Securing Communications with Certificate Services

Installing Windows Server 2003 Certificate Services allows a Windows 2003 server to issue certificates to Web servers, computers, other hardware devices, and users. You can issue certificates to firewalls that can be used instead of the Pre-Shared Key Authentication to establish a VPN. Certificates are more secure than pre-shared keys because certificates are more difficult to compromise than a pre-shared key. If the firewall supports a Certificate Revocation List (CRL), you can immediately revoke certificates on devices if your certificate infrastructure is compromised. You can also use certificates to implement an Extensible Authentication Protocol-Transport Layer Security (EAP-TLS) wireless security infrastructure to really harden your wireless network. Windows 2003 supports delta CRLs, so when a certificate is revoked, only the changes are replicated rather than the entire CRL, which can reduce WAN traffic on a large enterprise Certificate Authority (CA) implementation.

The first decision you need to make when installing Certificates Services is whether to install Certificate Services as an enterprise root CA or standalone root CA. An enterprise root CA integrates with Active Directory (AD), and a standalone CA doesn't. Best practices dictate that you take the root CA offline, and use an issuing CA to issue certificates. The root CA holds sensitive information about your entire CA infrastructure. If the root CA is compromised, your entire CA infrastructure will be at risk. If you plan to take the root CA offline, consider using Microsoft Virtual Server, Virtual PC, or VMware virtual machine (VM) software to create the root CA. Then you can burn the virtual server image to CD-ROM or tape to archive it. I recommend that you don't keep the virtual server image available online in case the host machine gets compromised. After you install the root CA, you should configure an enterprise subordinate/issuing CA to actually issue the certificates. If you plan to take the root CA offline, make sure to install the root CA as a standalone root CA. If you don't and take an enterprise root CA offline, EAP-TLS authentication with an Internet Authentication Server (IAS) will fail.

If you’re already running AD, you'll probably use an enterprise subordinate CA to issue certificates. An enterprise CA lets you use AD to centrally manage certificates, greatly reducing the amount of administrative overhead. If you want to autoenroll both user and computer certificates, you must use the Enterprise or Datacenter version of Windows 2003. Windows 2003 Standard Edition supports only autoenrollment of computer certificates. Because the standalone root CA will be taken offline, you can use Windows 2003 Standard Edition for the root CA server and the Windows 2003 Enterprise Edition for the issuing CA server. If you want to run certificate enrollment with the Certificate Enrollment Web Site, you must install Microsoft Internet Information Services (IIS) before you install Certificate Services on the issuing CA server.

To install Certificate Services, open Control Panel, Add/Remove Programs, Add/Remove Windows Components and select Certificate Services. Make sure you're happy with the server and domain name before installing Certificate Services because you can't change them after you install Certificate Services. You must first install the standalone root CA. Make a note of the common name (CN) you give the standalone root CA. After installing the standalone root CA, you can install Certificate Services on the enterprise subordinate CA on a different server. This enterprise subordinate CA will be used to issue certificates. Installing Certificate Services on the enterprise subordinate CA is similar to installing a standalone root CA, except you have to specify the standalone root CA name during the installation process. During the installation of the enterprise subordinate CA, a certificate is issued from the standalone root CA, granting it the authority to issue certificates on behalf of the root CA. After the enterprise subordinate CA is installed, verify that you can issue certificates from the enterprise subordinate CA then take the standalone root CA offline. In next month's article, I’ll discuss how to issue certificates to a Cisco PIX and Sonicwall firewall that you can use instead of pre-shared keys to set up a VPN connection.

Problems with Windows Antispyware Pattern
Are you running Symantec AntiVirus (SAV) Corporate versions 7, 8, 9, and 10 or Symantec Client Security 1, 2, or 3 and the Microsoft Windows Antispyware program? If so, the Windows Antispyware pattern 5805 released at 11:30 on February 9, 2006, incorrectly identifies SAV as the password-stealing program PWS.Bancos.A and will prompt the user to remove SAV from the registry. Deletion of these keys will cause SAV/ Symantec Client Security to stop working properly. A new pattern was released February 10, 2006, to address the SAV/Symantec Client Security false positive. If you have these programs installed, make sure to upgrade to the latest Windows Antispyware pattern immediately.