In this demonstration, we're going to examine the details of a certificate.
I want you to know what's inside of a certificate,
know the properties of a certificate,
and we'll conclude by actually looking at a key that is
contained within the certificate.
Let's start with this.
This is from Wikipedia.
It defines a digital certificate.
A digital certificate certifies the ownership of a public key
by the named subject of the certificate.
This allows you to rely on the private key that
corresponds to a certified public key.
So you're looking at a certificate saying this is the owner; they own
the public key and that opens all the doors for the encryption that
needs both the private key and the public key.
Now what is inside of a certificate?
Well, you have the key pair, the owner's name,
who owns a certificate, that could be a device or a user,
the owner contact information should you have to contact that person,
and then what are you going to use this certificate for.
You don't want to have a certificate that can do a whole bunch of things
if you're only going to use it for one or two things.
And then we have the validity period, when does this certificate expire.
And then finally, where is the certificate revocation list and the AIA.
Let's go in to CA2 and take a look inside of a certificate.
This is CA2, and what we're going to do, we're going to set up a console.
What we do with this console is have all the different parts inside of there
that we're going to use throughout the rest of this course so we don't keep
having to come in here to get to this tool.
So I'll come up here to say File, and we're going to say Save As.
I'm going to save it on the desktop so we can see it and simply call it cr,
for Carved Rock, console.
Click on Save.
Now, of course, we'll add a snap‑in.
And the first snap‑in that we're going to add is the Certification Authority,
click on Add, this is for a Local computer,
click on Finish, and then OK.
Let's expand this.
I'm going to go to carvedrockCA, expand it,
and then hit the Issued Certificates, and we only have one certificate on here.
This was given when we made an enterprise CA to the domain controller.
So this certificate takes care of domain controllers.
I'm going to double‑click it to get to the properties.
And we can come down here, we can see that it was issued to DC1.Carvedrock.com.
And it was issued by carvedrockIssueCA, in other words, CA2.
We have when this certificate was issued and also when it expires.
I'm going to go to details now, which gives us a lot more information.
We have the version number, there's version 1 through version 4,
we cover that shortly, and a serial number,
which identifies this certificate internally inside
of the Certification Authority.
And then we have the algorithms for the signature,
the algorithm for the signature hash and the issuer.
The issuer is carvedrockIssueCA, and above that, we have carvedrock.com.
So this being an enterprise CA is interwoven with the Active Directory,
the Valid from and Valid to, the Subject,
which is the name of the computer that this certificate is issued to.
We have the Public key and there is a look at the public key.
That's all it is is a bunch of hexadecimal numbers that make up the key.
For the purpose of understanding, we look at it as a key,
but really it's just a string of hexadecimal numbers.
Public key parameters, this can help identify what type of key we're using.
Certificate Template Name,
the templates inside of the CA allow you to have a starting ground or a
template to do certain things with your certification authority,
and in this case, it's the domain controller.
Enhanced Key Usage,
this is where you get the purpose of an individual certificate.
We can see that this one is to authenticate clients and to authenticate servers.
So it is there pretty much to take care of the computers and
devices that are on this Active Directory.
SMIME compatibility and quite a few other things that are down here to
identify this particular certificate on the network.
And then we have the CRL Distribution Points.
Every certificate should have on it where the
distribution points are to find out if a key,
or rather a certificate, has been revoked,
and the Authority, and then the Subject Alternate Name.
If you've ever dealt with web servers and SSL,
you know that that SAN has to match pretty much the home page for your website.
And then finally, Key Usage is for digital signatures,
and encipherment, we have a Thumbprint,
and then some error information right here.
Last thing to show you Certification Path.
We can see the root.
We can see the subordinate CA,
and then we can see the actual certificate that goes to the server.
So that is a look at the anatomy of certificates with
certification authority in Windows Server 2022. Up next, we'll examine certificate templates.