What are the benefits of having our own certification authority.
The first benefit is security will be able to specified that we only trust certificates issued by our
own certification authority.
We would avoid risks associated with the fact that someone else has already invested in a certificate
and we now indirectly trust him.
Secondly we have greater control over the certificates themselves.
We can for example immediately revoke them and attempt to revoke a certificate that for some reason
has been compromised.
For example someone stole a smart card takes a very long time.
Maybe some of you have learned that this is not such an easy procedure.
Thirdly we'll probably benefit from it.
If we issue 50 100 or 200 certificates at this point the cost to purchase these certificates will exceed
the cost of starting a public key infrastructure.
Since we decided to have our own infrastructure we just need the planet first.
Remember that one certification authority may not issue all the certificates for the company.
This is a single point of trust if something happens if someone discredits the certification authority
then we lose trust on a global scale.
The entire computer system stops working no one sends mail and computers don't connect with each other
because it doesn't work.
It's one big disaster.
The cost of rectifying such a situation will be enormous having a hierarchy of certificates.
We obtain two things.
First of all Theroux's certification authority will be better protected because it's turned off and
locked in a safe.
This will be a computer that we pull out of the safe once a year and only turn on for a moment not connecting
it to a local network.
It will be harder to break into.
Secondly the subordinate certification authority will be for example functional.
We could have only a certification authority responsible for ipsa.
If something bad happened to that authority then all certificates connected with Essec must be revoked
and most likely will be reissued later.
But everything else works.
It has not been compromised.
If we want to be in accordance with certain classifications classification documents of our computer
system we need to plan a two or three level hierarchy.
Moreover certificates of root certification authorities will have to be issued by a device that generates
external hardware certificates.
The hierarchy of our certification authority may look as follows.
We'll have a route certification authority into subordinate authorities.
One of them will support the internal network and the second the external network such as business partners
under those authorities will be the functional authorities responsible for various types of certificates
in windows.
We have two types of available certification authorities.
The first is called the standalone.
This is a certification authority that we can install ourselves on the computer which is not a member
of the Active Directory domain.
The second is the Enterprise certification authority.
As you might have guessed this authority requires active directory standalone is much less functional.
There is no automatic processing of certificate requests.
It is also more limited when it comes to the types of certificates it may issue at the enterprise certification
authority.
Requests can be processed automatically and we can create our own templates for certificates.
It follows that the root certification authority should be a standalone.
It's disconnected all the time from networks anyway.
However all the subordinate authorities should be enterprise certification authorities
since the root certification authority is a standalone and operates off line or it's most often turned
off we need to change a few things during installation.
This is one of the few places in the Microsoft environment where before you run the installer we have
to manually change the configuration file later it's impossible to change it.
The file name CA policy dot in must be prepared according to the template presented below and saved
in no windows folder.
The installer will find it there and use it.
What do we need to change.
It would be good to enter a security policy this policy is recorded in the certificate and everyone
who has it knows how it should be used in this file.
It will be abbreviated but there will also be the address of the full policy.
We should also configure certain things related to the length of the key and the validity of the certificate.
This is the most important certificate that we have.
Therefore it should be the best protected.
This should be a long key but also valid for a long time.
The certification authority may not issue certificates valid for longer than its own certificate.
This would be meaningless if the validity date in this file is not long enough then automatically we
shorten the lifetime of all certificates in the company such a certificate is unlikely to be revoked.
Therefore we should extend the period of publishing the certificate revoked and list if we don't do
this we'll have to turn on the computer that's stored in the safe or closet.
More frequently just to generate a new CRL list in which case we indicated that we have not revoked
certificates at the end.
We need to change two pieces of information whereas the data of the certification authority and certificate
revocation lists available by default.
They are available locally.
We would want for them to be published by one of the subordinate certification authorities which are
currently online after preparation of such a file.
Rerun the wizard and returned to the Windows environment.
We accept the next screen and from that moment the certification authority operates
we'd already mention that later we will configure two attributes indicating where the actual information
will be available about the authority and the lists on the company's network
using the command line.
We need to extend the validity period of the certificate.
For this we have a tool called cert.
You tell
later we publish the certificate from the root certification authority.
We do this in two places on the Web site server and on the domain controller we would also like for
our clients to be able to verify our identity both over the web and automatically
this entire procedure is much easier for subordinate certification authorities there online and by default.
The settings are correct.
Nothing needs to be changed or extended.
The thing that's interesting is that the subordinate certification authority does not run until it's
on the trusted list.
The subordinate certification authority must submit a certificate request to the root certification
authority the certification authority is blocked until the request is processed.