In this demonstration, we're going to install and configure IIS.
We're going to position the CRL and AIA files in CA2.
We do this so we can use them with the subordinate server.
We're going to use the GPO, I'll show you how to do this,
and what we're doing is we're making CA1 a Trusted Root
Certificate Authority simply by adding a GPO,
and then any machine that we have is going to trust our root CA.
We are in CA2, our subordinate server.
We need to install a web service in order to reply to
requests that come in through the web.
So I'm going to come in here and go into Server Manager,
type in serv, and there it is right there,
Server Manager.
Close this, and we simply Add roles and features, click on Next, Role‑based.
This is our server, CA2.carvedrock.com.
Click on Next.
Come down here to Web Server.
Check Web Server, and we're going to add the features here.
Click on Next, and then click on Next, click on Next again,
and there's a few things that we have to add in here,
or this is basically not going to work.
We have to have Windows Authentication and Basic
Authentication installed as well.
Otherwise, our defaults are just fine.
I'm going to click on Next, and we're ready to install this.
As this is installing, we can kind of do double time here.
We can go to our DC1 and add that certificate to the Trusted Root
Authorities for every single device inside of our domain,
and we do that through Group Policy.
So let's go ahead and switch over to DC1.
And for this we'll go to Server Manager,
same way we did before, type in server, go to Server Manager,
and what we're going to do here is come up to Tools,
go to Group Policy Management,
we'll go ahead and highlight that. And here's our
entire Forest, we have our Domains, and there's carvedrock right there.
Here are our, let me put this aside so you can see it a little bit better,
and probably focus this down a little bit more,
let me minimize that as well.
We don't want to just put it in a Default Domain Policy.
What we want to do is have its own policy inside of here.
We're going to create a GPO in this domain and link it here.
We're going to call this CarvedRockRootCA, and click on OK.
We'll go to edit this by right‑clicking and saying Edit.
I'll bring this down, and it's under Policies,
under Windows Settings, Security Settings,
and right here, Public Key Policies.
Under Public Key Policies, Trusted Root Certification Authorities.
We're going to double‑click on this, and then right‑click and say Import.
Click on Next, and the File name.
Remember, we brought this file over, so it is on our C drive.
So I'm going to expand that, go to the C drive, and there it is right there.
I'm going to click on Open, I'm going to click on Next, and it asks us, well,
where do you want to put this?
We want it at the top, Trusted Root Certification Authorities, and
then click on Next, and then click on Finish.
Now, whenever a device runs this Group Policy,
it's going to appear on their Trusted Root Certification Authorities.
Let's go see that in action with CA2. While we were gone, everything completed.
We'll go ahead and say Close for our web server, and then we're going to start
the MMC. We're going to add the snap‑in for the MMC console, and just add the
snap‑in for Certificates. Click Add, click Finish,
click OK.
We'll come up here to Certificates,
expand it, and go to Trusted Root Certificate
Authorities, and here are the Certificates.
These are automatically put in there when you install your Windows.
These are the major certification authorities out on the
internet. You might recognize some of these, Thawte,
Symantec, and places like that.
Notice what is not here, and that is our CarvedRockCA.
We need to have that certificate on all the computers to
trust that Root Certificate Authority.
We've set it up with Group Policy Object, so we
simply need to refresh that policy.
Come down here,
go to a command prompt, cmd, and then type in gpupdate, and force this. Wait
just a little bit, it's going to run through the policy.
It's going to see that, oh, I need a policy for this root authority
so they trust it. And we're all done there, it looks like. We're
going to go ahead and test that out.
I'm going to right‑click, and I'm going to say Refresh, and there
it is, right there, that's all you need to do. Add a GPO, and
then that root certificate is trusted by all the machines that
are on your Active Directory.
So there's just one more thing to do.
I'm going to minimize this, and we're going to go to File Explorer. Under
File Explorer in the C drive, remember, we put these two files, and there's
three files now, that plus means it's a delta.
And we're going to cut these three files, go up to inetpub, double‑click it, go
to wwwroot, and we're going to start a new folder in here.
That folder,
if we remember right, was called pki. This is where we directed our
AIA and our CRL within the settings to point to this very virtual
folder on the IIS for this machine.
So there we go, double‑click it, come in here, and paste, and
there they are. We're going to minimize this, and we're going to
go to yet another thing. We're going to go up to Tools here, and
Internet Information Services.
Let's expand that, and here is our CA2. Here are our sites, Default Web
Site right there. Expand it, and there's our pki. We can go to the pki,
right‑click, Explore, and there they are.
So there is one thing left to do. I'm going to go to Default Web
Site, and right here where it says Request Filtering,
double‑click it and go to Edit Feature Settings. Allow double escaping
right here, because we have a plus on the delta CRL. So we're going to
click on OK, we're going to close this, close it up here a little bit. We are now ready to install our subordinate enterprise CA.