Setting up SSL for Active Directory Server

Any utility or application that creates a valid PKCS #10 request can be used to form the SSL certificate request. The following example uses certreq.exe to form the request.

To set up SSL for Active Directory Server (ADS):

1. Find the Fully Qualified Domain Name (FQDN).

2. Request a server authentication certificate.

3. Verify an LDAPS connection.

To create certificate request, the Fully Qualified Domain Name (FQDN) of the Domain Controller (DC) is needed.

Finding the FQDN

To find the FQDN:

1. Select Start, and then Programs, and then Administrative Tools, and then DNS.

   The dnsmgmt window opens.

2. Double-click the host name of your machine, and you will see the FQDN.

Requesting a Server Authentication Certificate

To request a server authentication certificate:

1. Copy and paste the following text into a new text file and save it as request.inf:

   ; ----------------- request.inf ----------------- 
   
   [Version] 
   
   Signature="$Windows NT$"
   
   [NewRequest]
   
   Subject = "CN = LAB-SUMAHADE-WF.adserver.coretools”
   ; replace with the FQDN of the DC 
   KeySpec = 1 
   KeyLength = 1024 
   ; Can be 1024, 2048, 4096, 8192, or 16384. 
   ; Larger key sizes are more secure, but have 
   ; a greater impact on performance. 
   Exportable = TRUE 
   MachineKeySet = TRUE 
   SMIME = False 
   PrivateKeyArchive = FALSE 
   UserProtected = FALSE 
   UseExistingKeySet = FALSE 
   ProviderName = "Microsoft RSA SChannel Cryptographic Provider" 
   ProviderType = 12
   RequestType = PKCS10 
   KeyUsage = 0xa0 
   [EnhancedKeyUsageExtension] 
   
   OID=1.3.6.1.5.5.7.3.1 ; this is for Server Authentication 
   
   ;-----------------------------------------------
   
   

2. Provide the fully qualified DNS name of the domain controller in the request. The semicolon (;) is used to indicate that the following text through the end of the line is a comment.

3. Create the request file and then, in a command prompt, navigate to the path where the request is and type the following command:

   certreq -new <Name of the inf file> <name of the request file>

   Example: certreq -new request.inf request.req

   A new request.req is created in the current directory. This is the base64-encoded request file.

4. Submit the request to a CA for a server certificate. Save the server certificate, servercert.cer, on your machine. The saved certificate must be base64–encoded.

5. Accept the issued certificate by opening a command prompt, navigating to the path where the server certificate is stored, and executing the following command:

   certreq -accept <Name of the server certificate>

   Example: certreq -accept servercert.cer

6. Now the certificate is installed in your personal store. A private key is associated with this certificate. Verify this key by referring to the ADS documentation.

7. Restart the domain controller by restarting the server.

Verifying an LDAPS Connection

To verify an LDAPS connection:

1. Start the Active Directory Administration Tool (ldp.exe) by selecting Start, and then Run, and then ldp.exe.

2. On the Connection menu, click Connect.

3. When prompted, enter the name of the domain controller (enter the FQDN) to which you want to connect and the SSL port number.

4. Click OK.

   The RootDSE information should appear in the right pane, indicating a successful connection.