So here we are on our issuing CA server, and we need to open the
Certificate Templates management console, and the easiest way to
do that is to open the Certification Authority management console
and launch it from there.
If you click on the Windows Start button and just type in cert, you will
usually find the Certification Authority management console here.
So we're going to go ahead and open this, and then we're
going to expand our CA and right‑click on the Certificate
Templates folder and choose Manage.
So here we have our certificate templates. They're stored in Active Directory.
This may look very different in your environment.
This is a clean brand‑new and lab environment, so there's been no changes.
These are all the default templates.
So the first thing we want to do to create our VPN server
certificate is to right‑click the RAS and IAS Server
template and choose Duplicate.
Next, I'm going to uncheck Show resulting changes, and here I'm going to
go and select the Server 2016 for my Certification Authority and as well
for the Certificate recipient. Go to the General tab, and we'll give
this certificate template a name.
The validity period of one year is pretty much a standard industry best
practice, so we'll go ahead and leave it at that.
Do not check the Publish in Active Directory. That's not required to see the
certificate in AD, just an FYI. We'll go to the Cryptography tab, and I want to
select from the Provider Category drop‑down list.
I want to select Key Storage Provider.
I will also change the Request hash to SHA256, and then I'm going to
go to the Subject Name tab. Here, I need to choose the option to
supply in the request, and you're going to get a kind of scary warning
here, but this is basically telling you that this is a security risk,
and indeed it is, and we'll talk about some mitigations for that in
just a second.
So I'm going to click OK. And next, I'm going to choose
Use subject information from existing certificates for
autoenrollment renewal requests.
Since we have to supply the subject name and the request, the administrator
is going to have to manually request this the first time.
So if you're using a domain join server, we can use certificate
autoenrollment to renew this subsequently. That means we only have
to do this manual request once, and then perpetually it will just
renew itself every year.
If you're using a non‑domain joined server, of course,
you'll have to renew every year manually.
But if you're using domain joined servers, you can leverage certificate
autoenrollment to reduce this administrative burden.
Next, we're going to go to the Extensions tab, and here we're going to click
Edit and remove the Client Authentication application policy.
It is not required for the VPN server. Then we'll click Add,
and we need to add the IP Security IKE Intermediate
application policy, and then click OK.
And now we'll go to the Security tab.
And here we're going to remove the RAS and IAS Servers group, and we'll
add our VPN Servers group that we created previously.
We will also grant this VPN Servers group the Read,
Enroll, and Autoenroll permissions.
The autoenroll permission is only necessary if your
VPN servers are domain joined.
Obviously, if they're not domain joined, you can't take advantage of that.
Also, just an FYI, if you have just one or, you know,
a couple of VPN servers in your organization,
you can get away with assigning the computer object for the VPN
servers right here directly as opposed to doing a group.
I prefer to do groups because it makes it a little easier if you
want to scale out, but that's entirely up to you.
The next thing we'll do is we'll go to the Issuance Requirements
tab. As I said before and as you saw the warning message as well,
supplying the subject name in the request for a certificate is a
potential security risk.
And so the general recommendation is to enable the
option for certificate manager approval.
Now, this has two negative side effects.
They're both challenges from an administrative standpoint is that it means
the certificate will obviously not automatically be issued.
That means the administrator is going to have to do some additional work
to approve the request and also obtain the certificate once the request
has been approved. Since this certificate only includes the server
authentication EKU, not the client authentication EKU, it presents less
of a risk because an attacker wouldn't be able to gain access to this
template and supply, for example, the user principal name for a domain admin.
So I'm going to uncheck this,
but you may have requirements in your organization to
have used certificate manager approval.
So now click OK, and we'll move on to creating our NPS Server certificate template, next.