Applies to: Windows Server 2003, Windows Server 2003 R2, Windows Server 2008, Windows Server 2008 R2, Windows Server 2012 It is important to define and implement an Active Directory Certificate Services (AD CS) management model when you develop a certification authority (CA) infrastructure. This management model should complement your existing security management delegation plan and, if necessary, can help you meet Common Criteria requirements for role separation.
To ensure that a single individual cannot compromise public key infrastructure (PKI) services, it is best to distribute management roles across different individuals in your organization.
You can use role-based administration to organize certification authority (CA) administrators into separate, predefined CA roles, each with its own set of tasks. Roles are assigned by using each user's security settings. You assign a role to a user by assigning that user the specific security settings that are associated with the role. A user that has one type of permission, such as Manage CA permission, can perform specific CA tasks that a user with another type of permission, such as Issue and Manage Certificates permission, cannot perform. Note: Role-based administration is supported by both enterprise and stand-alone CAs starting with Windows Server 2003 Enterprise edition CAs. The following table describes the roles, users, and groups that can be used to implement role-based administration. To assign a role to a user or group, you must assign the role's corresponding security permissions, group memberships, or user rights to the user or group. These security permissions, group memberships, and user rights are used to distinguish which users have which roles.
CA administrator
Manage CA
Configure and maintain the CA. This is a CA role and includes the ability to assign all other CA roles and renew the CA certificate. These permissions are assigned by using the Certification Authority snap-in.
Certificate manager
Issue and Manage Certificates
Approve certificate enrollment and revocation requests. This is a CA role. This role is sometimes referred to as CA officer. These permissions are assigned by using the Certification Authority snap-in.
Backup operator
Back up file and directories
Restore file and directories
Perform system backup and recovery. Backup is an operating system feature.
Auditor
Manage auditing and security log
Configure, view, and maintain audit logs. Auditing is an operating system feature. Auditor is an operating system role.
Enrollees
Read
Enroll
Enrollees are clients who are authorized to request certificates from a CA. This is not a CA role.
All CA roles are assigned and modified by members of local Administrators, Enterprise Admins, or Domain Admins. On enterprise CAs, local administrators, enterprise administrators, and domain administrators are CA administrators by default. Only local administrators are CA administrators by default on a stand-alone CA. If a stand-alone CA is installed on a server that is joined to an Active Directory domain, domain administrators are also CA administrators.
The CA administrator and certificate manager roles can be assigned to Active Directory users or local users in the Security Accounts Manager (SAM) of the local computer, which is the local security account database. As a best practice, you should assign roles to group accounts instead of individual user accounts.
Only CA administrator, certificate manager, auditor, and backup operator are CA roles. The other users described in the table are relevant to role-based administration and should be understood before assigning CA roles.
Only CA administrators and certificate managers are assigned by using the Certification Authority snap-in. To change the permissions of a user or group, you must change the user's security permissions, group membership, or user rights. To set CA administrator and certificate manager security permissions for a CA
return to top
Each CA role has a specific list of CA administration tasks associated with it. The following table lists all the CA administration tasks along with the roles in which they are performed.
Install CAs
X
Configure policy and exit modules
Stop and start the Active Directory Certificate Services (AD CS) service
Configure extensions
Configure roles
Renew CA keys
Define key recovery agents
Configure certificate manager restrictions
Delete a single row in the CA database
Delete multiple rows in the CA database (bulk deletion)
The user must be both a CA administrator and a certificate manager. This activity cannot be performed when role separation is enforced.
Enable role separation
Issue and approve certificates
Deny certificates
Revoke certificates
Reactivate certificates that are placed on hold
Renew certificates
Enable, publish, or configure certificate revocation list (CRL) schedules
Recover archived keys
Only a certificate manager can retrieve the encrypted key data structure from the CA database. The private key of a valid key recovery agent is required to decrypt the key data structure and generate a PKCS #12 file.
Configure audit parameters
By default, the local administrator holds the system audit user right.
Audit logs
Back up the system
By default, the local administrator holds the system backup user right.
Restore the system
Read the CA database
By default, the local administrator holds the system audit and system backup user rights.
Read CA configuration information
The CA administrator for a CA assigns users to the separate roles of role-based administration by applying the security settings required by a role to the user's account. The CA administrator can assign a user to more than one role, but the CA is more secure when each user is assigned to only one role. When this delegation strategy is used, fewer CA tasks can be compromised if a user's account becomes compromised. return to top
The default installation setting for a stand-alone CA is to have members of the local Administrators group as CA administrators. The default installation setting for an enterprise CA is to have members of the local Administrators, Enterprise Admins, and Domain Admins groups as CA administrators. To limit the power of any of these accounts, they should be removed from the CA administrator and certificate manager roles when all CA roles are assigned.
As a best practice, group accounts that have been assigned CA administrator or certificate manager roles should not be members of the local Administrators security group. Also, CA roles should only be assigned to group accounts and not individual user accounts. Note: Membership in the local Administrators group on the CA is required to renew a CA certificate. Members of this group can assume administrative authority over all other CA roles. return to top
A certificate manager can approve certificate enrollment and revocation requests, issue certificates, and manage certificates. This role can be configured by assigning a user or group the Issue and Manage Certificatespermission.
When you assign this permission to a user or group, you can further refine their ability to manage certificates by group and by certificate template. For example, you might want to implement a restriction that they can only approve requests or revoke smart card logon certificates for users in a certain office or organizational unit that is the basis for a security group.
This restriction is based on a subset of the certificate templates enabled for the certification authority (CA) and the user groups that have Enroll permissions for that certificate template from that CA.
You must be a CA administrator or a member of Enterprise Admins, or equivalent, to complete this procedure. To configure certificate manager restrictions for a CA
Click Properties, and then click the Security tab.
Verify that the user or group that you have selected has Issue and Manage Certificates permission. If they do not yet have this permission, select the Allow check box, and then click Apply.
Click the Certificate Managers tab.
Click Restrict certificate managers, and verify that the name of the group or user is displayed.
Under Certificate Templates, click Add, select the template for the certificates that you want this user or group to manage, and then click OK. Repeat this step until you have selected all certificate templates that you want to allow this certificate manager to manage.
Under Permissions, click Add, type the name of the client for whom you want the certificate manager to manage the defined certificate types, and then click OK.
If you want to block the certificate manager from managing certificates for a specific user, computer, or group, under Permissions, select this user, computer, or group, and click Deny.
When you are finished configuring certificate manager restrictions, click OK or Apply.
An enrollment agent is a user who can enroll for a certificate on behalf on another client. Unlike a certificate manager, an enrollment agent can only process the enrollment request and cannot approve pending requests or revoke issued certificates.
Windows Server 2008 includes three certificate templates that enable different types of enrollment agents:
When you create an enrollment agent, you can further refine the agent's ability to enroll for certificates on behalf of others by group and by certificate template. For example, you might want to implement a restriction that the enrollment agent can only enroll for smart card logon certificates for users in a certain office or organizational unit that is the basis for a security group.
This restriction is based on a subset of the certificate templates enabled for the certification authority (CA) and the user groups that have Enroll permissions for that certificate template from that CA. Important: You can only apply enrollment agent restrictions starting with Windows Server 2008–based CAs. Enrollment agent policy must also be configured properly.
You must be a CA administrator or a member of Enterprise Admins, or equivalent, to complete this procedure. return to top
Open the Certification Authority snap-in, right-click the name of the CA, and then click Properties.
Click the Enrollment Agents tab, click Restrict enrollment agents, and click OK on the message that appears.
Under Enrollment agents, click Add, type the names of the users or groups that you want to configure, and then click OK. Click Everyone, and then click Remove.
Under Certificate Templates, click Add, select the template for the certificates that you want this user or group to be able to enroll from, and then click OK. Repeat this step until you have selected all certificate templates that you want to enable for this enrollment agent. When you have finished adding the names of certificate templates, click <All>, and then click Remove.
Under Permissions, click Add, type the names of the users or groups for whom you want the enrollment agent to manage the defined certificate types, and then click OK. Click Everyone, and then click Remove.
If you want to block the enrollment agent from managing certificates for a user, computer, or group, under Permissions, select this user, computer, or group, and then click Deny.
When you are finished configuring enrollment agent restrictions, click OK or Apply.
The following procedure configures a certification authority (CA) to send e-mail when a certification event occurs.
Membership in Domain Admins or local Administrators, or equivalent, is the minimum required to complete this procedure. return to top
At an elevated command prompt, type:
certutil -setreg exit\smtp\<smtpserverServerName>
certutil -setreg exit\smtp\<eventfilter +Event>
The following tables explain the command values and options available for this procedure.
certutil
The name of the command-line tool.
-setreg
Modifies the registry.
exit\smtp\smtpserver
The registry value that contains the name of the Simple Mail Transfer Protocol (SMTP) server.
exit\smtp\eventfilter
The registry value that contains the list of events that the CA should monitor. When any of these events occur, the CA will send e-mail.
+
Indicates that, if there are current entries stored in this registry value, this entry should be appended to them.
Event
Specifies the event to add to the list of events for the CA to monitor. An event can be any value in the following table.
ExitEvent_CertIssued
Specifies the action of issuing a certificate.
ExitEvent_CertPending
Specifies the action of a certificate request being received by the CA and set to pending.
ExitEvent_CertDenied
Specifies the action of a certificate request being received by the CA and that request being denied.
ExitEvent_CertRevoked
Specifies the action of a revocation of an existing certificate.
ExitEvent_CRLIssued
Specifies the action of a certificate revocation list (CRL) being issued.
ExitEvent_Startup
Specifies the action of the CA during startup.
ExitEvent_Shutdown
Specifies the action of the CA during shutdown.
certutil -setreg exit\smtp\CRLIssued\To<E-mailString> certutil -setreg exit\smtp\Startup\To<E-mailString> certutil -setreg exit\smtp\Shutdown\To<E-mailString> E-mailString specifies an e-mail address or a string of e-mail addresses that are separated by semicolons.
certutil -setreg exit\smtp\CRLIssued\To<E-mailString> certutil -setreg exit\smtp\Startup\To<E-mailString> certutil -setreg exit\smtp\Shutdown\To<E-mailString>
E-mailString specifies an e-mail address or a string of e-mail addresses that are separated by semicolons.
certutil -setreg exit\smtp\SMTPAuthenticate 1 certutil -setsmtpinfo<UserName>
Kurt L Hudson edited Original. Comment: Updated for RC
Kurt L Hudson edited Revision 3. Comment: revised links to include return to top and updated OS versions