Active Directory Certificate Services

Installing and using Active Directory Certificate Services to create trusted Certificates in an AD Domain.

[@ball_soup]

Thanks for this. Previous IT guy installed ADCS on a DC that was due for a replacement, and I ended up completely breaking the DC while removing the AD roles. I’ve been trying to figure out how to do this for a few days now and you’ve really helped out.

[@ProfessorAndrew]

Glad it to hear it was helpful.

[@bernicastaneda8965]

!!Excelente Contenido muy bien explicado saludos de Guate

[@ovais83]

Awesome content, very clear and precise. You indeed explained it like a professor but nailed it like a rockstar! :)

[@ProfessorAndrew]

That's very kind, thank you for the feedback.

[@a-hit8454]

Finally !!! Someone doing it right ! In every single video I've seen so far CA was being installed on the DC 😵😵

[@ProfessorAndrew]

Thank you. In a practice environment you sometimes have to work with extremely limited resources. Luckily I had multiple servers in this case.

[@ShivamSharma-vv9lw]

Amazing video you have created, very detailed and simple explanation. thank you sir.

[@ProfessorAndrew]

Thank you for the kind words.

[@boucharayoussef5943]

Hey Professor, keep up the good work!

[@ProfessorAndrew]

Thank you for the encouragement.

[@sglant]

Thank you so much. I was over-thinking my setup. I was using the wrong choice in the CSR request. Duh for me. Thanks for clarifying!!!!!!

[@ProfessorAndrew]

Glad it helped!

[@fredrikstustad5185]

thanks, that explaned my problem to get my sertificate to work. (install domain before sertificate) now it work.

[@ProfessorAndrew]

Thank you for the feedback.

[@raj3098]

Really nice ..explained

[@tingtingren2267]

thanks , it is a very clear explaination

[@ProfessorAndrew]

You are welcome, Thanks for the feedback.

[@thecalopor]

I am very grateful sir, you just saved my job. God, or whoever you believe in, bless you !

[@ProfessorAndrew]

Thank for the kind words.

[@intense0excellent]

Great video!!

[@DigsWigs2022]

I cant believe this is free. Thank you.

[@ProfessorAndrew]

I'm glad it was helpful. You're welcome!

[@abinashkumarsinha8958]

Its nice and wonderful explanation how certificate works

[@ProfessorAndrew]

Thank you for the feedback.

[@ryanhindley6274]

Very helpful! A bit ironic that you are showing how to do Windows infrastructure from a Mac! LOL

[@ProfessorAndrew]

I have a much longer history with Windows than with Macs.

[@phityaredchaowarit2031]

Thank you for This VDO.

[@ProfessorAndrew]

You’re welcome

[@fabiantoro7146]

This is exactly how a live demonstration in classroom should look like. I watched your video a couple of years ago and helped me for academic purposes. Now that I have to actually work with certificates I have a better picture. Thank you so much, you excel at explaining concepts. Just a couple of questions, if you have the time to reply: what happens if after installing the certificates signed by the internal CA I decide to use a different web browser such as Firefox or Chrome? Do I have to manually install the certificate on the workstation even if I have 100 computers?

[@TheRushabhy2k]

Hi Andrew Sir, I hope you're doing well. I wanted to check if the video mentioned above can guide me in installing it on my existing infrastructure. My main server isn't responding well, so I plan to set up another primary server and transfer the FSMO role to the secondary one. After that, I'm looking to install the AD DC certificate. Could you confirm if this is the right approach?

[@LinusTimon]

*you need to be a Domain Admin, tried it as a normal domain member and the Enterprise CA option was greyed out.

[@afshinorujzade2895]

Well explained

[@davidtuti1]

Thanks for your tutorial. How could I get p12 of the p7b certificates downloaded?

[@jrmcnair1]

Thanks very much for the clear and informative video! I wanted to add that after setting all this up, the certificate I issued in my home lab for my Nginx Linux reverse proxy was failing until I added subjectAltName to the certificate request. Hopefully, this can save someone experiencing the same issue from the hours of aggravation I had! I did have a follow-up question. I added the CA roles to a headless VM (Windows Server 2019 Standard) and I don't get the Certificate Authority tooling as a result. I tried adding the feature to my Hyper-V host server, but it throws an error on start, and it isn't an option for the CA server. Is there a way to get the tooling working? Thanks again!

[@danratsnapnames]

yes, it also depends on how headless you are.. if you included powershell and other management tools, then its likely just the windows server manager that needs to be added.. otherwise you'll have to add the dependancy roles for server manager.

[@NevaranUniverse]

All of the web services or stuff like IPMI need a private key alongside the certificate- How do you get that one? Could not find any information about it

[@user-ug8cl9pr2c]

Hey Professor, thank you for your truly enlightening videos! As a recent graduate, I'm currently assisting an enterprise client on a private isolated network. They have Windows Server 2019 and Windows 10 workstations, and they're eager to enhance their network security and encrypt the traffic. I've configured Active Directory, user accounts, and security policies, but I'm unsure about encrypting the traffic between clients and the server. Can AD CS help in my case , what are your recommendations ? Thank you in advance for your valuable advice!

[@ProfessorAndrew]

Sorry for the late response. Yes AD CS can assist in this but it’s probably beyond the scope of what can be done through comments in KZbin. Hopefully you were able to do more research and testing to find your answers.

[@danratsnapnames]

yea.. the answer is NO. encrypting client data purely depends on the application and protocol your attempting to encrypt. some requires a cert, some dont. some can use a self signed, some cant. its a pretty big world when it comes to encrypted vs non. some non-encrypted comminications is encrypted, but just on the data layer and not the protocol layer. WinRM is a perfect example of this, it uses TLS to encrypt the data being sent over a http non-encrypted protocol.

[@sa77if]

Thanks for the tutorial Professor! Is this the same setting for authenticating outlook app using CBA? is there more videos on this subject

[@ProfessorAndrew]

Sorry for the late reply. That's not something I've done so I can't offer any guidance.

[@tedmolavi8764]

Thanks for your informative video. Question: Are there any security concerns about installing ADCS on a DC? The DC doesn't give you any warnings when you try to do so. I have read different views on this online. Please advise. Thanks

[@ProfessorAndrew]

I would absolutely avoid putting ADCS on a DC for a number of reasons. I definitely prefer to keep services on separate servers, especially since virtualization makes it cheaper and easier to manage. In the AWS environment we use for our classes we have a limited number of servers and frequently install multiple services on the same server.

[@danratsnapnames]

yes, dont do it.. DC's are busy enough, dont give them more work. a DC should just be doing DC.. nothing else. the last thing you ever want is to have a bad DC that your trying to demote and there's a tun of other stuff on it. like a root CA, would be a nightmare.

[@bandarbandar6102]

it is a very clear explanation. thank you, sir. Do we need to add the centos to DC server as a member ?

[@firaschahine8484]

You can request a digital certificate for non-Windows servers using either the manual or Web-enrolment.

[@bandarbandar6102]

@@firaschahine8484 I tried to creat certificate from IIS but chrome didn’t accept it even if Internet Explorer accepted it . I tried in linux ubuntu server with openssl but doesn’t work!!

[@ProfessorAndrew]

Sorry about the delayed response. The server (running IIS or Linux) doesn't need to a member, it just needs to get the certificate from a server that the web client trusts. In a Domain environment, the Windows computer and therefore IE will trust the Cert Server. Chrome doesn't use the Windows Trusted Certificate Server list so the AD CS server would need to be manually added.

[@klassebip2934]

i followed your part, but each time for example when we try in the IE browser to go to the link what is running on XAMP it still says not secured. and then when viewing the certificate it is the localhost and not the certificate, how to change this?? having several virtual machines. dc01 (ad-ds) dc02 (ca etc) file01 (fileserver) srv-app (xamp running with web application) and the web application when we go through our network the link is not secured. have tried to import it as well via mmc on the srv-app from the file01 since it is a shared folder it sees the certnew ....

[@ProfessorAndrew]

Sorry for the delayed response. I'm guessing that your xampp configuration is pointing to your self-signed certificate instead of the new one you created.

[@effoya]

our domain computer keeps installing internet certificate when they are connected outside the LAN. When they return back to the LAN the internet certificate block them from accessing the LAN unless you delete. How best can I handle this?

[@ProfessorAndrew]

Sorry for the delayed response. That seems like too specific an issue to troubleshoot here.

[@kamarchand]

Have you cover the case with Chrome and Firefox?

[@ProfessorAndrew]

They use their own certificate stores. You could individually add the CA or use a policy to configure it for all users but that's beyond the scope of what I cover in this lab.

[@d4rky83]

Thanks a lot for that nice demonstration and explanation. :-) You mentioned that FireFox and Chrome use their own certificate stores. But what about Edge.? My expectation would be that Edge clients in the same domain would also trust the domain generated certificate automatically since it is also a MS product and IE is basically dead especially since Win 11. Can you confirm that?

[@ProfessorAndrew]

Sorry, I don't have a system to confirm that and I try to avoid edge as much as possible. I assume that edge would use the Windows Certificate Store. If I have things set up at some point I'll try to verify.

[@phungn02]

@@ProfessorAndrew Why would Chrome and Edge work with the certificate generated but only IE? What do we need to do to get Chrome and Edge to work?

[@VargaBacsi]

@@phungn02 Yes, I would like to know this as well. I started a new job about month ago and they have it working (and I am new to AD CS). Maybe @ProfessorAndrew can answer. I will try and figure it out and report back.

[@jayrsp1221]

@@phungn02 I'd like to ask if you have any updates on the issue with Chrome and Edge?

[@jayrsp1221]

I think I have a found a workaround for Chrome and Firefox to trust the certificate. The default certificated created in AD CS doesn't have a SAN which is needed to validate by the browsers. You just need to manually create a certificate request through MMC (Certificates) and add an attribute for DNS and that should work for Chrome, Edge and FireFox.

[@SnakePlissken1]

Question it appears the MS Certificate Service only works to clients on the domain. If I use it for outside public internet I get a Cert Error? Does this mean we have to pay for Certs?

[@ProfessorAndrew]

That is correct. The purpose of a Certificate is to prove the system you are connecting to is who they claim to be. That means the issuer of the Certificate needs to be trusted. For public systems you would need to purchase a cert from an authority that it publicly trusted.

[@SnakePlissken1]

@@ProfessorAndrew That’s one use of a CERT, the other is to provide HTTPS - so it’s unless you are doing E-commerce a trusted cert is really pointless. If you want to just encrypt traffic then it’s needed. Most users are clueless as to how it works. To my knowledge it’s not possible to write your own cert to decrypt or spy.

[@ProfessorAndrew]

@@SnakePlissken1 Public Key Certificates (X.509) include verified identity using a digital signature. The only way the identity can be trusted is if the issuer (or issuer of the issuer, or root CA, etc.) is trusted by the system viewing the certificate. Web browsers are configured to provide significant warnings (errors) when an untrusted certificate is encountered. Within a domain you can control the clients so you can configure them to trust your certificate. On a system that is not under your control you need to use a certificate that will be trusted by that system in order to avoid the errors.

[@SnakePlissken1]

@@ProfessorAndrew As I said before, a Cert does 2 things. The most important is allows encryption over 443. Second may or may not tell someone it’s a valid company for e-commerce which is debatable since anyone can pay for a stupid key. Those of us who only need to use encryption over 443 really could care less if key comes from Joe blow. In the USA we use Dun & Bradstreet !!! Popping up a stupid box telling users key doesn’t match is stupid. Your data is still encrypted!!!

[@ProfessorAndrew]

@@SnakePlissken1 Without being able to confirm who you're talking to, what is the point of encryption? You can be talking to Eve who is claiming to be Bob or you could be talking to Bob with Eve acting as a man in the middle. In both cases your data is encrypted but can be decrypted by Eve (the attacker). This is why Public Key certificates require trusted identity.

[@danratsnapnames]

i know your a professor and all, but did you choose AD integrated because your relying on windows integrated auth? because you really didn't use any of the other features of AD integration, such as "Request Domain Cert" which, i may add, will handle RENEWALS for you automatically.. as opposed to your manual request, wich will require you to manually renew. or am i really off base here?

[@ProfessorAndrew]

The purpose of the video is to show some basics so students can see it in use. AD integrated puts the CA in the Microsoft Browser’s trusted roots so you can see it work. Going into other features is further than we go in this class. It’s a walk before you run situation.

[@rudyfranz2717]

Good video. Next time enlarge windows for better visualization.

[@ProfessorAndrew]

Thanks for the feedback. I try to balance what I'm showing based on what type of screen the viewer will see the video. I'll keep this in mind going forward.

[@OLIMJON0051]

can you teach a web server access algorithm via pki or fingerprint

[@ProfessorAndrew]

It's not something in my plans right now but I'll keep it in mind.

[@b5nj1m9n]

Hey, very nice video but I am stuck on something and I can't seem to find a solution. I am running my AD and CS service on the same server (just for testing since my hardware resources are limited) and after following your steps I can successfully visit the site via https ON THE SERVER itself but as soon as I try this on a computer, which is joined the domain, I get an error that the site is unsecure. I tried importing the ca.cert again in the trusted root ca's on the windows machine but despite that it still gives me the same error. Could you, or someone else, help me figure this out because I don't know what to do anymore. I'm pretty new to the certificate stuff as well.

[@ProfessorAndrew]

Sorry for the late response. On the client computer only Edge (or Internet Explorer) will use the system trusted Certs. If you are using another browser you will need to add the trusted root in that store.

[@n2201]

Sir, please use lower resolution on your computer, I am trying to watch this video on my small-screen laptop, can't see your screen well

[@ProfessorAndrew]

I have to balance a useful resolution with being able to show my students what they need to see. That said, I will keep this in mind for future videos.

[@shajiljohn]

Hey Professor, Do you offer your tech expertise as a freelancer..

[@ProfessorAndrew]

I'm always willing to listen but my day job keeps me pretty busy.

[@shajiljohn]

@@ProfessorAndrew I am setting up an ADFS server and stuck with a issue. Lemm know if u can help with this.

[@phungn02]

@@shajiljohn Do you still need help?

[@naeemmun2781]

How to import 3rd party certificates

[@ProfessorAndrew]

From a public certificate vendor? You would need to create a CSR, submit it to the vendor, and then use the resulting certificate on your own server.

[@OLIMJON0051]

hi Professor

[@OLIMJON0051]

please