[ad_1]
Once you migrate your Home windows surroundings to Amazon Internet Providers (AWS), you may want to deal with certificates administration for computer systems and customers in your Energetic Listing area. Right this moment, Home windows directors generally use Energetic Listing Certificates Providers (AD CS) to assist this process. On this publish, we are going to present you find out how to migrate AD CS to AWS Non-public Certificates Authority through the use of the AWS Non-public CA Connector for Energetic Listing.
AWS Non-public CA supplies a extremely accessible non-public certificates authority (CA) service with out the upfront funding and ongoing upkeep prices of working your personal non-public CA. Utilizing the APIs that AWS Non-public CA supplies, you possibly can create and deploy non-public certificates programmatically. You even have the flexibleness to create non-public certificates for purposes that require customized certificates lifetimes or useful resource names. With AWS Non-public CA, you possibly can create your personal CA hierarchy and problem certificates for authenticating inner customers, computer systems, purposes, providers, servers, and units and for signing laptop code.
Use circumstances for certificates providers that combine with Energetic Listing
AD CS is usually utilized in enterprise environments as a result of it integrates certificates administration with Energetic Listing authentication, authorization, and coverage administration. A typical use case for AD CS is certificates auto-enrollment. Utilizing AD Group Insurance policies, you possibly can configure certificates to robotically be created for customers as they log in to the area, or you possibly can configure laptop certificates, that are related to every workstation or server that joins the area. You may then use these certificates for authentication or digital signature functions. A typical use case is for authentication of units to protected networks, similar to wired networks that require 802.1x authentication or wi-fi networks which are protected by WPA2/3 with EAP-TLS authentication. Auto-enrolled laptop and consumer certificates are additionally generally used to authenticate VPN connections.
Along with certificates auto-enrollment, AD CS additionally integrates with Energetic Listing to publish certificates data on to the consumer and laptop objects in Energetic Listing. On this manner, you possibly can combine the lifecycle administration of the certificates instantly into your current processes for managing the lifecycle of AD customers and computer systems which are joined to the area.
Choices to deploy certificates providers that combine with Energetic Listing on AWS
Emigrate your Home windows surroundings to the cloud, you in all probability need to retain the capabilities of a CA that integrates with Energetic Listing. Though you possibly can migrate AD CS on to AWS and run it on an Amazon Elastic Compute Cloud (Amazon EC2) occasion working Home windows, we are going to present you find out how to use AWS Non-public CA with the Connector for AD to offer an Energetic Listing built-in CA that gives the advantages of AD CS with out the necessity to handle AD CS or {hardware} safety modules (HSMs).
Why migrate your on-premises CA to AWS Non-public CA?
Migrating AD CS to AWS Non-public CA has a number of advantages. With AWS Non-public CA, you get simplified certificates administration, eliminating the necessity for an on-premises CA infrastructure and decreasing operational complexity. AWS Non-public CA supplies a managed service, decreasing the operational burden and offering excessive availability and scalability. Moreover, it integrates with different AWS providers, so it’s easier to handle and deploy certificates throughout your infrastructure. The centralized administration, enhanced safety features, and simplified workflows in AWS Non-public CA can streamline certificates issuance and renewal processes, enabling you to extra effectively obtain your safety objectives.
AWS manages the underlying infrastructure, which can assist cut back prices, and automation options assist forestall disruptions that expired certificates might trigger. AWS Non-public CA operates as a Regional service with an SLA of 99.9% availability. For environments that require the best degree of availability, you possibly can deploy CAs in a number of AWS Areas by following the steering on redundancy and catastrophe restoration within the documentation.
AWS Non-public CA Connector for AD extends the certificates administration of Non-public CA to AD environments. With the Connector for AD, you should use Non-public CA to problem certificates for AD customers and computer systems joined to your area. This contains integration with Home windows Group Coverage for certificates autoenrollment.
How do I migrate to the Connector for AD?
Transitioning from an current AD CS server to the Connector for AD entails a number of steps.
Evaluation and planning
Earlier than you start, determine the use circumstances to your current AD CS server and the way certificates are issued. On this publish, we deal with certificates which are auto-enrolled through the use of a Group Coverage, however you might need different use circumstances the place you have to manually enroll certificates through the use of the Internet Enrollment server or APIs. These may embody use circumstances for signing software program packages or internet server certificates for intranet purposes. Begin by making a certificates stock out of your current AD CS server.
To create a certificates stock out of your current AD CS server
Within the Microsoft CA console, choose Issued Certificates.
From the Motion menu, choose Export Record.
![Figure 1: Export a list of existing certificates](https://d2908q01vomqb2.cloudfront.net/22d200f8670dbdb3e253a90eee5098477c95c23d/2024/03/18/img1-1.png)
Determine 1: Export a listing of current certificates
This produces a CSV file of the certificates that the server issued. To find out which certificates have been created as a part of an auto-enrollment coverage and to determine particular circumstances that require guide consideration, type this file by Certificates Template.
Arrange AWS Non-public CA and the Connector for AD
To finish the preliminary setup of the Connector for AD, see Getting began with AWS Non-public CA Connector for Energetic Listing. Once you full the setup, you can begin transitioning enrollment to the brand new CA.
Configure belief for the brand new CA
Relying on the place you set the brand new non-public CA in your group’s public key infrastructure (PKI) hierarchy, you may need to be sure that its certificates is imported into the entire consumer belief shops earlier than you problem new certificates utilizing the CA. For Home windows units, creation of the Connector for AD imports the CA certificates into Energetic Listing, and robotically distributes it to the belief shops of domain-joined computer systems.
For non-Home windows units, that you must consider different use circumstances for issued certificates on the community and observe vendor directions for updating belief shops. For instance, in case you use consumer certificates for wired 802.1x and Wi-Fi Protected Entry (WPA) enterprise authentication, that you must import the brand new root CA certificates into the belief shops of the RADIUS servers that you simply use for authentication.
Export the CA certificates
The subsequent step is to export the certificates through the use of the AWS Administration Console.
To export the certificates
Open the AWS Non-public CA console.
Navigate to your non-public CA.
Select the CA certificates tab.
Choose Export certificates physique to a file.
For import into an Energetic Listing Group Coverage Object (GPO), title the exported file with a .cer file extension.
![Figure 2: Export the CA certificate](https://d2908q01vomqb2.cloudfront.net/22d200f8670dbdb3e253a90eee5098477c95c23d/2024/03/18/img2.jpg)
Determine 2: Export the CA certificates
Transition certificates enrollment to the brand new CA
After you configure AWS Non-public CA and the Connector for AD and replace your belief shops as needed, you possibly can start to transition certificates enrollment to the brand new CA. In Energetic Listing domains, certificates are sometimes created robotically through the use of an auto-enrollment Group Coverage. Emigrate enrollment to your new CA, that you must configure certificates templates with the suitable properties to match your necessities, assign permissions to the templates, and configure the Group Coverage to level the enrollment consumer on Home windows units to the brand new CA.
Configure certificates templates
Certificates templates outline the enrollment coverage on a CA. An Energetic Listing CA solely points certificates that conform to the templates that you’ve got configured. Utilizing the certificates stock that you simply collected out of your current AD CS server, it’s best to have a listing of certificates templates which are in lively use in your surroundings and that that you must replicate within the Connector for AD.
Begin by noting the properties of those certificates templates in your current AD CS server.
To notice the properties of the certificates templates
Open the Certificates Authority console in your AD CS server.
Navigate to the Certificates Templates folder.
From the Motion menu, choose Handle. This opens the Certificates Templates console, which reveals a listing of the certificates templates accessible in Energetic Listing.
![Figure 3: Identify certificate templates](https://d2908q01vomqb2.cloudfront.net/22d200f8670dbdb3e253a90eee5098477c95c23d/2024/03/18/img3.jpg)
Determine 3: Establish certificates templates
For every certificates that’s in lively use, open it and pay attention to its settings, notably the next:
Template title, validity interval, and renewal interval from the Normal tab.
Certificates recipient compatibility from the Compatibility tab.
Certificates objective and related checkboxes along with whether or not a non-public secret’s allowed to be exported from the Request Dealing with tab.
Cryptography settings from the Cryptography tab.
The extensions configured from the Extensions tab.
Settings for certificates topic and topic alternate title from the Topic Identify tab.
Assessment the Safety tab for the checklist of Energetic Listing customers and teams which have Enroll or AutoEnroll permissions. The opposite permission settings, which management which AD principals have the flexibility to switch or view the template itself, don’t apply to AWS Non-public CA as a result of IAM authorization is used for these functions.
![Figure 4: Certificate template properties](https://d2908q01vomqb2.cloudfront.net/22d200f8670dbdb3e253a90eee5098477c95c23d/2024/03/18/img4.jpg)
Determine 4: Certificates template properties
After you collect the configuration particulars for the certificates templates which are in lively use, that you must configure equal templates throughout the Connector for AD.
To configure templates within the Connector for AD
Open the AWS Non-public CA console.
Navigate to Non-public CA Connector for AD.
Choose your connector.
Within the Templates part, select Create template.
![Figure 5: Certificate template configuration in the Connector for AD](https://d2908q01vomqb2.cloudfront.net/22d200f8670dbdb3e253a90eee5098477c95c23d/2024/03/18/img5.jpg)
Determine 5: Certificates template configuration within the Connector for AD
You may then start configuring your certificates template through the use of the settings that you simply obtained out of your current AD CS server. For a whole description of the settings which are accessible within the certificates template, see Making a connector template.
![Figure 6: Certificate template settings](https://d2908q01vomqb2.cloudfront.net/22d200f8670dbdb3e253a90eee5098477c95c23d/2024/03/18/img6.jpg)
Determine 6: Certificates template settings
Assign permissions to the template.
You could manually enter the Energetic Listing Safety Identifier (SID) of the consumer or group that you’re assigning the Enroll or Auto-enroll permission to. For directions on find out how to use PowerShell to acquire the SID of an Energetic Listing object, see Managing AD teams and permissions for templates.
We advocate that you simply initially assign your certificates templates to a small take a look at group that incorporates a set of Energetic Listing computer systems or customers that will probably be used to check the brand new CA. When you find yourself assured that the brand new CA points certificates appropriately, you possibly can modify the permissions to incorporate the complete set of Energetic Listing consumer and laptop teams that have been assigned to the template in your authentic AD CS server.
Configure Group Coverage for automated certificates enrollment
With the Connector for AD configured with the required certificates templates, you’re able to configure the AD Group Coverage to allow automated enrollment of consumer and laptop certificates. We advise that you simply begin with a take a look at organizational unit (OU) in Energetic Listing, the place you possibly can put consumer and laptop objects to be sure that enrollment is working correctly. The prevailing AD CS server and the Connector for AD can proceed to coexist till you’re prepared to interchange the certificates.
On this instance, you configure a brand new Group Coverage object that’s linked to an OU known as Check OU, the place you’ll place laptop objects for testing.
To configure a brand new Group Coverage object
Throughout the Group Coverage object, find the settings for controlling enrollment beneath Laptop Configuration > Insurance policies > Home windows Settings > Safety Settings > Public Key Insurance policies.
![Figure 7: Active Directory Group Policy Editor](https://d2908q01vomqb2.cloudfront.net/22d200f8670dbdb3e253a90eee5098477c95c23d/2024/03/18/img7.jpg)
Determine 7: Energetic Listing Group Coverage Editor
Configure the Certificates Providers Shopper – Certificates Enrollment Coverage to level shoppers on the URL of the Connector for AD:
Set the Configuration Mannequin to Enabled.
Add a brand new merchandise to the Certificates enrollment coverage checklist.
![Figure 8: Certificate Services Client Group Policy settings](https://d2908q01vomqb2.cloudfront.net/22d200f8670dbdb3e253a90eee5098477c95c23d/2024/03/18/img8.jpg)
Determine 8: Certificates Providers Shopper Group Coverage settings
Enter the URL of your connector and go away the Authentication mode set to Home windows Built-in. Then select Validate.
Be aware: Yow will discover the URL of your connector within the AWS Non-public CA Connector for AD console beneath Certificates enrollment coverage server endpoint.
![Figure 9: Connector details](https://d2908q01vomqb2.cloudfront.net/22d200f8670dbdb3e253a90eee5098477c95c23d/2024/03/18/img9.jpg)
Determine 9: Connector particulars
After you save your configuration, take away the Energetic Listing Enrollment Coverage from the checklist in order that the Group Coverage solely references the Connector for AD. A accomplished configuration will look just like the next:
![Figure 10: Certificate services client settings with Active Directory enrollment policy removed](https://d2908q01vomqb2.cloudfront.net/22d200f8670dbdb3e253a90eee5098477c95c23d/2024/03/18/img10.jpg)
Determine 10: Certificates providers consumer settings with Energetic Listing enrollment coverage eliminated
From throughout the Group Coverage editor, open the Certificates Providers Shopper – Auto-enrollment coverage to configure auto-enrollment of laptop certificates. Set Configuration Mannequin to Enabled, and choose the next:
Renew expired certificates, replace pending certificates, and take away revoked certificates
Replace certificates that use certificates templates
![Figure 11: Certificate Services client auto-enrollment policy settings](https://d2908q01vomqb2.cloudfront.net/22d200f8670dbdb3e253a90eee5098477c95c23d/2024/03/18/img11.jpg)
Determine 11: Certificates Providers consumer auto-enrollment coverage settings
After you configure the Group Coverage, computer systems in OUs that the Group Coverage is linked to will begin robotically enrolling certificates through the use of AWS Non-public CA, topic to the permissions outlined on the certificates templates. To assessment the progress of certificates enrollment, use non-public CA audit stories.
Once you full testing and acquire confidence in your certificates roll-out, lengthen the scope of the GPO and Energetic Listing permissions on the certificates templates to cowl further customers and computer systems.
Revocation and decommissioning
You may proceed to assessment the Non-public CA audit stories to verify progress with auto-enrollment of certificates from the brand new CA. If in case you have computer systems that sometimes hook up with the community, this will take a while. As a part of this course of, handle your use circumstances that aren’t lined by auto-enrollment, which you recognized out of your preliminary certificates stock. These may embody internet server certificates for inner purposes or code-signing certificates for distributing software program packages. You may problem alternative certificates for these use circumstances through the use of the AWS Non-public CA APIs or CLI with out relying on the Energetic Listing integration. For extra data, see Issuing non-public end-entity certificates.
After the required certificates have been enrolled and you’ve got confirmed that the providers that depend on these certificates are functioning appropriately, it’s time to revoke issued certificates and decommission your current AD CS server. Microsoft supplies detailed documentation for correctly revoking certificates and decommissioning an Enterprise CA, together with clean-up of associated AD objects.
Conclusion
On this publish, we lined some use circumstances for Energetic Listing built-in certificates administration in Home windows environments and launched the brand new AWS Non-public CA Connector for Energetic Listing. AWS Non-public CA and the Connector for AD can assist you cut back operational overhead, enabling you to simplify the method of provisioning certificates whereas sustaining the Energetic Listing integration that you’re accustomed to in a Microsoft AD CS surroundings. You realized find out how to consider your current Microsoft CA and migrate to AWS Non-public CA with the Connector for AD, with a particular deal with auto-enrollment of certificates, which is usually utilized in enterprise environments for system and end-user authentication.
To be taught extra in regards to the providers described within the publish, see the documentation for Connector for AD, AWS Non-public CA , CA greatest practices and AWS Listing Providers. You may get began creating CAs in AWS Non-public CA through the use of the console.
If in case you have suggestions about this publish, submit feedback within the Feedback part beneath. If in case you have questions on this publish, begin a brand new thread on the AWS Certificates Supervisor re:Publish or contact AWS Assist.
[ad_2]
Source link