Revision ca20fcb5-cdd7-4f7f-b06a-7aaf79aa9792 - Information Security Stack Exchange

**AD CS Specific commands**

This is a list of commands relevant to configuring a Windows 2008 R2 CA Server.  I removed them from the other post since that informative was getting too long, and not all the commands directly relate to setting up a CA.

This is more of the How to section, rather the "what and why".  It also includes version-specific differences between CA versions (2000 vs 2003, vs 2008)

----

**List what Enrollment Policy Edit Flags**

[Some requests from the client may get automatically stripped][1] based on these hidden server settings.

    C:\Users\ChrisLamont>certutil -getreg

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CertSvc\Configuration:
    
    Keys:
      Secure Email Root v1
    
    Values:
      Active                   REG_SZ = Secure Email Root v1
      DBDirectory              REG_SZ = C:\Windows\system32\CertLog
      DBLogDirectory           REG_SZ = C:\Windows\system32\CertLog
      DBTempDirectory          REG_SZ = C:\Windows\system32\CertLog
      DBSystemDirectory        REG_SZ = C:\Windows\system32\CertLog
    
      DBSessionCount           REG_DWORD = 64 (100)
      LDAPFlags                REG_DWORD = 0
    
      DBFlags                  REG_DWORD = b0 (176)
        DBFLAGS_MAXCACHESIZEX100 -- 10 (16)
        DBFLAGS_CHECKPOINTDEPTH60MB -- 20 (32)
        DBFLAGS_LOGBUFFERSHUGE -- 80 (128)
    
      Version                  REG_DWORD = 40001 (262145) -- 4.1
      SetupStatus              REG_DWORD = 6001 (24577)
        SETUP_SERVER_FLAG -- 1
        SETUP_DCOM_SECURITY_UPDATED_FLAG -- 2000 (8192)
        SETUP_SERVER_IS_UP_TO_DATE_FLAG -- 4000 (16384)
    CertUtil: -getreg command completed successfully.
    
    C:\Users\ChrisLamont>certutil -getreg policy\editflags

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CertSvc\Configuration\Secur
    e Email Root v1\PolicyModules\CertificateAuthority_MicrosoftDefault.Policy\EditF
    lags:
    
      EditFlags REG_DWORD = 83ee (33774)
        EDITF_REQUESTEXTENSIONLIST -- 2
        EDITF_DISABLEEXTENSIONLIST -- 4
        EDITF_ADDOLDKEYUSAGE -- 8        // <--- THIS ENTRY REMOVES A CLIENT'S Key Agreement  
        EDITF_ATTRIBUTEENDDATE -- 20 (32)
        EDITF_BASICCONSTRAINTSCRITICAL -- 40 (64)
        EDITF_BASICCONSTRAINTSCA -- 80 (128)
        EDITF_ENABLEAKIKEYID -- 100 (256)
        EDITF_ATTRIBUTECA -- 200 (512)
        EDITF_ATTRIBUTEEKU -- 8000 (32768)
    CertUtil: -getreg command completed successfully.


The solution is to run the command `certutil -setreg policy\EditFlags -EDITF_ADDOLDKEYUSAGE` which in turn updates

         Configuration\spatula\PolicyModules\CertificateAuthority_MicrosoftDefault.Policy\EditFlags:
 




**How to define a policy on a Per CA Basis**

To include a policy in issued certificates, enter the following commands at a command prompt:

     certutil -v -setreg policy\EnableRequestExtensionlist "+2.5.29.32"
     certutil –shudown
     net start certsvc

You can disable the setting with

      certutil -v -setreg policy\EnableRequestExtensionlist      "-2.5.29.32"
      certutil –shudown
      net start certsvc


**How to define OCSP cache duration**

The following commands let you set, modify, and delete the Max-Age header setting.

      appcmd set config /section:httpProtocol /+customHeaders.[name='cacheControlHeader',value='max-age=604800']

To view the current httpProtocol custom headers

      appcmd list config /section:httpProtocol



**How to import offline CA certificates into AD**

    :
    : Root CA certificates
    :
    certutil -dspublish -f concorp-ca-00_CorporateRootCA.crt RootCA
    :
    : Sub CA certificate
    :
    certutil -dspublish -f connoam-ca-00_IntermediateCA1.crt SubCA
    :
    : Root CA CRLs
    : Since these are .NET CA CRLS that have the publication location as
    : part of the CRL, the publication location is optional
    :
    :                                              |-- publication location ---|
    :
    certutil -dspublish -f CorporateRootCA.crl     concorp-ca-00 CorporateRootCA
    :
    : Sub CA CRLs
    :
    certutil -dspublish -f IntermediateCA1.crl     connoam-ca-00 IntermediateCA1

**How to enable PKCS#1 v1.21**

This is enabled when the CAPolicy.inf file has `AlternateSignatureAlgorithm=1`.  Be sure to be aware of compatibility issues.

Finally one should know that installing AD Certificate Services isn't as simple as adding the role. You should check this [VBS Installation script][2] and ensure file [CAPolicy.inf][3] should be edited as needed for your environment 

**How to define a Cross Certificate Distribution Point**

Windows AD Certificate Services enable this in the CAPolicy.info file with the `[CrossCertificateDistributionPointsExtension]` entry


**Misc: AIA differences when upgrading Windows 2000 CA to Windows 2003**

Note that there is a change in behavior between Windows 2000 and 2003 CAs.  The AKI extension of certificates issued by Windows CAs differs between Windows 2000 and Windows Server 2003. By default, the following information is stored in the AIA extension of issued certificates.

* Windows 2000 The AIA extension of certificates issued by the CA includes the LDAP DN of the issuing CA (Issuer name), the serial number of the issuing CA’s certificate, and the key hash of the CA certificate’s public key.

* Windows Server 2003 The AIA extension of certificates issued by the CA only includes a hash of the public key of the issuing CA, also known as the Key-ID.

The change in behavior is due to chaining errors that could occur when a CA’s certificate was renewed. The default Windows 2000 behavior could result in incomplete chains if the CA certificate used to sign the issued certificate was not available to the client. With the Windows Server 2003 default behavior, if the CA was renewed with the same key pair, any CA certificate for the issuing CA that uses the same key pair could be included in the certificate chain.

You can imitate the old behavior by running this command

     certutil -setreg policy\EditFlags -EDITF_ENABLEAKIISSUERNAME
     certutil -setreg policy\EditFlags -EDITF_ENABLEAKIISSUERSERIAL



**Listing certificates in AD**

This command will list the certificates published in Active Directory. 

    certutil -viewstore "ldap:///CN=Certification Authorities,CN=Public Key Services,CN=Services,CN=Configuration,DC=contoso,DC=com?cACertificate?one?objectClass=certificationAuthority"

ISIS MTT v1.1 PKI Compatibility

See this [KB Article for procedures][4], also here is an [alternative CAPolicy.inf method for ISIS MTT v1.1][5]


  [1]: https://web.archive.org/web/20151006051320/http://blogs.msdn.com/b/spatdsg/archive/2006/04/27/585450.aspx
  [2]: https://docs.microsoft.com/en-us/archive/blogs/mrsnrub/q-when-is-a-validity-period-not-a-validity-period
  [3]: https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2003/cc756120%28v=ws.10%29
  [4]: https://web.archive.org/web/20150215020553/http://support.microsoft.com:80/kb/888180
  [5]: https://social.technet.microsoft.com/Forums/en-US/406ce00d-5a29-483e-9b81-7d4867139dad/how-do-i-set-the-keyusage-field-in-my-offline-standalone-root-ca-certificate-to-criticalyes?forum=winserverDS