Windows 11 and Certificate Authority best practice

[mwild]

I am aware of the issues with WIFI on Windows 11 due to credential guard. I know I have the option to disable credential guard, but to allow credential guard to run and move to EAP-TLS I need to install a new Certificate Authority. The existing CA is a standalone CA/NPAS and needs updating.

 

Best practice seems to be create a standalone root-CA then a subordinate enterprise CA then shutdown the root-CA.

Is this what people are doing for their Certificate Authorities or something else?

 

[DrCheese]

Hello -

 

Yes, you want an offline root CA that you just turn on every so often (yearly usually) to update your CRL with. I followed the guides on Windows noob for all our CA stuff, which goes through setting up an offline root CA, an online intermediate CA & then a CRL server that's hidden behind an azure app gateway. Set it up a few years ago during a quiet period (mainly to learn how) but it's been invaluable since as it made doing the 802.11 wifi stuff straight forward & later useful for setting up AOVPN.

 

 

[mwild]

5 minutes ago, DrCheese said:

Hello -

 

Yes, you want an offline root CA that you just turn on every so often (yearly usually) to update your CRL with. I followed the guides on Windows noob for all our CA stuff, which goes through setting up an offline root CA, an online intermediate CA & then a CRL server that's hidden behind an azure app gateway. Set it up a few years ago during a quiet period (mainly to learn how) but it's been invaluable since as it made doing the 802.11 wifi stuff straight forward & later useful for setting up AOVPN.

 

 

Thanks,

Are you able to share the link to these guides? 

We are not using Azure currently but not not read anything about a CRL server thus far.

[DrCheese]

Yes sure - Here you go 

https://www.windows-noob.com/forums/topic/16252-how-can-i-configure-pki-in-a-lab-on-windows-server-2016-part-1/