LDAPS - sorting the certificate

[timbo343]

Ok, i know a fair amount of edugeekers may have already sorted out the LDAPS certificate but i am starting to lose the will to live with it and it's making no sense at all.

 

I have the following:

 

1x Root CA server Running 2012r2 which is a VM not joined to the Domain

1x Subordinate CA server running 2012r2 which is a VM joined to the Domain

 

The Root CA server has 1 issued certificate which i issued out in 2016 and expired back in 2017.

 

The Sub CA server i see has issued some certificates out to my old DCs which do not exist anymore thus the certificate expired in 2017.

 

There is 1 certificate though which had it's validity set to 10 years, i think this was when i set up the AD CS role. I guess this is the Offline Root CA.

 

The guides i followed when setting this up were:

- Root CA - https://stealthpuppy.com/deploy-enterprise-root-certificate-authority/

- Sub Ordinate CA - https://stealthpuppy.com/deploy-enterprise-subordinate-certificate-authority/

 

I don't want to install another AD CS on a DC as i don't want the head ache later on as i have been down that road in the past.

 

Now i am stuck on what the heck i am supposed to do!

 

Can anyone help please?

[Domino]

 

If you open up an issued certificate (or issue a new one) and go to the "certification path" tab you should be able to then open up the issuing and root CA certs.

 

If those are valid and in date, you should just need to get the template set up correctly and issue the certificates you need.

 

Is that what you're asking? The question was a bit vague...

[timbo343]

Thanks for the reply, what happens if the certificate has expired on the DC?

 

 

The initial post was a bit vague but since posting i have been following https://social.technet.microsoft.com/wiki/contents/articles/2980.ldap-over-ssl-ldaps-certificate.aspx to try to get a certificate however i am now faced with an issue.

 

 

As a test i thought i'd see if i can get a cert via the localhost web service but i get the following:

 

 

The permissions are all there and set for the user. The user i'm using is part of the Domain Admin group.

[Domino]

When you request it from the cert mmc with "Computer account" the permissions need to be in place for the AD machine account rather than the logged in user. You could then either make the template available to the machine account and request it through the certificate MMC, or create a CSR and then sign it through the web service.

 

Also to check - the CA and issuing subordinate are both trusted? Their signing certs are both valid (they're usually long validity periods)

[mrbios]

I don't want to install another AD CS on a DC as i don't want the head ache later on as i have been down that road in the past.

 

Sorry to hijack slightly, but what head aches occur from this?

 

I ask this as an idiot that knew no better 8 years ago, and subsequently is running their CA on a DC (In my defence, at the time, i copied what the previous incumbent did on server 2003) I'm drawing ever closer to needing to upgrade my DCs off 2012R2, so this headache is fast approaching.

[timbo343]

When you request it from the cert mmc with "Computer account" the permissions need to be in place for the AD machine account rather than the logged in user. You could then either make the template available to the machine account and request it through the certificate MMC, or create a CSR and then sign it through the web service.

 

Also to check - the CA and issuing subordinate are both trusted? Their signing certs are both valid (they're usually long validity periods)

Thanks will check this tomorrow and come back to you. I'm hopefully having a quiet night to get over the headaches of today! Edited February 26, 2020 by timbo343

[mavhc]

Any root CA you create will be automatically installed on all the machines in the domain, then, AIUI, the idea is that the computers request certs themselves automatically, only works for Windows computers of course, everything else is manual.

 

When I wanted Wordpress to trust AD for LDAP (StartTLS), I had to add the root and the server cert to the Wordpress server.

 

LDAP (StartTLS) is prefered over LDAPS btw.

 

If the root CA has expired, make a new one, if the server cert has expired, it should have made a new one automatically I think

Edited February 26, 2020 by mavhc

[timbo343]

When you request it from the cert mmc with "Computer account" the permissions need to be in place for the AD machine account rather than the logged in user. You could then either make the template available to the machine account and request it through the certificate MMC, or create a CSR and then sign it through the web service.

 

Also to check - the CA and issuing subordinate are both trusted? Their signing certs are both valid (they're usually long validity periods)

 

I have given the template certificate on the Subordinate CA rights to the group Domain Controllers, yet i am still getting the Certifcates types are not available.

 

The web service doesn't work either:

 

 

I think the following is the Root CA certificate that has the long validity on it which is located in the Domain Trusted Root Certification Authority > Certificates.

 

 

As you can see from above, this server has the Personal > Certificates folders but some of my DCs don't have this (see below). I guess this is due to the Subordinate CA has expired?

 

 

The Subordinate CA has a certificate from the Root CA in the Personal > Certificates store but this has expired by 2.5 years:

 

 

Ok, On the Subordinate CA server i have Requested A New Certificate gone through the wizard to find the certificates are listed which i guess they will be as the the local server can see it's own certificates.

 

 

What is the best way to check the CA and Sub CA are trusted?

[Domino]

Okay, so if the subordinate's cert that has expired is it's signing cert that will need to be resolved first.

 

If you open a cert that was previously signed by this, go to certificate chain and view the certificate from the subordinate - you should be able to see if it matches.

 

If it is that one,you'll need to bring the root CA online, have it issue a new Singing Cert to the Subordinate, and then have that issued to the clients "Intermediate Certification Authorities" store.

 

I'd also ensure you've a GPO with auto-enrollment set up once this is sorted - I believe it's present in the Default Domain Policy on Domain creation, but worth checking

 

[timbo343]

@Domino I've just managed to get it sorted so thank you for your help though here is what i did:

 

The subord cert had expired so in CertSev on teh subord server, i right clicked the server > All tasks > Renew Cert. When it asked to choose an online server there was one listed however i'm not sure where this server is, it was setup by the previous network manager but obviously my RootCA wasn't listed as it's not joined to the domain. Clicking Cancel meant i could move the request file to the RootCA.

 

On the RootCA i went into Certsrv and selected Submit a new request. Selected the request file from the Subordinate server. It placed the request in pending and then actioned the pending request - issuing the cert.

 

Now the cert is issued, as stated in the instructions i have (from page 12 onwards of this document > https://stealthpuppy.com/deploy-enterprise-subordinate-certificate-authority/), went to the details tab > copy to file and export the cert in PKCS and tick Include all certificates in the certification path if possible. Once exported i moved the certificate from the RootCA to the SubCA. Opened up Certsrv again and chose to Install CA Cert.

 

Whilst installing i got an error of The revocation function was unable to check revocation because the revocation server was offline. 0x80092013 (-2146885613 CRYPT_E_REVOCATION_OFFLINE) but following this guide provided a work around https://stealthpuppy.com/resolving-issues-starting-ca-offline-crl/.

 

I had to copy the folder Certenroll from C:\windows\system32\certsrv to C:\inetpub\wwwroot\.

 

I grabbed the SubCA certificate from the SubCA server, the location C:\windows\system32\certsrv\CertEnroll and placed it in the Trusted Root Certification Auth of the Domain group Policy.

 

Now via MMC > Certificates (local computer) on the DCs once the DCs have checked in against the subCA server i am able to run All Tasks > Request new certificate and select the LDAPS server from the list.

 

I can now use LDP.exe and connect to AD via LDAPS via port 636.

[Domino]

Nice, seems like you're almost there.

 

You'll want to either move your CRL point to the subordinate CA, or add it as an additional. That way it can be used as a check for anything internal - https://www.vkernel.ro/blog/how-to-publish-the-crl-and-aia-on-a-separate-web-server

 

When all that is working, you should be able to get domain members auto renewing machine certs. This'll let you do things like this, but also have certificate based VPN authentication or similar down the line (that'll require externally accessible CDP/CRL though). And even have user certs auto created and added to AD if you wanted to have the option for PGP encryption without the users having to request certs.

 

Having a working CA internally makes a lot of things easier down the line, once you get over the setup.

[timbo343]

Cheers @Domino

 

during the setup i configured a CNAME in the domain's DNS to point to the SubCA server configuring both the AIA and the CDP.