AD CS Specific commands
This is a list of commands relevant to configuring a Windows 2008 R2 CA Server. I removed them from the other post since that informative was getting too long, and not all the commands directly relate to setting up a CA.
This is more of the How to section, rather the "what and why". It also includes version-specific differences between CA versions (2000 vs 2003, vs 2008)
How to define a policy on a Per CA Basis
To include a policy in issued certificates, enter the following commands at a command prompt:
certutil -v -setreg policy\EnableRequestExtensionlist "+2.5.29.32"
certutil –shudown
net start certsvc
You can disable the setting with
certutil -v -setreg policy\EnableRequestExtensionlist "-2.5.29.32"
certutil –shudown
net start certsvc
How to define OCSP cache duration
The following commands let you set, modify, and delete the Max-Age header setting.
appcmd set config /section:httpProtocol /+customHeaders.[name='cacheControlHeader',value='max-age=604800']
To view the current httpProtocol custom headers
appcmd list config /section:httpProtocol
How to import offline CA certificates into AD
:
: Root CA certificates
:
certutil -dspublish -f concorp-ca-00_CorporateRootCA.crt RootCA
:
: Sub CA certificate
:
certutil -dspublish -f connoam-ca-00_IntermediateCA1.crt SubCA
:
: Root CA CRLs
: Since these are .NET CA CRLS that have the publication location as
: part of the CRL, the publication location is optional
:
: |-- publication location ---|
:
certutil -dspublish -f CorporateRootCA.crl concorp-ca-00 CorporateRootCA
:
: Sub CA CRLs
:
certutil -dspublish -f IntermediateCA1.crl connoam-ca-00 IntermediateCA1
How to enable PKCS#1 v1.21
This is enabled when the CAPolicy.inf file has AlternateSignatureAlgorithm=1. Be sure to be aware of compatibility issues.
Finally one should know that installing AD Certificate Services isn't as simple as adding the role. You should check this VBS Installation script and ensure file CAPolicy.inf should be edited as needed for your environment
How to define a Cross Certificate Distribution Point
Windows AD Certificate Services enable this in the CAPolicy.info file with the [CrossCertificateDistributionPointsExtension] entry
Misc: AIA differences when upgrading Windows 2000 CA to Windows 2003
Note that there is a change in behavior between Windows 2000 and 2003 CAs. The AKI extension of certificates issued by Windows CAs differs between Windows 2000 and Windows Server 2003. By default, the following information is stored in the AIA extension of issued certificates.
Windows 2000 The AIA extension of certificates issued by the CA includes the LDAP DN of the issuing CA (Issuer name), the serial number of the issuing CA’s certificate, and the key hash of the CA certificate’s public key.
Windows Server 2003 The AIA extension of certificates issued by the CA only includes a hash of the public key of the issuing CA, also known as the Key-ID.
The change in behavior is due to chaining errors that could occur when a CA’s certificate was renewed. The default Windows 2000 behavior could result in incomplete chains if the CA certificate used to sign the issued certificate was not available to the client. With the Windows Server 2003 default behavior, if the CA was renewed with the same key pair, any CA certificate for the issuing CA that uses the same key pair could be included in the certificate chain.
You can imitate the old behavior by running this command
certutil -setreg policy\EditFlags -EDITF_ENABLEAKIISSUERNAME
certutil -setreg policy\EditFlags -EDITF_ENABLEAKIISSUERSERIAL
Listing certificates in AD
This command will list the certificates published in Active Directory.
certutil -viewstore "ldap:///CN=Certification Authorities,CN=Public Key Services,CN=Services,CN=Configuration,DC=contoso,DC=com?cACertificate?one?objectClass=certificationAuthority"
ISIS MTT v1.1 PKI Compatibility
See this KB Article for procedures, also here is an alternative CAPolicy.inf method for ISIS MTT v1.1