Certificates...?

[Koldov]

Ok there's no way around this, so I'm just going to have to ask....

 

Do I need certificates on my server, if so which ones and how do I create them?

 

We don't do anything complicated, it is just a simple client / server relationship (AD, DNS, File server, Print server, SIMS etc.).

 

No website, no exchange, no BYOD, no remote access.

 

However, I just installed Microsoft Remote Desktop for a Mac to connect to a server internally and it complained about not being able to identify the server (due to some certificate signing issue) and Event Viewer on our main server, regularly moans about connections:

 

During the previous 24 hour period, some clients attempted to perform LDAP binds that were either:

(1) A SASL (Negotiate, Kerberos, NTLM, or Digest) LDAP bind that did not request signing (integrity validation), or

(2) A LDAP simple bind that was performed on a clear text (non-SSL/TLS-encrypted) connection

 

Does anybody have a clear, basic (very basic) guide on what I need to do, most Google hits seem to be about IIS and website/remote access certs.

 

Also, what impact will any actions have (I'm not keen on doing something that will suddenly lock everyone out of the server or encrypt all the data)...

 

Thanks in advance.

[3s-gtech]

Do you need one? No. However, it may help for things like RDS (though it will just stop the popups), and other services you may wish to provide. You could even implement a CA service (we have a server that just does this) which can help - several MS services can detect it, request a certificate directly and install it. Our CA is trusted internally, so anything issued by it is trusted and we don't get errors/prompts.

[localzuk]

We have our own internal CA for this sort of thing.

[jhothersall]

Same question here how do you do it?

 

Thanks

 

James

[Koldov]

Well, in all honesty the steps look very straight forward.

 

https://technet.microsoft.com/en-us/library/cc731183(v=ws.11).aspx

 

But I'd like a little more in depth about how this affects anything and what it might break!

 

In a 'production environment' I really don't want to install it and then find nobody can log on or access the server....

[3s-gtech]

Nope it shouldn't cause any issues like that! It's just a service that then becomes available on the network. Essentially you're just creating a local version of the CAs that issue certs commercially. You can use it to issue certificates for internal services (ours handles our Skype for Business, some internal web services, things like that). You could also not use it at all. Some of the wizards that installers for MS software and services (and the certificate wizards) can automatically detect your local CA and request a cert from it, making local trusted deployments extremely easy! When I made our current one, I remember most guides advising that it was standalone - our CA server does nothing else.

[Koldov]

Right I'm gonna do it!

 

Below steps for review/comment/criticism:

 

1. On the Specify Setup Type page -------- Enterprise.

2. On the Specify CA Type page ------------ Root CA.

3. On the Set Up Private Key page --------- Create a new private key.

4. On the Configure Cryptography page -- RSA#Microsoft Software Key Storage Provider - 2048 - SHA256.

5. On the Configure CA Name page ------- XXX School Domain CA.

6. On the Set Validity Period page --------- 5 Years.

7. On the Configure Certificate Database page -- Accept the default location.

8. On the Confirm Installation Options page -- Review all of the configuration settings.

 

I don't have a server solely to run this on, both are DC's and control, file server, DNS, print server etc. Is it a big load/drain on resources?

 

Also, is there any point in installing this on the other DC as a subordinate CA?

[3s-gtech]

It's not that it's a big drain, it's the hooks into the AD and the refresh cycles of DCs (which are usually updated frequently, where CAs tend to get built and left). If you have any virtualisation capability this is a good thing to use it for. If not, just bear in mind that it may be a little more difficult to configure correctly.

 

I wouldn't build a second on your other DC. We have a pretty large network and we just stick with one.

[Koldov]

Hmmmm....

 

Looking at whether or not to install on a DC and the first few Google hits have pretty much put me off altogether!

 

https://redmondmag.com/articles/2015/06/01/ad-certificate-services.aspx

 

The replies to this guys article make me think they'd actually string him up if they could!

 

Obviously most of the replies come from people who probably make their living by 'advising', 'consulting' or writing books about it and I know we are all touchy about less technical individuals trying to say how I.T. make their living is easy (click install and it 'just works', how many Teachers or SLT members do we know who think that?!), but it raises enough concerns to put me off.

 

Not sure how it ends up that installing certificates for security makes things less secure but hey ho....

[mavhc]

Well, you have to know what it means to have a CA, what you can do with it, just like you need to know what you can do with access to a DC, most of the warnings are for either enterprises with multiple levels of computer admins, or where they expect long term hackers.

 

So, depends if it's a school with 1 DC whose passwords are mostly their kids names, where the domain admin password is known by 6 random teachers, or a multi school AD with proper security

[mavhc]

https://blog.css-security.com/blog/diy-pki-five-common-mistakes

 

You can ignore a lot of it, but you should probably know why you're ignoring it

[Homer]

Just don't install it on a DC it will cause you problems when you come to upgrade/move/decomission that DC

 

Run up a server core VM and run it off that or if you have any other boxes doing menial tasks such as NPS throw it on there