Enterprise PKI

The Enterprise PKI snap-in makes it possible to monitor and manage one or more public key infrastructures (PKIs) and certification authorities (CAs) in an organization.

  • Enterprise PKI Overview

  • Using Enterprise PKI

  • Troubleshooting an Enterprise PKI


Enterprise PKI Overview

The Enterprise PKI snap-in provides a view of the status of all certification authorities (CAs) in one or more public key infrastructures (PKIs) in your network. Having a view of multiple CAs and their current status enables administrators to manage CA hierarchies and troubleshoot possible CA errors more easily and effectively.

  • Enterprise PKI Concepts

  • Enterprise PKI Status Codes


Enterprise PKI Concepts

The Enterprise PKI snap-in is used to ensure that all of the following elements in a public key infrastructure (PKI) are functioning properly, available, and valid:

  • Certification authorities (CAs). A CA accepts a certificate request, verifies the requester's information according to the policy of the CA, and then uses its private key to sign the certificate. The CA then issues the certificate to the subject of the certificate for use as a security credential within a PKI. A CA is also responsible for revoking certificates and publishing a certificate revocation list (CRL).

  • CA certificates. A CA certificate is a certificate issued by a CA to itself or to a second CA for the purpose of creating a defined relationship between the two CAs. A certificate that is issued by a CA to itself is referred to as a trusted root certificate. CA certificates are critical to defining the certificate path and usage restrictions for all end-entity certificates issued for use in the PKI.

  • Authority information access locations. Authority information access locations are URLs that are added to a certificate in its authority information access extension. These URLs can be used by an application or service to retrieve the issuing CA certificate. These CA certificates are then used to validate the certificate signature and to build a path to a trusted certificate.

  • CRLs. CRLs are complete, digitally signed lists of unexpired certificates that have been revoked. This CRL is retrieved by clients who can then cache the CRL (based on the configured lifetime of the CRL) and use it to verify certificates presented for use.

  • CRL distribution points. CRL distribution points are locations, typically URLs, that are added to a certificate in its CRL distribution point extension. CRL distribution points can be used by an application or service to retrieve a CRL. CRL distribution points are contacted when an application or service must determine whether a certificate has been revoked before its validity period has expired.

The Certification Authority snap-in allows an administrator to monitor and manage these PKI elements for a single CA. However, separate instances of the snap-in need to be used to monitor and manage a PKI if more than one CA is involved. In addition, the Certification Authority snap-in cannot be used to integrate non-Microsoft CAs into the infrastructure and cannot be used to conveniently manage the authority information access locations and CRL distribution point stores. The Enterprise PKI snap-in, therefore, can be used to resolve these issues from a single snap-in.

For more information about how CAs, CA certificates, authority information access locations, CRL distribution points, and CRLs work together to create a public key trust hierarchy, see How Certificate Services Works (http://go.microsoft.com/fwlink/?LinkID=88045).

Additional references

  • Enterprise PKI Overview

  • Active Directory Certificate Services (http://go.microsoft.com/fwlink/?LinkID=48545)


Enterprise PKI Status Codes

The Enterprise PKI snap-in provides a view of the status of the certification authorities (CAs) and Online Responders in one or more public key infrastructures (PKIs). In addition, the Enterprise PKI snap-in can be used to verify the validity and accessibility of authority information access locations and certificate revocation list (CRL) distribution points.

For each CA selected, the Enterprise PKI snap-in indicates one of the CA health states listed in the following table.

Indicator | CA state
Question mark | CA health state evaluation
Green indicator | CA has no problems
Yellow indicator | CA has one or more non-critical problems
Red indicator | CA has one or more critical problems
Red cross over CA icon | CA is offline

If your environment includes one or more Online Responders, the Enterprise PKI snap-in can be used to monitor the status of these components. The indicators and health states in the following table apply to Online Responders.

Indicator | Online Responder state
Question mark | Online Responder health state evaluation
Green indicator | Online Responder has no problems
Yellow indicator | Online Responder has one or more non-critical problems
Red indicator | Online Responder has one or more critical problems
Red cross over CA icon | Online Responder is offline

The following status codes apply to CRL distribution points, delta CRL distribution points, and authority information access locations.

Indicator | CRL distribution point or authority information access state
Question mark | Location health state evaluation
Green indicator | Data is available and has no problems
Yellow indicator | Data is available and has one or more non-critical problems
Red indicator | Data is available but has one or more critical problems
Red cross over CA icon | Data is not available

For problems relating to the Online Responder, use the Online Responder snap-in to further diagnose and resolve the problem. For problems relating to CAs, CRL distribution points, and authority information access locations, use the Certification Authority snap-in to further diagnose and resolve the problem. In addition, check the Event log on the computers hosting the Active Directory Certificate Services (AD CS) role services for additional troubleshooting information that can help you identify and resolve any problems. For more information about troubleshooting CA, Online Responder, certificate validation, and revocation checking problems, see Active Directory Certificate Services (http://go.microsoft.com/fwlink/?LinkId=89215).

Additional references

  • Enterprise PKI Overview


Using Enterprise PKI

The Enterprise PKI snap-in is primarily a monitoring tool, and many of the issues identified when you use Enterprise PKI can be resolved by using the Certificate Templates, Certification Authority, or Online Responder snap-ins. However, one set of tasks, involving Active Directory Certificate Services (AD CS) containers, can be completed directly from the Enterprise PKI snap-in.

  • Install the Enterprise PKI Console

  • Configure the Enterprise PKI Snap-In

  • Manage Certification Authorities with Enterprise PKI

  • Managing Active Directory Containers with Enterprise PKI


Install the Enterprise PKI Console

The Enterprise PKI snap-in does not appear in the list of default Microsoft Management Console (MMC) snap-ins. The Enterprise PKI snap-in becomes available in the Add/Remove snap-ins list only after you have installed one or more Active Directory Certificate Services (AD CS) role services on the computer or you have installed the AD CS Remote Server Administration Tools from Server Manager.

You must be an administrator on the server to complete this procedure.

To install the AD CS Remote Server Administration Tools

  1. In Server Manager, click Add Features to start the Add Features Wizard.

  2. In the Select Features window, click the plus sign that appears to the left of the Remote Server Administration Tools check box, and then click the plus sign to the left of the Role Administration Tools check box.

  3. Select the Active Directory Certificate Services check box, click Next, and then click Install.

  4. When installation is complete, click Close.

If the computer you want to perform remote administration tasks from is running Windows Vista, you can obtain the Remote Server Administration Tools Pack from the Microsoft Download Center (http://go.microsoft.com/fwlink/?LinkId=89361).

After you have installed the AD CS Remote Server Administration Tools or installed one or more AD CS role services, you can proceed with the following procedure to install the Enterprise PKI snap-in.

You must be a local administrator to complete this procedure.

To install the Enterprise PKI snap-in

  1. Click Start, click Run, type mmc, and then press ENTER.

  2. On the File menu, click Add/Remove Snap-in.

  3. Add the Enterprise PKI snap-in to the list on the right.

  4. Click OK.

Additional references

  • Using Enterprise PKI


Configure the Enterprise PKI Snap-In

The left pane, or console tree, of the Enterprise PKI snap-in includes a tree view of the public key infrastructures (PKIs) and enterprise certification authorities (CAs) in an organization.

If you select a specific PKI in the console tree, the details pane displays the status of the entire PKI: OK, if everything is properly configured and functioning correctly, or Error, if there are problems that require attention.

If you select a specific CA in the console tree, additional information that can be used to identify the source of an Error condition is displayed, including whether the following are available, expiring, or unavailable:

  • CA certificate

  • Authority information access locations

  • Certificate revocation list (CRL) distribution points

  • Delta CRL distribution points

By right-clicking the name of the PKI in the console tree, you can configure when you want to display alerts for the following components of the CAs in that hierarchy.

Component | Description
Set certificate status to Expiring when expiring in | Number of days before a CA certificate expires that a warning will appear
Set CRL status to Expiring when expiring in | Number of hours or days before a CRL expires that a warning will appear
Set Delta CRL status to Expiring when expiring in | Number of hours or days before a delta CRL expires that a warning will appear

Membership in the local Administrators group, or equivalent, is the minimum required to complete this procedure.

To modify warning options for a PKI

  1. Open the Enterprise PKI snap-in.

  2. In the console tree, right-click Enterprise PKI.

  3. Click Options.

  4. Review and modify the days or hours listed for the CA certificate, CRLs, and delta CRLs.

  5. Click OK.

  6. On the Action menu, click Refresh.

Additional references

  • Using Enterprise PKI


Manage Certification Authorities with Enterprise PKI

Certification authorities (CAs) are listed by name and by their location within a public key infrastructure (PKI), with root CAs located at the top of the hierarchy and subordinate CAs below. CAs can be listed either in the console tree or details pane, depending on whether the PKI or a CA is selected in the console tree. When a CA is double-clicked in the details pane, it will be expanded and selected in the console tree.

CA status information will be listed as OK, Warning, Error, or Unable to download. These status messages indicate whether there is a problem with some aspect of the CA, either the CA certificate, the CRL distribution point locations, or the authority information access locations, or that status information was not obtained. For specific error status messages and their meaning, see Enterprise PKI Status Codes.

If a problem or warning only applies to a subordinate CA, then the error indicator will only appear on the icon for that CA.

When you right-click a CA or click the Action menu, two unique options appear:

  • Manage CA, which opens the Certification Authority snap-in. If the user has the appropriate permissions, the Certification Authority snap-in can then be used to perform various management tasks for the CA.

  • Refresh, which initiates an update to all of the status information available for that CA.

For more information about customizing when different warning codes appear, see Configure the Enterprise PKI Snap-In.

Additional references

  • Using Enterprise PKI


Managing Active Directory Containers with Enterprise PKI

Enterprise certification authorities (CAs) publish certificates, certificate revocation lists (CRLs), and other data to Active Directory containers. The Enterprise PKI snap-in can be used to browse and manage objects in those containers.

The Active Directory containers that can be managed with the Enterprise PKI snap-in are:

  • NTAuthCertificates. Contains all of the CA certificates in the current forest. Certificates are added automatically when a new CA is installed by a member of the Enterprise Admins group. Certificates can also be added manually by using the Manage AD Containers dialog box.

  • AIA. Contains CA certificates that can be retrieved by clients using the authority information access (AIA) certificate extension to build a valid certificate chain and to retrieve any cross-certificates issued by the CA.

  • CDP. Contains all base CRLs and delta CRLs published in the forest.

  • KRA. Contains the certificates for key recovery agents for the forest. Key recovery agents must be configured to support key archival and recovery. Key recovery agent certificates can be added to this container automatically by enrolling with an enterprise CA. The key recovery agent certificates cannot be added manually by using the Manage AD Containers dialog box.

  • Certification Authorities. Contains the certificates for trusted root CAs in the forest. Root CA certificates are added automatically when a member of Enterprise Admins sets up an enterprise root CA or stand-alone root CA that is joined to the domain. Root CA certificates can also be added manually from the command prompt but not through the Manage AD Containers dialog box.

  • Enrollment Services. Contains the certificates for enterprise CAs that are available to issue certificates to users, computers, or services in the forest. Enterprise CA certificates can only be added to this container by a member of Enterprise Admins who installs an enterprise CA. The certificates cannot be added manually by using the Manage AD Containers dialog box.

Additional references

  • Using Enterprise PKI

  • Add Published Certificates to Active Directory Containers

  • Delete Unused Objects from Active Directory Containers


Add Published Certificates to Active Directory Containers

All certification authority (CA) certificates in the Active Directory domain of the current forest are stored in the NTAuthCertificates container. Enterprise CA certificates are added automatically when a new CA is installed.

If a CA certificate is not added automatically when the new CA is created, such as a stand-alone CA created by a user who is not a member of the Enterprise Admins group, the CA certificate can still be added manually to the NTAuthCertificates container. This process can also be used to add the CA certificate of a non-Microsoft CA that has been used to issue smart card logon or domain controller certificates. By publishing these CA certificates to the Enterprise NTAuth store, the administrator indicates that the CA is trusted to issue certificates of these types.

Membership in Enterprise Admins, or equivalent, is the minimum required to complete this procedure.

To add a certificate to the NTAuthCertificates container by using the Windows interface

  1. Export the certificate of the CA to a .cer file that supports either the Distinguished Encoding Rules (DER)-encoded binary format or the base-64 encoded X.509 format.

  2. Open the Enterprise PKI snap-in, right-click Enterprise PKI in the console tree, and click Manage AD Containers.

  3. Click the NTAuthCertificates container.

  4. Click Add, and browse to the .cer file for the certificate that you want to add. Click OK.

You can also add a certificate to the NTAuthCertificates container by using the Certutil command-line tool.

To add a certificate to the NTAuthCertificates container by using a command line

  1. Export the certificate of the CA to a .cer file that supports either the DER-encoded binary format or the base-64 encoded X.509 format.

  2. Open a command prompt window, type the following command, and press ENTER:

    certutil -dspublish -f filename NTAuthCA

Additional references

  • Delete Unused Objects from Active Directory Containers


Delete Unused Objects from Active Directory Containers

There may be times when you need to uninstall a certification authority (CA). However, clients will not be able to send requests to this CA and some applications that depend on your public key infrastructure (PKI) may not function properly after a CA that is needed to verify the validity and revocation status of a certificate has been uninstalled.

If you are permanently decommissioning the CA before its expected expiration date, then the CA certificate should be revoked from its parent CA for a certificate revocation reason of "Cease of operation." If the CA is a self-signed root CA, then all certificates that have not expired should be revoked and a certificate revocation list (CRL) should be generated with the same reason. This will indicate that the certificates are no longer valid because the CA has been decommissioned.

When uninstalling an enterprise CA, it is important that it be uninstalled properly to ensure that its CA enrollment object is removed from Active Directory Domain Services (AD DS). Failure to do so may result in AD DS clients continuing to attempt to enroll against that CA. If an enterprise CA cannot be uninstalled normally, the Enterprise PKI snap-in can be used to manually remove the CA objects from AD DS.

Note

You should back up the entire server before uninstalling the CA.

Membership in Enterprise Admins, or equivalent, is the minimum required to complete this procedure.

To remove unused certificate-related objects from Active Directory containers

  1. Open the Enterprise PKI snap-in.

  2. In the console tree, right-click Enterprise PKI, and then click Manage AD Containers.

  3. Select one of the containers, and select one or more objects within that container.

  4. Click View to examine the contents of each object if you are uncertain whether any of the selected objects pertain to the CA that you are uninstalling.

  5. Click Remove.

  6. Select a different container, and repeat steps 3 through 5 until you have removed all objects that you no longer need.

Additional references

  • Add Published Certificates to Active Directory Containers


Troubleshooting an Enterprise PKI

Enterprise PKI is primarily a monitoring tool. As a monitoring tool, it may often be the first place that an administrator notices a problem or potential problem with the public key infrastructure (PKI). Therefore, it is important to understand how to find additional diagnostic and troubleshooting information in order to fix the problem promptly before it potentially becomes more serious.

If a warning or serious error is indicated on a server hosting a certification authority (CA) or Online Responder, you should examine the events logged in the Event Viewer on that computer for additional information that can help you diagnose and correct the problem.

For CA-related issues, such as problems connecting to a current certificate revocation list (CRL), use the Certification Authority snap-in to correct the problem.

For Online Responder–related issues, you can use the Online Responder snap-in to perform tasks such as correcting revocation configuration problems.

If Enterprise PKI indicates that one or more CA certificates are about to expire, use the Certificates snap-in to reissue or renew these certificates.

You can enable CryptoAPI 2.0 diagnostics to obtain more information about many PKI-related issues.

You must be a local administrator to complete this procedure.

To enable advanced CryptoAPI 2.0 diagnostics

  1. Click Start, point to All Programs, point to Administrative Tools, and then click Event Viewer.

  2. Expand the Applications and Services Log, Microsoft, and Windows folders.

  3. Open the CAPI2 folder, right-click Operational, and click Enable Log.

  4. If there is data present in the log before you reproduce a problem, right-click Operational, and click Clear Log. This allows only the data relevant to the problem scenario to be collected from the saved log.

  5. Open the Services snap-in console, right-click Active Directory Certificate Services, and click Restart.

  6. After you have collected event data, save the log file by right-clicking Operational, clicking Save Events as, and typing a name for the event file. You can save the log file in the .evtx format (which can be opened through the Event Viewer) or in .xml format.
Note

The default maximum size for the event log is 1 MB. For CryptoAPI 2.0 diagnostics, the log can increase in size quickly and it is recommended to increase the maximum log size to at least 4 MB to capture relevant events. To increase the maximum log size, right-click Operational, and then click Properties. In the log properties, increase the maximum log size.

For more information about CryptoAPI 2.0 diagnostics, see Troubleshooting PKI Problems on Windows Vista (http://go.microsoft.com/fwlink/?LinkId=89570).

For more information about troubleshooting and resolving problems with CAs, CRLs, certificate access, and Online Responders, see Active Directory Certificate Services (http://go.microsoft.com/fwlink/?LinkId=89215).