In this demonstration, we're going to create the CAPolicy.inf file.
This is just a plaintext file, and you change the default settings for
this if you want. And this file is divided into sections,
keys, and values.
Let's go into our server. We are in CA1. This is not a member server,
so we're logged in as a local administrator.
What I'm going to do is come down here to File Explorer, and this
is going to be located in a specific location.
I'm going to go to my PC, C, Windows, and then System32. Scroll to the
bottom here, and we can see CAPolicy.inf does not exist.
Let's get down there.
It would be right in here.
So, let's create a new one.
I'm going to say New, Text Document, and we're going to call this CAPolicy.inf.
Let's go ahead and double‑click on that to open it.
I'm going to paste something in here, and that is
located inside of the course documents.
It's called capolicy.inf.txt. Let's go through this.
The first one is the only required part of this, and that's
the version. The version equals $ NT$.
It has been that way for a very long time.
Next we have this. This is the InternalPolicy.
This would probably be dictated by your legal department.
There's two ways to do this. One, you can go in there and have a URL
and just point to the URL. That will appear in all the certificates
in case somebody has to look that up.
Secondly,
you can just post it right here between these quote marks actually
stating what your policy is in this text document. Here,
we have the CRLDistributionPoint.
This is not going to produce CRLs because it is a standalone root server.
We also have the AIA, or Authority Information Access, and same here,
we're not going to put anything in because this is a root server. Then we
get to the good part, certsrv_server. The key length,
the RenewalKeyLength, I'm going to actually make a change here to 4096
because a few things have changed since this default document.
One is we're using 4096 now. The renewal validity, in here it's five
years. I'm going to actually change this to 10 years.
Here is the circumstance for this.
The longer you have this, the less maintenance it's going to require; however,
the less secure it is. You shouldn't have an unknown point in the future when
these certificates need to be renewed because you don't want certificates
kind of slipping through the cracks as it were.
So we change that to 10.
The CRLPeriod, in here I have 2 years, meaning that that
revocation list is good for 2 years.
The Deltas, in this case it's going to be 26 weeks,
which is approximately 6 months. Down here we have
LoadDefaultTemplates, and this is equal to 0, meaning don't do it,
don't load the default templates because we don't need them.
This is a root server. Down here, that's going to be for reverse
compatibility, AlternateSignatureAlgorithm.
I'm going to assume that my network is pretty modern, so I'm going to
leave that. If you had some older machines and servers,
you might change that appropriately.
And down here, this is a basic constraint.
I have PathLength=1, meaning that the only path from this root
server to subordinate server is one hop.
So we can't take a server,
make it a subordinate server to one of our subordinate
servers with this setup, it ends at 1.
If you were going to cascade or have a hierarchy with more than one,
then you'd want to change that appropriately to 2 or 3
or limit it to however many you have.
So we just come down here, I'm going to say File,
Save, close this, close our File Explorer, and we have set
the CAPolicy.inf file for our root server. We're ready now to install it.