- [Instructor] One of the conveniences
of using your own PKI
is the ability to create custom certificates
and to issue them on your terms.
In my courses on certificate services,
I walk through the process of configuring group policy
so we can tell all of the work stations
and users in the domain
to trust our certificate authority,
and how to pull certificates of their own
whenever they need it.
Here in the domains,
I'm going to open the default domain policy for editing,
and I'm going to go ahead and maximize this
and give us a little bit more room here.
Under the computer configuration in policies,
Windows settings, security settings,
and public key policies,
there's a place right here where I can add
the certificate of my root authority
as a trusted authority,
and that information will go out to all of my users
and all of my computers.
I can also specify how computers and users
enroll for certificates
and when it's okay for them to enroll themselves
without any human intervention.
This is all very convenient, but it requires you to create
your own certificate templates.
Let me close out of here and show you what I mean.
After closing the group policy management,
I can open the tools menu and open certification authority.
Now, if I try to run this tool on a server
that doesn't have certificate services installed,
it's going to give me an error
and require me to search for the server
that has the certificate authority installed.
This demo environment is fairly small,
so I went ahead and installed this role
on the domain controller.
In a production server,
it's likely that you won't do that,
that you'll look for another member server somewhere else.
But I'm trying to simplify the number of machines
in these demonstrations.
Once I expand that server,
the bottom thing in the list is certificate templates.
If I right-click on that and go to manage,
I can see a list of all the different types of certificates
that I may choose to issue,
including one specifically designed for users.
And if I look at the properties of that user certificate,
I can see that it is published in active directory,
but I can also see that there's not a lot of tabs up here
for me to make other changes.
Let me close out of this and right-click on user
and choose duplicate template.
Here, I can go to the general tab
and assign this a new name.
Probably something that starts with reference
to my company, Landon Hotels,
so let me go ahead and put LH,
user, and specify the validity of this certificate.
How long is this certificate going to be good for,
whether or not it's supposed to be published
in active directory.
All of these are fine,
so I'm going to go ahead and click apply.
Back here on compatibility,
I can choose which versions of Windows,
and this does have the work station equivalent
associated as well.
Which version of Windows support for certificates
do I want to allow?
If I want to use only the most recent information,
then I'm going to scroll down and pick
the highest number on the list.
And when I choose that,
I can immediately see what benefits I've received
by choosing a newer format.
When I make everything newer, including the recipient,
I can see a much longer list
of what I am allowed to require
or what capabilities are included in my certificates.
So let me go ahead and click okay to that.
Beyond this, you could go through each tab
and find information that's worth setting
and configuring about your servers,
but let me point out a couple specific tabs
that you'll want to take a look at.
The subject name.
This is the name that goes into the certificate.
This is how someone will be recognized.
It's a good idea to have two different kinds of names
in an active directory certificate:
the fully distinguished name and,
because we use DNS for so much of what we do
in active directory,
the DNS name should at least be included
as an alternate subject name.
In addition to that,
I want to go to the security tab.
On the security tab,
we specify who is allowed to enroll.
If I want all of my domain users
to be allowed to request certificates,
or better yet, I want them to automatically
receive certificates when they log in,
I can select them and make sure that enroll
and auto enroll are selected,
and then go ahead and apply these changes.
I now have my own new certificate template
that I can start to issue.
If I close this management console,
I can go back to certificate templates,
right-click on it,
and select new certificate template to issue.
And this will allow me to scroll through,
find my Landon Hotels user template,
and publish it in active directory.
Now, anytime one of my users logs into their work station
in the domain,
they're going to automatically be enrolled
in that certificate.
So far, issued certificates are just the ones
that a domain controller pulls for themselves.
But as soon as users start logging in,
their new, automatically issued certificates
are going to start populating right here.