Deploying Certificates in Visual Studio .NET

Maker QR Code in Visual Studio .NET Deploying Certificates

Note The SCEP installation file (cepsetup.exe) is available for download at www.microsoft.com/downloads/details.aspx displaylang=en&familyid=9f306 763-d036-41d8-8860-1636411b2d01 and can be used by any device that supports SCEP enrollment.

For each PKI-enabled application, you must choose the best way to deploy certificates to users, computers, and network devices. In most cases, you ll have a primary method and a secondary method.

Manual enrollment is not well suited for mass certificate deployment because of the amount of time an organization must spend training personnel to use such a method. Table 12-1 shows the available manual enrollment methods for version 1 and version 2 certificate templates on Windows 2000, Windows XP, and Windows Server 2003 client computers.

Enrollment Method Manual enrollment on a Windows 2000 workstation Manual enrollment on a Windows XP or Windows Server 2003 workstation Request a certificate template that is pended for certificate manager approval

Certificates MMC V1 template: Yes V2 template: No V1 template: Yes V2 template: Yes V1 template: No V2 template: No

Web Enrollment V1 template: Yes V2 template: Yes V1 template: Yes V2 template: Yes V1 template: Yes V2 template: Yes

Autoenrollment lowers the cost of a PKI by reducing the time and effort required to deploy certificates. Table 12-2 shows the automatic enrollment methods available for common deployment scenarios.

Part II:

Table 12-2

ACRS V1 template: Yes V2 template: No V1 template: No V2 template: No V1 template: Yes V2 template: No Autoenrollment Settings V1 template: No V2 template: Yes V1 template: No V2 template: Yes V1 template: No V2 template: Yes Scripting V1 template: Yes V2 template: Yes V1 template: Yes V2 template: Yes V1 template: Yes V2 template: Yes

Enrollment Method Automatic deployment of certificates to computers Automatic deployment of certificates to users Automatic renewal of expired certificates

Before enrolling a certificate manually, automatically, or through a scripting method, you must ensure that the certificate templates are available for enrollment at a CA. This process is known as publishing the certificate template at the CA. The following procedure publishes a certificate template: 1. Log on at the CA computer as a user assigned the CA administrator role. 2. From Administrative Tools, open the Certification Authority console. 3. In the console tree, expand CAName (where CAName is the logical name of the CA) and click Certificate Templates. 4. In the console tree, right-click Certificate Templates, point to New and click Certificate Template to Issue. 5. In the Enable Certificate Templates dialog box, select one or more certificate templates not currently published at the CA and click OK.

Note Version 2 certificate templates are only available if the enterprise CA is running Windows Server 2003, Enterprise Edition, or Windows Server 2003, Data Center Edition. If the enterprise CA is running Windows Server 2003, Standard Edition, the Enable Certificate Templates dialog box only displays the available version 1 certificate templates.

Once you add the certificates, they are available for enrollment. The list of published certificate templates is defined on a CA-by-CA basis, allowing the availability of different certificate templates at each enterprise CA in the CA hierarchy.

12:

If you want to remove a certificate template, select the certificate template or templates in the details pane and press Delete. After confirming the deletion, the certificate templates are no longer available for enrollment.

Alternatively, you can use the certutil command to add or remove certificate templates from a CA. For example, the following script sample removes the default certificate templates and publishes only the Basic Encrypting File System (EFS), CA Exchange, EFS Recovery Agent, and Key Recovery Agent certificate templates:

::Remove certutil certutil certutil certutil certutil certutil certutil certutil certutil certutil the default templates for a W2K3 CA. -SetCAtemplates -Administrator -SetCAtemplates -DirectoryEmailReplication -SetCAtemplates -DomainControllerAuthentication -SetCAtemplates -EFSRecovery -SetCAtemplates -EFS -SetCAtemplates -DomainController -SetCAtemplates -WebServer -SetCAtemplates -Machine -SetCAtemplates -User -SetCAtemplates SubCA

:Publish the required certificate templates certutil certutil certutil certutil -SetCAtemplates -setCAtemplates -setCAtemplates -setCAtemplates +EFS +KeyRecoveryAgent +EFSRecovery +CAExchange

As shown here, the certutil setCAtemplates command can either add templates (+Template name) or remove templates (-Template name). You can use this command in a batch file to define the exact set of certificate templates that must be published at a specific CA.