validate that it is an expected host for that service as part of the deployment and authorize it. Commented Jun 2, 2023 at 4:23
  • Windows ADCS only understand the concept of user and computer identity. If you need a certificate for a service account, you have to request is as a user or computer, then export it as a file and import it into the service's certificate store. Using this method, ADCS can only verify the identity and authority of the user or computer which requested the cert - not the service to which the certificate is ultimately bound. If you start using the Certificate Manager (a person) for this, then it could be extremely cumbersome if you have many services. It would work for a few. Commented Jun 2, 2023 at 5:19
  • Can't I script it so that the service itself does the request? We have a deployment system that can run in the service user's context and should be able to request a certificate as the service user. The service user has a CurrentUser\My certificate store available because it is still an AD user. Commented Jun 2, 2023 at 14:08
  • If the certificate naming requirements match the details of the service user account in AD, then you could potentially do this. Whether this service user would be able to access its stores while not logged in interactively to the machine, is another matter. Much of the PKI automation in Windows relies on group policy processing and scheduled tasks, which may not run if the user isn't interactively logged in. You may have to experiment. Commented Jun 2, 2023 at 14:24
  • I already have done certificate registration using a hand rolled CA as a proof of concept. If you use the right impersonation mode, it's possible to perform certificate store operations within the service user context. The trick here is just trying to get the proper information validated by AD since I need to be able to tell what computer it's coming from. All of the certs are being issued non-exportable so they will be tied to both the user and the machine it's installed on, but I can't find a way to tell what system a particular certificate was requested on. Commented Jun 2, 2023 at 16:40

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .