Designing and Implementing a PKI: Part III Certificate Templates
The series:
Designing and Implementing a PKI: Part I Design and Planning
Designing and Implementing a PKI: Part III Certificate Templates
Designing and Implementing a PKI: Part V Disaster Recovery
Chris here again. In this segment I will be covering setting up certificate templates on the newly created CA hierarchy. Enterprise Certification Authorities (CAs), as well as clients, utilize what are called certificate templates. Certificate templates contain properties that would be common to all certificates issued by the CA based on that template. Windows includes several predefined templates, but Administrators also have the ability to create their own templates specific for their enterprise. When requesting a certificate, a client can just specify the template name in the request and the CA will build the certificate based upon the requestor’s information in Active Directory and the properties defined in the template.
Certificate templates are also used to define the enrollment policy on the CA. First, an Enterprise CA can only issue certificates based upon the templates it is configure to use. For example, if the CorpUserEmail template is not available on the CA then the CA cannot issue certificates based on that template. Second, permissions set on the certificate template’s Active Directory object determine whether or not a user or computer is permitted to request a certificate based on that template. If a user does not have Enroll permissions on a particular template, the CA will deny any request submitted by the user for a certificate based on that template.
As the Windows Server operating system has evolved over the last ten years, so has the concept of the certificate template. Currently, there are three versions of templates:
Version 1 templates were introduced in Windows 2000, and can be used by Windows 2000, Windows Server 2003 (R2), and Windows Server 2008 (R2) Enterprise CAs. Version 1 templates Active Directory objects are created the first time an Enterprise CA is created in the forest. These templates were designed to reflect the most common scenarios for digital certificates in the Enterprise. Unfortunately, if you don’t like the settings we selected you’re pretty much out of luck. Creating new v1 templates, or editing the existing templates, is not supported. The only customization supported is to the permissions on the template.
Version 2 templates were introduced in Windows Server 2003 and are a vast improvement over v1 templates. First and foremost, v2 templates can be modified by an Enterprise Admin. In addition, the Admin can duplicate an existing v1 or v2 template to create a new v2 template, and then customize the result. Finally, v2 templates expose a larger number of properties that can be configured, and also expose some controls to take advantage of some other new features introduced in Windows Server 2003. One of these features, for example, is key archival. Version 2 templates can be used by Windows Server 2003 and Windows Server 2008 Enterprise or Datacenter Editions. On Windows Server 2008 R2, v2 templates can be used by a CA installed on Standard, Enterprise, Datacenter, Foundation and Server Core Editions.
Version 3 templates were introduced in Windows Server 2008. Version 3 templates have all the features of a version 2 template with two major additions. First, v3 templates support the use of Crypto Next Generation (CNG) providers, which means that the certificates support Suite B algorithms based on Elliptical Curve Cryptography (ECC). Second, v3 templates have a setting that instructs Windows to grant the Network Service account access to the private key created on the requesting computer. This is great for those certificates that will be used by applications or services that run as Network Service rather than Local System. Version 3 templates are supported by CAs installed on Windows Server 2008 Enterprise and Datacenter Editions. They are also supported by CAs installed on Windows Server 2008 R2 Standard, Enterprise, Datacenter, Foundation and Server Core Editions.
For a complete table of Windows Server SKU and the features supported by it, check out this blog post by the Windows PKI development team.
Deploying Certificate Templates
For the purpose of example, I am going to use a fictional company called Fabrikam. The diligent IT staff at Fabrikam have done their research, performed some testing, consulted the auguries, and they’ve determined what types of certificates they need to issue to meet the specified business needs. The next step is to look at what templates are available that they can use out of the box and which ones they need to modify to suit their purposes.
Here’s a quick overview of what Fabrikam determined:
CA Issuance: Domain Controller Authentication, Web Server, and User certificates
Key Archival: The private keys for User certificates should be archived
Doman Controller Authentication template: No additional requirements
Web Server template:
- A version 2 template must be created from the default Web Server template.
- The security group Fabrikam Web Servers should have Enroll permissions.
- The Subject name must contain the DNS name of the web server, and should be provided automatically.
User Certificate Template:
- A version 2 template must be created from the default User template
- Key Archival must be implemented for the template
Certificate Templates Setup
Fabrikam has decided that they need to deploy the following certificate templates: Domain Controller Authentication, Web Server, and User. In addition, the fact that Key Archival is to be enabled for the User template means that the CA should also be configured to issue certificates based on the Key Recovery Agent template (Actually, this is not a requirement if there is another Windows Enterprise CA in environment that is configured to issue Key Recovery Agent certificates, and is trusted to do so.)
Let’s assume that the PKI hierarchy has been set up and is functional. The next step is to configure the certificate templates. Let’s check the configuration of the templates before deploying them.
To manage the certificate templates, you use the Certificate Templates MMC snap-in. In the Certificate Services MMC snap-in, right-click on the Certificate Templates folder and select Manage from the context menu.
In the view pane of the Certificate Templates snap-in you’ll see all the certificate templates available in Active Directory. If you locate the Domain Controller Authentication template and double-click on it, you’ll see the properties available for that template. Our fictional IT staff has already reviewed the settings and determined that no changes need to be made, so we’ll just click Cancel, here.
Next, locate the Web Server template. The default Web Server template already meets the current requirements that arose from an analysis of business needs. However, to allow for future changes Fabrikam has decided that they need to duplicate this default template and create a v2 template.
To duplicate the existing Web Server template and create Version 2 template:
1. I right click on the Web Server template and select Duplicate Template from the context menu.
Fabrikam still has a lot of Windows Server 2003 servers and Windows XP workstations (But they are steadily upgrading. No, really! They are!! Trust me! Sigh.) This means that we can’t use the latest and greatest v3 templates available on our Windows Server 2008 CA. We’ll have to specify that we’re creating a template for Windows 2003 Server, Enterprise Edition which will create a v2 certificate template.
2. We’ll give a new name to the template: Fabrikam WebServer.
3. Clients within Fabrikam will connect to the web servers via the server’s DNS name. This means that the requesting server’s fully qualified DNS name must be in the Subject of the certificate it receives. To meet this requirement, click on the Subject Name tab and select Build from this Active Directory information. For the Subject Name Format, select DNS Name. Finally, deselect all of the check boxes under Include this information in the alternate Subject name.
Now that the new template is configured per the specified requirements, we need to set the security. The computer account for a particular web server will be the principal enrolling for the Fabrikam WebServer template, so we have to make sure that all the web server computer accounts have Enroll permission on the new template. Fabrikam, luckily, has a Security Group containing all of their web servers called, oddly enough, Fabrikam Web Servers. We can simply grant the necessary permissions to that group.
In the template properties, elect the Security tab, and click Add…
Enter the group name (Fabrikam Web Servers) and click the Check Names button.
After the name of the security group is resolved, click OK.
Grant the group Enroll permission.
The permissions in the security tab should like this when these changes are complete.
Once all the necessary changes have been made, click Ok to commit the new template and save it to Active Directory. The Fabrikam WebServer template is now ready to be added to the CA.
User Certificate Template
We’ll use essentially the same process to duplicate the default User template and modify the resulting v2 template to suit Fabrikam’s requirements.
Just as with the default WebServer, we’ll duplicate the existing User template to create the custom v2 template. We need to do this because the default User template is a v1 template, so its properties cannot be modified. One of our requirements is to enable Key Archival which requires configuring a setting in the template, so in order to do this a v2 template is required.
To create and configure our new User template:
Select the User template, right click on it, and select Duplicate Template from the context menu.
Select Windows 2003 Server, Enterprise Edition to create a v2 template.
Change the Template Display name to Fabrikam User.
Navigate to the Request Handling Tab, and select Archive subject’s encryption private key to enable key archival for this template.
Next, set permissions on the new template. Domain Users will already have Enroll permission, but since this certificate will be deployed via user Autoenrollment, Domain Users will also require Autoenroll permission. The permissions, when set properly, should look like this:
Once all the necessary changes have been made, click Ok to commit the new template and save it to Active Directory. The Fabrikam User template is now ready to be added to the CA.
Key Recovery Agent Certificate Template
Although this template was not mentioned as one of Fabrikam’s requirements, it is a requirement to issue at least one Key Recovery Agent certificate to support Key Archival. This step is only necessary if there is not another Windows Enterprise CA configured to issue certificates based on the Key Recovery Agent template.
For this example, however, let’s assume that there is not and go ahead and configure the Key Recovery Agent template. The only setting that requires modification is the permissions. We’ll assign enroll permissions to the Fabrikam KRA security group so that members of that group can enroll for a Key Recovery Agent certificate.
- Open up the Key Recovery Agent certificate template by double-clicking on it and selecting the Security tab. I click Add…
- Enter the name Fabrikam KRA and click the Check Names button.
- After the name of the security group is resolved, click OK.
- Check the Enroll permission.
Configuring the CA to issue certificates
To configure the CA to issue the desired certificate templates, I right-click on the Certificate Templates folder, select New, then select Certificate Templates to Issue from the context menu.
Then I select the certificate templates I wish to issue, by holding down the control key and selecting multiple templates, and then clicking OK.
This CA can now issue certificates based on the selected certificated templates.
Conclusion
That’s really all there is to it. While in this segment we only modified a few properties of our templates, in the vast majority of cases there should be no need for making extreme changes. The default templates should be sufficient for most implementations, and the changes we made were more to ease certificate deployment than actually create truly custom templates. Perhaps in a later blog post we’ll cover some of the more esoteric settings. However, this shouldn’t stop you from exploring on your own using the online help.
In Part IV of this series we’ll cover implementing Web Enrollment and Key Archival.
Comments
Anonymous
June 04, 2010
Can you reference the other 2 PKI articles before this one- I can't find them in search or in your user history when I click on your nameAnonymous
June 07, 2010
Designing and Implementing a PKI: Part I Design and Planning blogs.technet.com/.../designing-and-implementing-a-pki-part-i-design-and-planning.aspx Designing and Implementing a PKI: Part II blogs.technet.com/.../designing-and-implementing-a-pki-part-ii.aspxAnonymous
July 12, 2010
Hi Jon, your guide is the best i ever learn about PKI on the internet. When did you write the next part ? :D:D:DAnonymous
July 13, 2010
Thanks, JonathanB. I'll pass that on to my colleague, Chris. I'll try to put the last part of this series up this week.Anonymous
September 15, 2010
Great post. Anxiously looking forward to part IV. Any update on when we might see it?Anonymous
May 27, 2015
The comment has been removed