DirectAccess, SSL Certificates, CSRs and Let's Encrypt!

[dry]

So I'm trying to set up Direct Access on Server 2012 and am a bit stuck with certificates. We need an SSL certificate issued by a trusted certificate authority (as I think self-signed certificates aren't trusted externally?).

 

I've attempted to use Let's Encrypt! (via Let's Encrypt Win Simple) and although I've successfully been issued an SSL certificate, DirectAccess needs a certificate that has been requested using a CSR (Certificate Signing Request).

 

LEWS doesn't appear to allow the upload of a CSR. I've found Get HTTPS For Free! who allow the upload of a CSR, but it requires an account email address and an account public key. I'm stuck on the public key bit!

 

Guides are suggesting you can run a command from OpenSSL to export your public key, but I haven't got OpenSSL on our (Windows) server.

 

The question is, should I try installing OpenSSL and exporting a public key from there? Is there an easier way to achieve this?

 

I've tried to use SSL For Free too, but even though they allow the upload of a CSR, I'm getting an application error each time I try to download the certificate.

 

Am I being thick? Do we need to actually buy an SSL certificate *shock horror!*?

[Blue_Cookeh]

You'd fix all your problems by deploying an internal PKI.

 

You can deploy your own domain wide PKI and send out the root certificate as a trusted root certificate on all your clients, then use your domain PKI to generate all the certs you need for DirectAccess + clients. You don't want to be faffing around with LetsEncrypt and DirectAccess config every 30 days believe me!

 

There are multiple ways you can do this via OpenSSL and Microsoft Certificate Authority Services. I created a 2012R2 VM (off the domain) that holds our root keys and I use to export CRLs etc as necessary, this VM is kept on a USB stick in the safe, and a backup kept off site somewhere. We then have an 'online' intermediate signing CA which generates certificates for our servers, services, and clients, which is fully domain joined and integrated into AD DS and AD GPOs.

[dry]

You'd fix all your problems by deploying an internal PKI.

 

You can deploy your own domain wide PKI and send out the root certificate as a trusted root certificate on all your clients, then use your domain PKI to generate all the certs you need for DirectAccess + clients. You don't want to be faffing around with LetsEncrypt and DirectAccess config every 30 days believe me!

 

There are multiple ways you can do this via OpenSSL and Microsoft Certificate Authority Services. I created a 2012R2 VM (off the domain) that holds our root keys and I use to export CRLs etc as necessary, this VM is kept on a USB stick in the safe, and a backup kept off site somewhere. We then have an 'online' intermediate signing CA which generates certificates for our servers, services, and clients, which is fully domain joined and integrated into AD DS and AD GPOs.

Thanks, that makes sense. I think I'd been over thinking this- and hadn't thought about deploying a PKI on our domain.

 

Now for some reading up on how to implement it!

[simpsonj]

If you happen to be successful, and are really good at writing guides, would be interested to read how you did it! I've been thinking about setting this up myself, but setting up the external part has always put me off.

[dry]

An update.

 

Have got RemoteAccess working successfully. I started to look down the avenue that @Blue_Cookeh suggested, reading many TechNet articles and various blogs, but hit a stumbling block at the part where an OID is required for an online CA server. I'm sure I've just mis-interpreted this, but at that point I was ready to call it quits and buy an SSL certificate.

 

Got some fresh air and was thinking it over- and I thought about the CSR issue with sslforfree.com. I realised I'd been including the 'BEGIN NEW CERTIFICATE REQUEST' and 'END NEW CERTIFICATE REQUEST' lines when submitting my CSR. I removed these and hey presto, I got my free certificate.

 

The rest was plain sailing from there.

 

We're still in the predicament where I'll have to manually apply for an SSL certificate every 3 months, but I'm glad we've got it working at no cost- simply so we can test DirectAccess. Although I'm keen on creating our own PKI (it'll be something to put on the CV!), I'm also tempted to buy an SSL certificate with longer validity. CheapSSLSecurity sell a 3-yr SSL cert for £11.97.

[jeff]

Hi,

 

Likewise I am interested in setting up DirectAccess on server 2012 for testing. Can you recommend any good guides, tutorials etc?

 

Thanks.