Comodo Certificate Manager Version 5.4

Transcription

1 Comodo Certificate Manager Version 5.4 Comodo Certificate Authority Proxy Server Installation Guide Guide Version Comodo CA Limited 3rd Floor, 26 Office Village, Exchange Quay, Trafford Road, Salford, Greater Manchester M5 3EQ, United Kingdom.

2 Table of Contents 1. Prerequisites Server Requirement Client Requirement Active Directory Certificate Services (AD CS) Installation Comodo CA Proxy Service Installation Configure Certificate Enrollment Policy Deploy Trusted Root Certificates Configure Templates at Active Directory Configure Templates at CCM Configure Active Directory Users Enrollment and Auto-Enrollment Starting Troubleshooting Enrollment Failure Unsupported editions of Windows 2012/R Access denied when duplicating templates About Comodo

3 1. Prerequisites 1.1.Server Requirement Windows Server 2012 /2012 R2 (Foundation/Essentials/Standard/Datacenter) Active Directory Domain Services Certificate Manager Server (CCM) running under JRE 1.6., must be accessible from Active Directory Certificate Services host. CCM Server's URLs must be assigned to Trusted Zone. Remarks: Currently, AD CS role can be installed automatically by Comodo AD Agent Installer. It is not recommended to have AD CS role installed before Comodo CA Proxy. If AD CS role is already installed, make sure that it is meets to following requirements: This CA is configured as Root CA The type of the CA is Enterprise (not Standalone) This CA works properly Otherwise, it is highly recommended to uninstall AD CS role or use another server. Editions of Windows Server 2012 / R2 that can be used with AD CS role Edition AD CS availability Edition AD CS availability Foundation Certificate Authorities only Essentials Certificate Authorities only Standard Yes Datacenter Yes 1.2.Client Requirement Windows 7, 8, 8.1 workstation as domain member Domain user account 2. Active Directory Certificate Services (AD CS) Installation It is recommended to run Comodo AD Agent installer on a server without previously installed AD CS role. It allows to get right configuration of AD CS role in the most simple way. To continue, please, follow to section 3. However, if you decide to configure AC CS role independently, please, refer to Active Directory Certificate Services Role installation guide. If Comodo AD Agent installer finds that AD CS role is already installed, it will use existing configuration of AD CS. 3

4 3. Comodo CA Proxy Service Installation 1. Make sure, that you are logged on to appropriate server as a domain administrator. 2. Run certsrv.msc (Press Windows Key + R, type certsrv.msc, click 'OK'). 3. Select 'Roles Summary' section, expand it and then select and expand 'Active Directory Certificate Services' node. Previously installed Microsoft AD CA service must be stopped. You can stop it by pressing 'Stop' tool button on the 'Server Manager' page. See the Figure 3.1 for details. Figure Start ad-agent.exe from command line or explorer 5. Accept End User License Agreement 6. Leave default destination folder or select it by clicking 'Browse' button The destination folder is C:\Program Files\COMODO\CcmADAgent\ for 32-bit platform or C:\Program Files (x86)\comodo\ccmadagent\ for 64-bit platform. Press 'Next' button. 7. Provide actual address of CCM server, Account's URI and secret key 4

5 Figure 3.2 CCM Server's address format: URL: For example: You can type if the server is accessible on 443 port Account's URI: The Figure 3.2a explains how to obtain it. Log on to CCM as Super Admin, select Customer tab and get right value from URL Extension column. Figure 3.2a 5

6 Secret Key: The figure 3.2b explains how to obtain secret key from CCM Log on to CCM as Super Admin, select Customer tab and click 'Edit' button. Scroll down the page with customer properties approximately to the middle of the page. Figure 3.2b shows the location of secret key. You can copy it from here and paste into installer window (Figure 3.2). If secret key is empty, or AD Support check box is not set, do next step, otherwise click 'Cancel' button to close current page without saving. Figure 3.2b 8. Do this step, only if secret key is empty, or (and) AD Support check box is not set. Otherwise, skip this step. Set AD Support check box and enter at least 10 digits for secret key. Copy this secret key to provide it to installer window (Figure 3.2). Save changes and close current page by clicking OK button. 9. Select Cryptographic Services Provider, algorithm and key size for CA's private key, after that press 'Next' button. 6

7 Figure Select shortcut folder for Active Directory Agent Setup Utility by clicking 'Browse' button or leave default folder and press 'Next' 11. Press Install and wait some minutes for end of installation process. Press Finish button to close setup wizard. Click Start, point to Administrative Tools, and then click Server Manager. Or click corresponding button on task bar. Select Roles Summary section, expand it and then select and expand Active Directory Certificate Services node. Locate Comodo CA Proxy service. Make sure, that service is started. Figure 3.1 shows running state of this service. Otherwise, try to start this service manually. You must provide CCM RAO or MRAO credentials to AD Agent settings using Setup Utility. To start it, find corresponding shortcut into Start menu. It's default location is Start > COMODO > CcmADAgent > Start-agent.lnk, or run start-agent.bat from command line. Figure 3.4 The Figure 3.4 demonstrates fields, which was filled with some sample data. 7

8 4. Configure Certificate Enrollment Policy 1. Make sure, that you are logged on to appropriate server as a domain administrator. 2. Run gpmc.msc (Press Windows Key + R, type gpmc.msc, click OK) Figure Select 'Features' node, expand it according to the Figure 4.1. Select 'Edit...' option of popup menu for 'Default Domain Policy'. The Group Policy Management Editor will be displayed. 8

9 Figure Select 'Computer configuration' > 'Policies' > 'Windows settings' > 'Security Settings' > 'Public key policies'. 5. In the 'Object Type' list double click on the Certificate Service Client Certificate Enrollment Policy. Switch configuration model to Enabled state. Make sure, that this Active Directory Enrollment Policy is used as default. The 'Default' check box must be selected. Column Automatic Enrollment must contain value as Enabled. Otherwise, make this policy enabled with next step. 9

10 Figure Press the 'Properties' button. Make sure, that all options in the 'Enrollment Configurations' group box are selected. 'Enrollment policy servers' list must contain a record with LDAP: as Server URI and Windows Integrated as Authentication type. Such configuration is displayed at Figure

11 Figure 4.4 Click the OK button to apply changes and to close this window. Click the OK button on Certificate Services Client Certificate Enrollment Policy Properties form to apply changes and to close this window. Remark: This section is about minimal configuration of Certificate Enrollment Policy. Basically, it is required for enrollment and auto-enrollment functionality for domain-joined users. But if you need to use extended features, such as web-enrollment services, you must add other enrollment policy. 7. In the Object Type list (Figure 4.2) double click on the Certificate Service Client Certificate Auto-enrollment. Switch configuration model to Enabled state. It is recommended to activate options, that allow renew expired certificates, update pending certificates, renew revoked certificates and update certificates, that use certificate templates. 11

12 Figure 4.5 Press the 'OK' button to apply changes and close this window. 5. Deploy Trusted Root Certificates Import Comodo CA's root and intermediate certificates to Group Policy. In the Group Policy Management Editor (Figure 4.1) go to 'Computer Configuration' > 'Windows Settings' > 'Security Settings' > 'Public Key Policies' > 'Trusted Root Certificate Authorities'. (In Windows Server 2012 navigate to 'Computer Configuration' > 'Policies' > 'Windows Settings' > 'Security Settings' > 'Public Key Policies' > 'Trusted Root Certificate Authorities'). 12

13 Figure 5.1 Click 'Import... 'option from popup menu, then click Next button and input location of file with certificates. Basically, trusted cerficicates are located at \Trusted sub-folder of destination folder, that was entered to installer program at section 3, step 6. By default it is C:\Program Files (x86)\comodo\ccmadagent\trusted\ 13

14 Figure 5.2 Certificate Import Wizard 14

15 Figure 5.3 Select certificate to import 15

16 Figure 5.4 Select certificate store 16

17 Figure 5.5 Import complete. Press Finish to close wizard. After importing, you should see certificates in Group Policy. You should do this action for each file with trusted certificates. 6. Configure Templates at Active Directory Log on to appropriate server as a domain administrator. Run certsrv.msc (Press Windows Key + R, type certsrv.msc, click OK) Select Certificate templates. Now you are able to see the list of templates, currently used by Comodo CA Proxy. Using popup menu, click on Manage option. Now you are able to see all available templates. Choose the most suitable template and click the Duplicate Template option in popup menu. 17

18 Figure

19 Figure 6.2 Choose compatibility of new template. It is recommended to choose it according to actual versions of used OS at the CA Proxy server and workstations. Click 'OK' button to accept your choice. Enter Template Display Name and Template Name 19

20 Figure 6.3 Set necessary permissions to this template. Switch to Security tab. For users, that enroll for certificates using this template, you should set Read, Enroll, Auto-enroll permissions. 20

21 Figure 6.4 'Write' permission enables the users to modify the properties of this template, so it is not recommended to set this permission for all users. Press Apply button to apply security changes and to leave this window opened. Open Extension Tab and select Application Policies item. Click Edit... button 21

22 Figure 6.5 Now you will be able to add, edit or remove application policies for this template. Form the set of application policies according to purposes of this template. 22

23 Figure 6.6 To view or edit OID of selected application policy press Edit... button. Figure 6.7 Remarks: You can add application policy by clicking Add button. 23

24 Figure 6.8 If you need some application policy and it does not exists at this list, click New... button, then enter the name of new application policy and your OID and click the OK. You can use only OIDs, that are supported by current version of CCM. Please view OIDs list at CCM side. The section 6 explains how to view this list. Select Key Usage item at Extensions tab (Figure 6.5), then click Edit... button. Select suitable options for Key Usage extension (Figure 6.9) of this template, then click OK button. If you don't need any changes, press Cancel button. 24

25 Figure 6.9 Select Cryptography tab of current template property editor (Figure 6.10). Enter algorithm name, key size and hash algorithm, then click OK button. Remarks: This tab is available only for version 3 certificate templates. This settings applied to certificate request only, not the certificate, that issued from this template. 25

26 Figure 6.10 Fill other template properties at different tabs of current template property editor according to purposes of this template. To associate new template with Comodo CA Proxy open Server Manager, select node Roles > Active Directory Certificate Services > Comodo CA Proxy > Certificate Templates, then activate popup-menu on Certificate Template sub-node and select New > Certificate Template to Issue, or choose main menu Actions > New > Certificate Template to Issue. 26

27 Figure 6.11 Select your template and click OK button to save changes and close the window 27

28 Figure

29 7. Configure Templates at CCM 1. Log on to CCM as Super Admin using Super Admin interface 2. Select Setting > Ku/EKU tab to view available OID codes. Active Directory certificate templates must use this codes only. Figure Use Add button or Edit button to do corresponding action with available Extended Key Usages (EKU) list Remark: Please, be careful, when you edit or add EKU code (OID) must be entered correctly. 4. Select Settings > Templates tab to access available templates list. Use Add button or select a template and use Edit button to do corresponding action. To add or edit template do the following: Enter or edit template name (Name field) Enter or edit template description (Description field) Form or edit Binding Key Usage list. Use > button for bind or < button for unbind KU item. Form or edit Binding EKU list. Use > button for bind or < button for unbind EKU item. 29

30 Note: Key Usage in Active Directory template must be set according to KU bindings in corresponding CCM template. Application policies list in Active Directory template and EKU bindings list in CCM template must be equal by used aggregate of OIDs. 30

31 7. Select the template from Available Templates list and click > button to add it to Assigned Templates list. You can also remove other template from Assigned Template list by selecting it and using < button. Click OK button to save changes and close this page. Figure 7.2b 8. Scroll down the content of Edit Customer page and locate Web Services section. Set Allow web services for SSL processing checkbox and Allow web services for SMIME processing checkbox to selected state. Click OK button to save changes and to close this page. Figure 7.2b1 9. Log on to CCM as MRAO using Client Admin interface. Select the organization to bind it with the template. Click Edit button and switch to Client Cert tab. Make sure, that Web API check box is on, and also Secret Key is valid. 31

32 Otherwise, set Web API check box and/or enter right Secret Key. Figure 7.2c 10. Click KUT button. Select the template from Available Templates list and click > button to add it to Assigned Templates list. You can also remove other template from Assigned Template list by selecting it and using < button. Click OK button to save changes and close this page. The figure, that images this action is fully identical to Figure 7.2b, so it is omitted here. Also click OK on Edit Customer page to finish editing and to close it. 11. Click Departments button. Select the department and click Edit button. Switch to Client Cert tab. Make sure, that Webm API check box is on, and also Secret Key is valid. Otherwise, set Web API check box and/or enter right Secret Key for this department. Click OK button to save changes and close this page. 32

33 Figure 7.2d 12. Log on to CCM as RAO using Client Admin interface. Select the organization, which you have planned to use for Active Directory enrollment. Select Setting > Organizations tab, then click Edit button. On the page with properties of selected organization, select Client cert tab and check the Secret Key. It must be same as ones provided at Section 3, step 7. 33

34 Otherwise, correct it. Also, select your template in Key Usage Template combo box. Click OK button to save changes and close this page. Figure Skip this step, if selected organization does not have any department. Otherwise, do following. Click Departments button, then select the department, which you have planned to use for Active Directory enrollment with this organization. Click Edit button. On the page with properties of selected department, select Client cert tab and check the Secret Key. It must be same as ones provided at Section 3, step 7. Otherwise, correct it. Also, select your template in Key Usage Template combo box. Click OK button to save changes and close this page. 34

35 Figure

36 8. Configure Active Directory Users Please, check that next attributes are filled properly for users accounts in Active Directory: First Name Last Name Company Department [optionally] To check this, do following. 1. Make sure, that you are logged on to appropriate server as a domain administrator. 2. Run dsa.msc (Press Windows Key + R, type certsrv.msc, click OK) Figure 8.1 Double click on selected user 36

37 Figure 8.2 Check First name, Last Name, 37

38 Figure 8.3 Check Department and Company 3. Click OK button to apply changes and close this window 9. Enrollment and Auto-Enrollment Starting 1. Log on to user's workstation as domain-joined user. Autoenrollment must be initiate by system automatically. For details see Microsoft technical documentation related to certificate autoenrollment. 2. Run certmgr.msc from command line or by any other way. Select node Certificates Current User=>Personal. If sub-node Certificates is present, select it and try to view the list of certificates. Otherwise, the autoenrollment is in progress, or is not started. 3. To start manual enrollment, select popup menu, or main menu option All Task=>Request New Certificate... 38

39 Figure Read information in new window and click next button 39

40 Figure Select Active Directory Enrollment Policy and click Next button 40

41 Figure Select you template for enrollment and click 'Enroll' button 41

42 Figure Make sure, that operation complete and click Finish button. Remark: You can also view detailed information about enrolled certificate by clicking Detail button from window at Figure

43 Figure Double click on new certificate from the list under Personal=>Certificates node. Now you are able to view the most of certificate properties. Figure On Comodo CA Server console you also can see this certificate under Issued certificates node. To view it's details, double click it in the list. The result is same as from client certificates console and is displayed at Figure

44 Figure Troubleshooting Enrollment Failure See *.log files under \Log sub-folder for details of troubles. Logs can be opened with any text viewer or editor. In case of enrollment failure, please make sure that the following is completed: 1) Names of the organization and the department in user's properties at Active Directory side match with corresponding settings at CCM side. 2) The in user's properties at Active Directory side is valid. 3) Selected domain is delegated to appropriate organization and department in CCM. 4) Active Directory certificate template has Read, Enroll, Autoenroll permitions for appropriate users and/or groups. Also enrollment and autoenrollment is allowed by Public Key Policies of the domain. 5) Key Usage in Active Directory template is set according to KU bindings in corresponding CCM template. Application policies list in Active Directory template and EKU bindings list in CCM template are equal by used aggregate of OIDs. Each Application policy in AD template have corresponding EKU binding in CCM template. 6) ccm_ca32.exe is trusted for domain network and allowed by Windows Firewall 44

45 10.2. Unsupported editions of Windows 2012/R2 There are some special-purpose editions of Windows Server 2012/R2, that optimized for specific tasks and do not allow to install ADCS role. Such editions are not supported: Microsoft Hyper-V Server 2012 Windows Storage Server 2012 Standard Windows Storage Server 2012 Workgroup Windows MultiPoint Server 2012 Premium Windows MultiPoint Server 2012 Standard Access denied when duplicating templates This error can take place when current user s account have no corresponding permissions to container with templates. To check and/or fix it, please do the following: 1) Make sure, that you are logged on to appropriate server as a enterprise administrator. 2) Run adsiedit.msc 3) Connect to Configuration naming context 4) Choose CN=Configoration(your DC)->CN=Services->CN=Public Key Services ->CN=Certificate Templates 5) Open Properties window using corresponding option from the popup-menu 6) Choose Security tab 7) Select group or name of the user 8) Make sure that Write and Create all chind objects permissions are granted 9) Press OK button Figure 10.1 shows how to find Certificate Templates container with ADSI editor. Figure

46 About Comodo The Comodo organization is a global innovator and developer of cyber security solutions, founded on the belief that every single digital transaction deserves and requires a unique layer of trust and security. Building on its deep history in SSL certificates, antivirus and endpoint security leadership, and true containment technology, individuals and enterprises rely on Comodo s proven solutions to authenticate, validate and secure their most critical information. With data protection covering endpoint, network and mobile security, plus identity and access management, Comodo s proprietary technologies help solve the malware and cyber-attack challenges of today. Securing online transactions for thousands of businesses, and with more than 85 million desktop security software installations, Comodo is Creating Trust Online. With United States headquarters in Clifton, New Jersey, the Comodo organization has offices in China, India, the Philippines, Romania, Turkey, Ukraine and the United Kingdom. Comodo CA Limited Comodo Security Solutions, Inc. 3rd Floor, 26 Office Village, Exchange Quay, Trafford Road, Salford, Greater Manchester M5 3EQ, 1255 Broad Street United Kingdom. Tel : +44 (0) Fax : +44 (0) EnterpriseSolutions@Comodo.com Clifton, NJ United States Tel: Tel: For additional information on Comodo - visit 46