Just a quick post describing how to request an AD FS SSL (service communications) certificate from within Windows Server Core. The OS being used is Windows Server 2016, but, unless otherwise stated, this also applies to Windows Server 2012 R2.
For the enrollment and submission of the request, as well as parsing of the response, we’ll look at two mechanisms:
The issuing authority is an Active Directory Certificate Services Enterprise CA.
This is the legacy tool uses for certificate enrollment since Windows 2000. While a little cumbersome, it’s provide to be very useful over the years. It’s a command-line utility that parameterizes the request, submission and processing of the request file and certificate response to the Certificate Authority (CA). As a rule-of-thumb, it’s used where traditional enrollment mechanisms: web enrollment or MMC are not available or valid.
To begin a configuration (TXT) file needs to be created. This serves as an input file for completing information concerning the request. We’ll call it ADFSDEMO.TXT.
Signature= $Windows NT$
Subject = “CN=adfsdemo.mydomain.com 1, OU=Demo, O=Access_Onion, L=City, S=State/Province, C=NL” ;
KeySpec = 1
KeyLength = 2048
Exportable = TRUE
MachineKeySet = TRUE
SMIME = False
PrivateKeyArchive = FALSE
UserProtected = FALSE
UseExistingKeySet = FALSE
ProviderName = Microsoft RSA SChannel Cryptographic Provider
ProviderType = 12
RequestType = PKCS10
KeyUsage = 0xa0
Hashalgorithm = sha256 2
OID=184.108.40.206.220.127.116.11.1 ; Server Authentication OID 3
1 is the common name for our certificate, i.e. the federation services URL.
2 specifies a hash algorithm of SHA-256. Note that CNG algorithms are only supported in AD FS in Windows Server 2016. Use SHA-1 for older versions.
3 is the Server Authentication object identifier (OID) required for an SSL certificate
4 are Subject Alternate Names added for Workplace Join and the new certificate enrollment endpoint in Windows Server 2016 / AD FS 4.0
5 For third-party certificate authorities or a stand-alone AD CS CA, the CertificateTemplate=”WebserverV2″ line can be dropped.
On our AD Certificate Services Enterprise CA, support for Subject Alternate Names (SAN) needs to be enabled:
certutil -setreg policy\EditFlags +EDITF_ATTRIBUTESUBJECTALTNAME2
net stop certsvc&&net start certsvc
A template called WebServerV2 has been created (this is a copy of the WebServer built-in template, with compatibility level set to Windows Server 2003 and with certificate duration to 2 years). From CERTREQ.TXT, we generate a REQ (Request) file for submission to the local issuing authority
This is done with the following command:
CERTREQ –new ADFSDEMO.TXT ADFSDEMO.REQ
A response from the local policy filter
Active Directory Enrollment Policy
CertReq: Request Created
And it’s now possible to submit the request file to the CA
CERTREQ –submit ADFSDEMO.REQ
The authority requests confirmation via a popup-window
Click on OK and the CA requests a location to save the generated certificate on the local disk of the server. For consistency, we call it ADFSDEMO.CER.
To complete the installation of the certificate the following command is run:
certreq –accept ADFSDEMO.CER
This section is the picture of conciseness as PowerShell simplifies the enrolment process for us. Here’s the request, submission and installation of the certificate, succinctly rolled-up into one command.
Get-Certificate -Template WebServerV2 -DnsName adfsdemo.mydomain.com,enterpriseregistration.mydomain.com,certauth.adfsdemo.mydomain.com -Subjectname -CertStoreLocation cert:\LocalMachine\My
Note that on the AD FS server, it’s possible to drop into Powershell to have a look at the issued certificate
Assuming the server has already been domain-joined, has had the AD FS feature installed (Add-WindowsFeature ADFS-Federation) and a service account created in AD, then the configuration wizard of the AD FS farm can begin. Here’s an example of a WID-based deployment for the first farm node, utilizing the thumbprint of the SSL cert. The credentials for the service account are collected via the variable $cred, before being called in the Install-ADFSFarm cmdlet.
Install-ADFSFarm –CertificateThumbprint 57C0D558EC02… –FederationServiceDisplayName ‘Access Onion’ –FederationServiceName adfsdemo.mydomain.com –ServiceAccountCredential $cred –OverwriteConfiguration
Till next time..