Certificate Company Recommendations

[Gongalong]

Hi folks,

 

We’re trying to get LDAPS setup here, and need a certificate with a common name and a subject alternative name (.local domain). Can anyone recommend a straightforward company that can supply this?

 

I’ve checked with GoDaddy and they seem confused that it’s for a server rather than a website, which I didn’t think boded well!

 

Thanks

[3s-gtech]

With a .local domain that can't be externally resolved, I think you're onto a loser getting a third-party cert for this. You may have to do what most do and use an internal CA for this job. If you need that LDAP access outside of your LAN, you may have further problems.

[jthompson]

I'm not sure that you can buy anything .local any more. I'd have thought you could do it all yourself, though. Create your own certificate authority and have that self-sign any .local certs you need. The certificate for the CA would need to be added to whatever systems need to trust it.

[Gongalong]

@3s-gtech The common name will be publicly accessible (albeit locked down to certain IPs within the firewall), but the certificate needs a local name as well for the certificate to work with the DC. This is trying to setup Jamf School (cloud based Apple device management system) to talk to our DC.

 

I asked elsewhere and it seems that no cerfiticate companies will offer with a .local domain as well https://cabforum.org/internal-names/

 

We did initially try to get the Certificate Authority role up and running on the server, but that was so problematic we switched to buying a certificate. This is proving a nightmare to setup!

[3s-gtech]

You'd need a certificate with SAN (multi domain) which I'd imagine for a .local is either impossible or very specialist to get working.

 

Any way of doing it with Let's Encrypt? With that, I don't buy any certs now; including for internal Exchange, web services etc.

[bald_pig]

Can't be done externally with .local. Either set up a local CA, or use an alternate UPN

[Brimstone]

@3s-gtech The common name will be publicly accessible (albeit locked down to certain IPs within the firewall), but the certificate needs a local name as well for the certificate to work with the DC. This is trying to setup Jamf School (cloud based Apple device management system) to talk to our DC.

 

Is this a trust signing cert for Jamf..?

 

You can create this very easily using a Jamf Nation account...

 

https://www.jamf.com/jamf-nation/articles/649/creating-a-signing-certificate-using-jamf-pro-s-built-in-certificate-authority

[Gongalong]

It's a cert for Jamf School to talk to LDAPS on our DC. Apparently it needs both the .local name and the public facing name. Proving very difficult to setup, but Jamf can't give any guidance other than an old Microsoft document.

[3s-gtech]

Can Jamf use OAuth 2? That's what I eventually used when I was looking at LDAPS integration with Moodle - it was then just plugged into our Azure connection.

[Gongalong]

It can use Azure, but we federate Office 365 with RM Unify so can't use it.

 

Other options are Google (which we don't use) and SOMToday (no idea, and Google isn't finding much).

[Arthur]

This is proving a nightmare to setup!

Could you use the PowerShell PKI cmdlets (Get-Command -Module PKI) to generate a self-signed certificate for the required domain(s)? e.g.

 

$Duration = (Get-Date).AddYears(5)
$Cert = New-SelfSignedCertificate -DnsName [color="#FF0000"]school.local[/color],[color="#FF0000"]school.co.uk[/color] -NotAfter $Duration -CertStoreLocation cert:\LocalMachine\My
Move-Item -Path $Cert.PSPath -Destination "cert:\LocalMachine\Root"

 

Once you have generated the certificate you may need to copy it into the NTDS cert store using the registry method described below.

 

https://www.ip8.it/active-directory-ldaps-and-lets-encrypt-its-possible

 

$thumbprint = $Cert.Thumbprint

$copyParameters = @{
   'Path' = "HKLM:\Software\Microsoft\SystemCertificates\ROOT\Certificates\$thumbprint"
   'Destination' = "HKLM:\SOFTWARE\Microsoft\Cryptography\Services\NTDS\SystemCertificates\My\Certificates\$thumbprint"
   'Recurse' = $true
}
Copy-Item @copyParameters

Edited January 9, 2020 by Arthur

[Gongalong]

Does this still need the Certificate Authority role on the server to setup?

 

The US$64M question is whether it will generate a certificate with both a public address and a .local SAN.

[Arthur]

Does this still need the Certificate Authority role on the server to setup?

Nope!

 

The US$64M question is whether it will generate a certificate with both a public address and a .local SAN.

It did when I tested it.

[Gongalong]

I'm amazed it doesn't need the CA role. Thanks Arthur, that's really helpful!