MCSA 70-412 Chapter 06

Editor's Notes

• #2: Presentation: 150 minutes Lab: 120 minutes After completing this module, the students will be able to: Describe public key infrastructure (PKI). Explain how to deploy certification authorities (CAs). Explain how to deploy and configure a CA hierarchy. Explain how to deploy and manage certificates. Implement certificate distribution and revocation. Describe how to manage certificate recovery. Required materials To teach this module, you need the Microsoft® Office PowerPoint® file 20412C_06.pptx. Important: We recommend that you use PowerPoint 2007 or a newer version to display the slides for this course. If you use PowerPoint Viewer or an older version of PowerPoint, all the features of the slides might not display correctly. Preparation tasks To prepare for this module: Read all of the materials for this module. Practice performing the demonstrations. Practice performing the labs. Work through the Module Review and Takeaways section, and determine how you will use this section to reinforce student learning and promote knowledge transfer to on-the-job performance.
• #3: Introduce the module, and determine the students’ level of experience with PKI. Is it widely used by the students? Are they already familiar with the basic administration of Active Directory® Certificate Services (AD CS)? It is common to find students who are responsible for their PKI, but not completely comfortable with its administration or components. One point worth mentioning about AD CS in a smaller environment is that it rarely requires maintenance.
• #4: This lesson describes the practical application of certificates. Most of the students will know about Secure Sockets Layer (SSL), digital signature, and encryption, but they might not be familiar with how these technologies work. Try to focus on explaining how these technologies work in detail. Also, describe how certificates and key pairs enable these technologies.
• #5: Define SSL. After that, ask the students to describe how SSL works. Discuss the process of the SSL handshake, step by step. Do not forget to mention the potential trust issues for a server certificate. Describe how to configure an SSL certificate on Internet Information Services (IIS) and when to use subject alternative names. This topic contains a large amount of the content in the workbook, so make sure that you cover it all during teaching.
• #6: Define the purpose of a digital signature. Make sure that you emphasize that a digital signature protects content consistency but does not protect content from unauthorized access. Explain how content is signed digitally and how a digital signature is verified. Use the process described in the workbook for detailed steps. At the end, explain how to configure and issue a certificate for digital signature.
• #7: Preparation Steps For this demonstration, you will need the 20412C-LON-DC1 and 20412C-LON-CL1 virtual machines. Sign in as Adatum\Administrator with the password Pa$$w0rd. After you have finished this demo, leave the virtual machines running for the next demo. Demonstration Steps On LON-CL1, open Windows® PowerShell. At the Windows PowerShell command prompt, type mmc.exe, and then press Enter. Click the File menu, and then select Add/Remove Snap-in. Select Certificates, click Add, select My user account, click Finish, and then click OK. Expand Certificates-Current User, right-click Personal, select All Tasks, and then click Request New Certificate. In the Certificate Enrollment Wizard, click Next twice. On the Certificate Enrollment page, in the list of available templates, select User, click Enroll, and then click Finish. Close the Console 1 window without saving changes. Open Microsoft Word 2013. In a blank document, type some text, and then save the file to the desktop. On the toolbar, click INSERT, and then in the Text pane, in the Signature Line drop-down list box, click Microsoft Office Signature Line. In the Signature setup window, type your name in the Suggested signer text box, type Administrator in the Suggested signer’s title text box, type [email protected] in the Suggested signer’s email address text box, and then click OK. Right-click the signature line in the document, and then click Sign…
• #8: In the Sign window, click Change. On the Certificate list, select the certificate with today’s date, and then click OK. In the text box right to the sign X, type your name, click Sign, and then click OK. Note: Explain to the students that besides typing your name, you also can select an image instead. This image can be your scanned, handwritten signature. Ensure that the document cannot be edited anymore. Close Word 2013, and save the changes when prompted. Stay signed in for the next demonstration.
• #9: Describe encryption and compare it to digital signatures. Be sure to emphasize the differences between the two. Define Encrypting File System (EFS), and use the diagram on the slide to describe how it works with one user, and with multiple users and Data Recovery Agent. Also, describe how email encryption works and what its limitations are.
• #10: Describe some scenarios for using certificates for authentication of users and devices.
• #11: Briefly describe the lesson content. Because this content has not changed much since Windows Server® 2008, if your students have previous PKI experience, you can expedite the teaching of this lesson except for the topic about the new AD CS features in Windows Server 2012.
• #12: Explain the basics of PKI. It is important that the students understand what PKI is. Some students may find it easier to initially grasp what PKI is if you give them the synonym—certificate services. This term may be more familiar to the students. You should tell the students that PKI is not equal to certificate services, but in Windows Server, you can implement PKI solutions by implementing and configuring certificate services. After that, you can continue to talk about the benefits of PKI.
• #13: Briefly describe each component of the PKI solution. Do not spend too much time on this topic, because most of these components will be discussed later in more detail. The purpose of this topic is to provide the students with a high-level overview of components that make up a PKI solution.
• #14: Explain what a CA is, and how it operates. CAs are the key components of the PKI environment. In a simple PKI environment, a single CA may provide all of the PKI services.
• #15: Introduce AD CS, and explain the purpose of each role service. Spend some time describing the role services that are new to Windows Server 2008 R2 and Windows Server 2012.
• #16: In this topic, discuss the new features of AD CS in Windows Server 2012. If you did not spend much time on the previous topics in this lesson, devote more time to this topic. The students will most likely be very interested in Virtual Smart Cards, so be sure to explain clearly how this concept works and how it differs from traditional smart cards.
• #17: Start by explaining that a CA solution can be implemented as an internal private CA, or an organization can use an external public CA. Many organizations use both: an external public CA for their public-facing services, and an internal private CA for their internal corporate requirements. You can also discuss a newer approach that some organizations use, the hybrid approach. In this scenario, the root is an externally trusted root CA, and internal CAs that issue certificates are subordinates. With the hybrid approach, companies can issue certificates that are trusted by virtually all computers. This module goes into more detail about this method in the following topics. Therefore, keep the discussion at a high level at this point, because subsequent topics provide more detail. Remind the students that a public CA is trusted by virtually all modern computers and applications, while an internal private CA is usually not trusted outside of the company that runs it. Mention that some organizations might choose to define their own list of trusted CAs. Ask the students which type of CA they are using in their environments today, and what its limitations.
• #18: Explain the following benefits of a cross-certification hierarchy: It provides an approach for one CA hierarchy to trust another CA hierarchy. It provides interoperability PKI between networks or other organizations (mergers, acquisitions, partnerships). It assumes complete trust of a foreign CA hierarchy. It can be configured at the root CA level or at the subordinate-to-the-root CA level. Question Your company is currently acquiring another company. Both companies run their own PKI. What could you do to minimize disruption and continue to provide PKI services seamlessly? Answer You could implement a cross-certification hierarchy.
• #19: Briefly describe the lesson content. Ask the students if they have previous experience with CA deployment. Point out to the students that things have not changed much in this area since Windows Server 2008 R2.
• #20: Highlight the various usage scenarios for CAs. This should help the students understand the typical usage scenarios that are found in an enterprise environment. Compare these scenarios with a typical usage scenario in a small environment (single-server PKI). Make sure that the students understand that a single CA does not represent a CA hierarchy, although it is still a fully functional PKI.
• #21: Discuss the following: Stand-alone and enterprise CAs, and the differences between the two. CAs that issue certificates to clients over the Internet. A root CA is typically configured as a stand-alone CA. Mention that business requirements often dictate the type (or types) of CAs that the students will use. For example, autoenrollment requires an enterprise CA.
• #22: Describe the key points related to considerations for installing a root CA. When you discuss the private key configuration, mention that any provider that starts with a number sign (#) in its name is a Cryptography Next Generation (CNG) provider. CNG, which was first introduced in Windows Vista®, has been enhanced in Windows Server 2008 and Windows Server 2012. The CNG application programming interface (API) is the long-term replacement for the Cryptography Application Programming Interface (CryptoAPI) in older versions of the Windows operating system.
• #23: Preparation Steps This demonstration is mandatory to perform, because it establishes the PKI and CA that are used in the following demonstrations in this module. For this demonstration, start 20412C-LON-DC1 and 20412C-LON-SVR1. Sign in to both virtual machines as Adatum\Administrator with the password Pa$$w0rd. Demonstration Steps Deploy a root CA On LON-SVR1, in the Server Manager, click Add roles and features. On the Before You Begin page, click Next. On the Select installation type page, click Next. On the Select destination server page, click Next. On the Select server roles page, select Active Directory Certificate Services. In the Add Roles and Features Wizard, click Add Features, and then click Next. On the Select features page, click Next. On the Active Directory Certificate Services page, click Next. On the Select role services page, ensure that Certification Authority is selected, and then click Next. On the Confirm installation selections page, click Install. On the Installation progress page, after the installation completes successfully, click the text Configure Active Directory Certificate Services on the destination server. In the AD CS Configuration Wizard, on the Credentials page, click Next. On the Role Services page, select Certification Authority, and then click Next.
• #24: Discuss scenarios for deploying a subordinate CA. Ask the students if they have PKI deployed in their environments, and whether they use only root CAs, or if they have also deployed subordinate CAs as well.
• #25: Describe the CAPolicy.inf file, and explain its structure and uses. Also, point the students to the syntax examples in the workbook.
• #26: Define and discuss role-based administration for the CA hierarchy. Discuss each role and its rights and permissions. Explain the relationship between role-based administration and security permissions that are defined on the CA level.
• #27: Define policy and exit modules on the CA. Most of the students probably will not be familiar with these settings, as they are used rarely. Use FIM CM to provide real-life examples of custom policy and exit modules. Spend some time explaining how to configure default exit modules to perform certain tasks.
• #28: Preparation Steps For this demonstration, you will need the 20412C-LON-DC1 and 20412C-LON-SVR1 virtual machines. Sign in as Adatum\Administrator with the password Pa$$w0rd. Demonstration Steps On LON-SVR1, open the Server Manager, click Tools, and then click Certification Authority. In the certsrv console, right-click AdatumRootCA, and then select Properties. On the General tab, click View Certificate. When the Certificate window opens, review the data on the General, Details, and Certification Path tabs, and then click OK. On the Policy Module tab, click Properties. Review the settings available for the Default policy module, and then click OK. On the Exit Module tab, click Properties. Show the Publication Settings available in the default Exit module, and then click OK. On the Extensions tab, review the options available for the CDP and AIA locations. On the Security tab, review the available options on the access control list (ACL), and also review the default permissions. On the Certificate Managers tab, review the options and explain how to restrict security principals to specific certificate templates, and then click Cancel. Close the certsrv console
• #29: Discuss the procedure for CA backup and restore. Emphasize that this is done as a part of an entire backup strategy or when moving a CA to another computer. First, make sure that you define scenarios for this and discuss each step. Use the workbook for detailed steps. This slide provides only high-level steps for this procedure.
• #30: Exercise 1: Deploying a Stand-Alone Root CA A. Datum wants to start using certificates for various purposes. You need to install the appropriate CA infrastructure. Because they are using Windows Server 2012 AD DS, you decided to implement the AD CS role. When you were reviewing available designs, you decided to implement a stand-alone root CA. This CA will be taken offline after it issues a certificate for subordinate CA. Exercise 2: Deploying an Enterprise Subordinate CA After you deploy the stand-alone root CA, the next step is to deploy an enterprise subordinate CA. A. Datum wants to use an enterprise subordinate CA to utilize AD DS integration. In addition, because the root CA is stand-alone, you want to publish its certificate to all clients.
• #32: Question Why is it not recommended to install just an enterprise root CA? Answer For security reasons, root CAs should be offline, without any network access. A root enterprise CA cannot be offline, so there is no maximum protection for its key.
• #33: Briefly describe the lesson content. Emphasize that certificate templates are important, because they provide the ability to customize certificate settings.
• #34: You should start by defining a certificate. Ask the students to provide their definition of a certificate. After that, start to introduce templates. A set of default templates is included during the installation of AD CS. Explain that the students can duplicate and modify these default templates to meet business requirements. Specific template versions and features are covered in later topics. Also, emphasize that in Windows Server 2008 R2, the Standard edition operating system also works with certificate templates.
• #35: Discuss certificate template versions, and the functional differences between them.
• #36: Discuss security options for certificate templates. Explain that the DACL for a certificate template has the same purpose as with other Active Directory objects. Also, emphasize the difference between the Enroll and Autoenroll permissions.
• #37: Discuss settings that you can modify on a certificate template. If time permits, you can quickly show these options in a CA Manager console. Also, discuss single purpose and multiple purpose certificates.
• #38: As a best practice, mention that the students should duplicate templates before they modify them. This preserves the original template for future duplications or as a reference. You can replace a template with a new one by using the option to supersede an existing template. This option is available in each template.
• #39: Preparation Steps For this demonstration, start 20412C-LON-DC1 and 20412C-LON-SVR1. Sign in to both virtual machines as Adatum\Administrator with the password Pa$$w0rd. Be sure to complete all previous demonstrations before you begin this demonstration. Demonstration Steps Modify and enable a certificate template On LON-SVR1, on the taskbar, click the Server Manager icon. In the Server Manager, click Tools, and then click Certification Authority. In the Certification Authority console, expand AdatumRootCA, right-click Certificate Templates, and then click Manage. Review the list of default templates. Examine the templates and their properties. In the Details pane, double-click IPsec. In the IPsec Properties dialog box, scroll through the tabs, and note what you can modify on each tab. Note that on the Security tab, you can define permissions for enrollment. Click Cancel to close the template. In the Certificate Templates console, in the Details pane, right-click the Exchange User certificate template, and then click Duplicate Template. In the Properties of New Template dialog box, review options on the Compatibility tab. Click the General tab, and then in the Template display name text box, type Exchange User Test1. Click the Superseded Templates tab, and then click Add. Click the Exchange User template, and then click OK. Click the Security tab, and then click Authenticated Users.
• #40: Under the Permissions for Authenticated Users node, select the Allow check boxes for Read, Enroll, and Autoenroll, and then click OK. Close the Certificate Templates console. In the Certification Authority console, right-click Certificate Templates, point to New, and then click Certificate Template to Issue. In the Enable Certificate Templates dialog box, select the Exchange User Test1 certificate, and then click OK.
• #41: Present the lesson content. Be aware that this is an extensive lesson with several technologies to cover, so you should plan to spend some more time on this lesson.
• #42: Discuss and describe each enrollment method. Be sure to provide a valid scenario for each enrollment method, and to explain their differences.
• #43: Discuss the following: Autoenrollment enables organizations to deploy public key–based certificates to users and computers automatically. Domain members using the Windows XP operating system, Windows Server 2003, or newer versions can use certificate autoenrollment. The Certificate Services administrator can allow Enroll and Autoenroll permissions, and configure templates for users who receive certificates. Domain-based Group Policy activates and manages autoenrollment. Both computer-based and user-based Group Policy can activate autoenrollment. By default, Group Policy is applied at the restart for computers, or at logon for users, and is refreshed periodically. The Group Policy setting is named Certificate Services Client - AutoEnrollment. An internal timer triggers autoenrollment every eight hours after previous autoenrollment activation. For each request that requires user interaction as per the certificate template, a pop-up window displays approximately 60 seconds after logon. If no user interaction occurs on the certificate template, no window displays. You may want to expand upon certificate usage with Group Policy, as covered in the workbook—that is, enhancements in Windows Server 2008, the benefits of deploying via Group Policy, and other features. You also may want to briefly discuss autoenrollment from the perspectives of CA options or certificate templates. Finally, be sure to discuss Credential Roaming.
• #44: Define what the Enrollment Agent certificate is and what can be done with it. Describe how the Enrollment Agent worked in older versions of Windows Server. Describe the drawbacks of that approach. After that, define the Restricted Enrollment Agent and describe how it works.
• #45: Preparation Steps For this demonstration, start 20412C-LON-DC1, 20412C-LON-SVR1, and 20412C-LON-CL1. Sign in to 20412C-LON-DC1 and 20412C-LON-SVR1 as Adatum\Administrator with the password Pa$$w0rd. Do not sign in to 20412C-LON-CL1 until directed to do so. Be sure to complete all previous demonstrations before you start this demonstration. Demonstration Steps Configure the Restricted Enrollment Agent On LON-SVR1, on the taskbar, click the Server Manager icon. In the Server Manager console, click Tools, and then open the Certification Authority. In the certsrv console, expand AdatumRootCA, right-click Certificate Templates, and then click Manage. In the Certificate Templates console, double-click Enrollment Agent, click the Security tab, and then click Add. In the Select Users, Computers, Service Accounts, or Groups window, type Allie, click Check Names, and then click OK. On the Security tab, click Allie Bellew, select Allow for Read and Enroll permissions, and then click OK. Close the Certificate Templates console. In the certsrv console, right-click Certificate Templates, point to New, and then click Certificate Template to Issue. In the list of templates, click Enrollment Agent, and then click OK.
• #46: Switch to LON-CL1, and sign in as Adatum\Allie with the password Pa$$w0rd. On the Start screen, type mmc.exe, and then press Enter. In Console1, open the File menu, and then click Add/Remove Snap-in. Click Certificates, click Add, and then click OK. Expand Certificates – Current User, and then click Personal. Right-click Personal, point to All Tasks, and then click Request New Certificate. In the Certificate Enrollment Wizard, on the Before You Begin page, click Next. On the Select Certificate Enrollment Policy page, click Next. On the Request Certificates page, select Enrollment Agent, click Enroll, and then click Finish. Switch to LON-SVR1. In the Certification Authority console, right-click AdatumRootCA, and then click Properties. In the AdatumRootCA Properties dialog box, click the Enrollment Agents tab. On the Enrollment Agents tab, click Restrict Enrollment agents. In the pop-up window, click OK. On the Enrollment Agents tab, under Enrollment Agents, click Add. In the Select User, Computer, or Group window, type Allie, click Check Names, and then click OK. Click Everyone, and then click Remove. In the certificate templates section, click Add. In the list of templates, select User, and then click OK. In the Certificate Templates section, click <All>, and then click Remove. In the permission section, click Add.
• #47: In the Select User, Computer, or Group window, type Marketing, click Check Names, and then click OK. In the Permission section, click Everyone, click Remove, and then click OK.
• #48: Discuss the primary functionality of Network Device Enrollment Service (NDES). Explain that NDES performs the following functions: Generates and provides one-time enrollment passwords to administrators. Receives and processes Simple Certificate Enrollment Protocol (SCEP) enrollment requests on behalf of software running on network devices. Retrieves pending requests from the CA. Explain what is needed to deploy NDES.
• #49: Discuss the following steps regarding certificate revocation with the students: A certificate is revoked from the CA Microsoft Management Console (MMC) snap-in. During revocation, a reason code and a date and time are specified. The certificate revocation list (CRL) is published through the CA MMC snap-in (or the scheduled revocation list is published automatically based on the configured value). When Windows client computers are presented with a certificate, they use a process to verify revocation status by querying the issuing CA. That check determines whether the certificate is revoked, and presents that information to the application requesting the verification.
• #50: Be sure to explain what AIA and CDP are, and the purpose of these certificate extensions. After that, discuss publication points and usage scenarios. Explain to students that after you install a root CA, you need to configure two X.509 version 3 extension fields, known as the AIA and the CDP extensions. These extensions apply to all certificates that the root CA issues. These extensions define where client applications can find valid AIA and CDP information for the root CA. Inform the students that the formatting and publishing of AIA and CDP extension URLs are generally the same for root CAs and subordinate CAs. The difference between offline CAs and online CAs is that offline CAs require manual certificate and CRL publishing to a directory or Web server.
• #51: Describe how an Online Responder uses Online Certificate Status Protocol (OCSP) to provide a more efficient method for clients to determine the revocation status of a certificate. OCSP uses HTTP for submitting certificate status requests. Remind the students that using standard CRLs may be inefficient because of the size of the CRL, and that clients must check the entire CRL. An Online Responder does this checking process for the client, and responds only with the requested certificate. Mention that the Online Responder can support a number of CAs, including a CA other that Microsoft.
• #52: Preparation Steps For this demonstration, start 20412C-LON-DC1 and 20412C-LON-SVR1. Sign in to both virtual machines as Adatum\Administrator with the password Pa$$w0rd. Be sure to complete all previous demonstrations before you start this demonstration. Demonstration Steps Configure an Online Responder On LON-SVR1, on the taskbar, click the Server Manager icon. In the Server Manager, click Add roles and features. Click Next three times. On the Select server roles page, expand Active Directory Certificate Services (Installed), and then select Online Responder. Click Add Features. Click Next two times, and then click Install. When the message displays that installation is successful, click Configure Active Directory Certificate Services on the destination server. In the AD CS Configuration Wizard, click Next. Select Online Responder, and then click Next. Click Configure, and then click Close two times. In the Server Manager console, click Tools, and then click the Certification Authority console on LON-SVR1. In the Certification Authority console, right-click AdatumRootCA, and then click Properties. In the AdatumRootCA Properties dialog box, on the Extensions tab, in the Select extension list, click Authority Information Access (AIA), and then click Add.
• #53: In the Add Location dialog box, type http://LON-SVR1/ocsp, and then click OK. Select the Include in the AIA extension of issued certificates check box. Select the Include in the online certificate status protocol (OCSP) extension check box, and then click OK. In the Certificate Authority box, restart Active Directory Certificate Services by clicking Yes. In the certsrv console, expand AdatumRootCA, right-click the Certificate Templates folder, and then click Manage. In the Certificate Templates console, double-click the OCSP Response Signing template. In the OCSP Response Signing Properties dialog box, click the Security tab. Under Permissions for Authenticated Users, select the Allow for Enroll check box, and then click OK. Close the Certificate Templates console. In the Certification Authority console, right-click the Certificate Templates folder, point to New, and then click Certificate Template to Issue. In the Enable Certificate Templates dialog box, select the OCSP Response Signing template, and then click OK. On LON-SVR1, in Server Manager, click Tools, and then click Online Responder Management. In the Online Responder Management console, right-click Revocation Configuration, and then click Add Revocation Configuration. In the Add Revocation Configuration Wizard, click Next. On the Name the Revocation Configuration page, in the Name text box, type AdatumCA Online Responder, and then click Next. On the Select CA Certificate Location page, click Next. On the Choose CA Certificate page, click Browse, click the AdatumRootCA certificate, click OK, and then click Next.
• #54: Provide a brief overview of the lesson content.
• #55: Explain the scenarios in which the private key can become lost. Also, explain why the private key is important, and describe the consequences of losing a private key. After that, explain how you can protect, archive, and recover your private key. Do not go into too much detail, because this subject will be discussed in greater detail in following topics. Note: The practice of user profile deletion for the purpose of troubleshooting user issues is not recommended, and can cause other issues in the work environment.
• #56: Use this topic to describe the process to configure automatic key archival. Discuss the types of templates that should have key archival enabled, for example, an EFS certificate. Explain that if a certificate is already configured without key archival, you can configure a superseded template to replace the previous certificate. Mention that users are not protected by key archival until they have enrolled for a certificate that has key recovery enabled.
• #57: Preparation Steps For this demonstration, start 20412C-LON-DC1 and 20412C-LON-SVR1. Sign in to both virtual machines as Adatum\Administrator with the password Pa$$w0rd. Be sure to complete all previous demonstrations before you start this demonstration. Demonstration Steps Configure automatic key archival On LON-SVR1, open the Certification Authority console. In the Certificate Authority console, expand the adatumRootCA node, right-click the Certificate Templates folder, and then click Manage. In the Details pane, right-click the Key Recovery Agent certificate, and then click Properties. In the Key Recovery Agent Properties dialog box, on the Issuance Requirements tab, clear the CA certificate manager approval check box. Note: This is for test purposes only. In a production environment, you should not change this value. On the Security tab, notice that Domain Admins and Enterprise Admins are the only groups that have the Enroll permission, and then click OK. Make no changes here. Close the Certificates Templates console. In the Certificate Authority console, right-click Certificate Templates, click New, click Certificate Template to issue, click Key Recovery Agent, and then click OK. This process configures a CA to issue certificates based on the Key Recovery Agent template. Click the Start screen, type mmc.exe, and then press Enter. In the Console 1 window, click File, and then click Add/remove Snap-In. On the Add/Remove Snap-ins page, select Certificates, and then click Add. Select My user account, click Finish, and then click OK.
• #58: With the help of the diagram on the slide, explain to the students the procedure to restore a lost key. Explain how you can transfer a file to the recovery agent, how key recovery is performed, and how the key is restored on the client’s computer.
• #59: Preparation Steps For this demonstration, start 20412C-LON-DC1 and 20412C-LON-SVR1. Sign in to both virtual machines as Adatum\Administrator with the password Pa$$w0rd. Be sure to complete all previous demonstrations before you start this demonstration. If you do not have enough time, you can skip this demonstration, because the students will be doing this in a lab. Demonstration Steps Recover a lost private key On LON-SVR1, click to the Start screen, type mmc.exe and then press Enter. Click File, and then click Add/Remove Snap-in. Select Certificates, and then click Add. Click My user account, and then click Finish and then click OK. Expand Certificates - Current User, expand Personal, and then right-click Certificates. Then select All tasks, and click Request New Certificate. Click Next twice. Enroll for the Exchange User Test1 certificate by using the wizard. When you select the Exchange User Test1 template in the wizard, click to open settings to enter Subject name. In the Type list, click Email, and in the value field, type [email protected], click Add, click OK, and then click Enroll. Click Finish. Verify that the certificate displays in the Personal->Certificates store. Simulate a lost private key by deleting the [email protected] certificate from the Personal certificate store. Right-click [email protected], click Delete, and then click Yes. Minimize the Certificates (Console1) console. In the Certification Authority console, in the Issued Certificates folder, double-click the certificate with Exchange User Test1 as the template name. This is the certificate that you issued in an earlier step. From the Details tab, record the serial number. (You can copy and paste it to Notepad, and then remove spaces between numbers.)
• #60: Open a command-prompt window with elevated privileges. (On the Start menu, type cmd, right-click Command Prompt, and then click Run as Administrator.) In the command-prompt window, switch to the root of drive C by typing cd.., and then press Enter. (You might have to do this twice.) Select the certificate serial number from Notepad, right-click it, and then select Copy. Switch back to the command-prompt window, and type the following command, where <serialnumber> is a number that you paste from Notepad: Certutil -getkey <serialnumber> outputblob Press Enter. Note: If a question mark appears at the beginning of the number after you paste it in, delete it. Also ensure that you remove all spaces from the serial number, or enclose the serial number in quotation marks. After the command completes successfully, open drive C and verify that the Outputblob file displays. Switch back to the command-prompt window. At a command prompt, type the following, and then press Enter: Certutil -recoverkey outputblob recover.pfx When prompted, type Pa$$w0rd as the new password, and then confirm the password. Browse to drive C, and then verify that the Recover.pfx file—the recovered key—is created. Right click the file recover.pfx, and then click Install PFX. (Note: If Install PFX option is not available, select Open with and then click Crypto Shell Extensions)
• #61: This lab can take more than an hour to complete. Be prepared to help the students, and to discuss tasks that they are performing. It is crucial that all the students have completed Lab A, to prepare the PKI environment for this lab. Exercise 1: Configuring Certificate Templates After deploying the CA infrastructure, the next step is to deploy the certificate templates that are required in the organization. First, A. Datum wants to implement a new Web server certificate and implement smart card certificates for users. They also want to implement new certificates on the LON-SVR2 web server. Exercise 2: Configuring Certificate Enrollment The next step in implementing the PKI at A. Datum is to configure certificate enrollment. A. Datum wants to enable different options for distributing the certificates. Users should be able to enroll automatically, and smart card users should get their smart cards from an Enrollment Agent. A. Datum has delegated Enrollment Agent rights for the Marketing department group to user Allie Bellew. Exercise 3: Configuring Certificate Revocation As part of configuring the certificate infrastructure, A. Datum wants to configure revocation components on newly established CAs. You will configure CRL and Online Responder components. Exercise 4: Configuring Key Recovery As a part of establishing a PKI, you want to configure and test procedures for the recovery of private keys. You want to assign a KRA certificate for an administrator, and configure CA and specific certificate templates to allow key archiving. In addition, you want to test a procedure for key recovery.
• #63: Question What is the main benefit of OCSP over CRL? Answer OCSP provides status for a single certificate that clients request, instead of downloading the entire CRL and delta CRLs. In addition, responses are much faster and more reliable, because clients do not cache them. Question What must you do to recover private keys? Answer To recover private keys, you must configure CA to archive private keys for specific templates, and you must issue a KRA certificate.