Installation de l'autorité de certification racine

Je m'inspire de cette documentation, très complète : Offline Root CA Setup | docs.mjcb.io

Un livre papier/kindle existe, je le recommande très fortement.

Cette documentation est en cours de rédaction.

J'utilise ici les bonnes pratiques de Microsoft qui consiste à mettre en place 2 serveurs : 

On commence par mettre en place l'autorité de certification racine, qui sera par la suite offline.

A la racine du C:, on ajoute un fichier CAPolicy.inf :

[Version]
Signature = "$Windows NT$"

[PolicyStatementExtension]
Policies = AllIssuancePolicy,InternalPolicy
Critical = FALSE

; AllIssuancePolicy is set to the OID of 2.5.29.32.0 to ensure all certificate templates are available.
[AllIssuancePolicy]
OID = 2.5.29.32.0

[InternalPolicy]
OID = 1.2.3.4.1455.67.89.5
Notice = "The Khroners Labs Certification Authority is an internal resource. Certificates that are issued by this Certificate Authority are for internal usage only."
URL = http://pki.ad.khroners.fr/cps.html

[Certsrv_Server]
; Renewal information for the Root CA.
RenewalKeyLength = 4096
RenewalValidityPeriod = Years
RenewalValidityPeriodUnits = 10

; Disable support for issuing certificates with the RSASSA-PSS algorithm.
AlternateSignatureAlgorithm = 0

; The CRL publication period is the lifetime of the Root CA.
CRLPeriod = Years
CRLPeriodUnits = 10

; The option for Delta CRL is disabled since this is a Root CA.
CRLDeltaPeriod = Days
CRLDeltaPeriodUnits = 0

 

image.png

image.png

On configure le rôle :

image.png

image.png

image.png

image.png

image.png

image.png

image.png

image.png

image.png

certutil.exe -setreg CA\DSConfigDN "CN=Configuration,DC=ad,DC=khroners,DC=fr"
certutil.exe -setreg CA\ValidityPeriodUnits 5
certutil.exe -setreg CA\ValidityPeriod "Years"
certutil.exe -setreg CA\CRLPeriodUnits 52
certutil.exe -setreg CA\CRLPeriod "Weeks"
certutil.exe -setreg CA\CRLOverlapPeriodUnits 12
certutil.exe -setreg CA\CRLOverlapPeriod "Hours"
net stop CertSvc
net start CertSvc

Offline Root CA Setup | docs.mjcb.io


Revision #6
Created 27 September 2023 05:49:23 by Khroners
Updated 5 October 2023 22:21:26 by Khroners