So let's move on to enrolling for certificates.
Now, unlike the NPS server where we use certificate auto enrollment,
we have to manually request a couple of different
certificates for the VPN server.
So, the first thing I want to do is open the Local Computer Certificates store,
and here again there's two certificates that we need to enroll for.
One is an internal private certificate for IPsec,
and that's for IKEv2,
and the second one is a public TLS certificate used for SSTP.
So let's focus on the first one first.
Let's go to the Personal store, and you'll see there are no certificates.
Again, that's by design.
But I'm going to right‑click here, choose All Tasks,
Request New Certificate, and we're going to make a
certificate request to our PKI and get our IPsec
certificate for IKEv2. So we'll click Next,
select Active Directory Enrollment Policy, and choose Next. And here
we'll select our VPN Server certificate template, and you'll see that
there's a little warning information here or information link here that
says, More information is required.
If you'll recall, this was because we required the
subject name to be supplied in the request.
Again, that's required because the VPN clients are going to
connect to the VPN server using a name on the public
internet, not its server hostname.
So we'll click More information here. And the first thing I want to do
is in the Subject name section I want to select Common name, and I'm
going to enter my public hostname here.
Now, this is going to be entered a couple of more times, so my suggestion is
just to copy this and put it on your clipboard and then click Add. And
again, this name is the public name of the server,
not the server's actual name, so your clients are going
to address this server, or this group of servers
eventually, by this particular name.
So in the Alternative name field,
I'm going to select DNS, and I'm going to paste that value
because it's essentially the same name, so we'll click Add.
We'll go to the General tab, and here for the Friendly name I
usually just paste the same thing.
I give it the same FQDN.
And really, this is all that's required.
The rest of the information here is going to be handled by the certificate
template in AD, so we'll go ahead and click OK and click Enroll. And once
that's done, you can click Finish, and now you should see a certificate in
the Local Computer Certificates store.
It's using the template, VPN Server.
If you double‑click on this, now you'll see we have
a private key. And by the way,
this certificate is valid for one year because that's what
we defined on our certificate template.
If you're using domain‑joined servers and you're using certificate
auto‑enrollment, if you recall, we set the policy on the template in Active
Directory to say re‑enroll using the same subject name.
So although we had to go through this process manually here on this
server, next year this certificate will renew automatically,
so I won't have to come back and touch it.
If this is a non‑domain‑joined server,
it becomes a little more complex because obviously we
can't use auto‑enrollment there,
so you will have to monitor these certificates for expiration and manually repeat this process each time.