We're going to cover the Active Directory Certificate Services
structure and the hierarchy that you can build,
starting with the definition.
The Active Directory Certificate Services provides a platform for issuing
and managing public key infrastructure certificates.
The certificates can be used for authentication of a computer,
a user, traffic or an application, and this is from Microsoft.com.
There are certain components to an Active Directory Certificate Services.
First, we start off with the main one, the certificate authority.
This is the issuing certificate authority that
provides the major function for AD CS.
And we have CA Web Enrollment where people can go just to a web
page in order to enroll and get their certificate.
We have something called an Online Responder.
The Online Responder takes some of the resource load off of the
server that is handling the certificate authority.
The algorithm for encryption is not the most complicated thing in the world.
The complication and the load comes from running it.
Encryption has gotten very, very complicated,
and it takes a lot of processing power, a lot of memory,
in order to encrypt and decrypt any type of communications.
Then we have the Network Device Enrollment Services.
This allows you to take a router, to take a switch,
to take any kind of device, put it in your network,
and then it is automatically enrolled with a certificate,
making sure that the communications between that device and
other devices is encrypted and is safe.
And also,
ensures that that message didn't get disrupted and that that
message came from that network device.
Next,
we have Certificate Enrollment Web Services that allow
policies for the Web Enrollment.
And then finally, and this would be a policy server,
a Certificate Enrollment Policy Web Service.
The policy that you set up can save you a lot of time because,
remember,
an enterprise CA can automatically enroll users and any entity that you want
according to criteria that you have specified in your policy.
Let's take a look at the standalone versus enterprise CA.
These are the two major types of CA.
The standalone CA.
It does not use, does not need, does not want Active Directory.
It can exist offline.
In fact, we'll take our standalone certificate authority offline.
It can only issue certificates with manual or web enrollment and all
certificate requests have to be manually improved.
There's no auto enrollment with a standalone server.
Then we have an enterprise certification authority.
It does require Active Directory.
It is intertwined with the Active Directory.
It cannot exist offline.
It has to be up and running.
It can issue certificates with various enrollment procedures,
not just web enrollment or manual enrollment.
And the certificate request can be auto approved
according to what criteria you set.
And this is the policy that you have for auto enrollment.
Here are some hierarchies to give you an example of what
you might want to do in your network.
In this case we have a root CA.
That root CAs only job in the world is to certify the issuing CAs,
and then traditionally you take the root offline and only bring it online to
renew that certificate or if you need another issuing CA. This gives it
tremendous integrity because if you think about it,
if the root of your hierarchy is compromised,
everything is compromised.
Now, the issuing CAs are just what they sound like, they issue
certificates to whoever wants those certificates.
Now, this can get a little complicated. In this scenario, the
middle part is we have policy CAs that just delve out the
policies that you created for your certification hierarchy. At
the top we have root CAs, however, we have two of them.
One of them on the right is below actually the root CA on the left.
It's just issued a certificate and then acts as the root. And of course at the
bottom you have the workers here, and that's the issuing CAs.
And let's take a look at this. Perfectly appropriate for smaller networks.
You have one server, and that one server operates as the
root, the policy, and the issuing CA.
Of course,
I don't have to mention that you've got to make sure that this server is secure.
You don't want this server compromised.
And finally, here's our CA hierarchy.
We have CarvedRockRootCA at the top.
This is a standalone server.
It pretty much is installed, configured,
it certifies the enterprise subordinate CA, and then we're done with it.
We can take it offline. And the name of that enterprise
subordinate is CarvedRockIssueCA.
So that's a look at the AD CS, how it works, the difference between
standalone and enterprise, and a little bit about the hierarchy. Next, we're going to find out, well, what can we do with AD CS