Windows Server 2008 PKI Marc Grote

Präsentation zum Thema: "Windows Server 2008 PKI Marc Grote"—  Präsentation transkript:

1 Windows Server 2008 PKI Marc Grote
3/28/2017 8:11 PM Windows Server 2008 PKI Marc Grote Telta Citynetz Eberswalde + IT Training Grote © 2007 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

2 Inhalte Bestandteile einer PKI CA-Hierarchien Windows 2008 PKI
CA-Arten Zertifikatvorlagen Certificate Lifecycle Manager OCSP / CRL Schlüssel Archivierung CA-Konsole Certutil PKI Health

3 Was ist eine PKI Als Public-Key-Infrastruktur bezeichnet man in der Kryptologie und Kryptografie ein System, welches es ermöglicht, digitale Zertifikate auszustellen, zu verteilen und zu prüfen. Die ausgestellten Zertifikate werden zur Absicherung computergestützter Kommunikation verwendet.

4 Einsatzgebiete Smartcards E-Mail Signatur und –Verschlüsselung IPSec
PPTP EAP-TLS L2TP/IPSec SSL / TLS EFS Code Signatur

5 Bestandteile einer PKI
Digitale Zertifikate Certification Authority Registration Authority Certificate Revocation Lists Verzeichnisdienst Validierungsdienst

6 CA-Hierarchien

7 Windows Server 2008 CA Windows Server 2008 Standard
Alle Basisfunktionen einer Windows 2003 PKI Später erwähnte Erweiterungen Windows 2008 Enterprise und Datacenter Schlüssel Archivierung und Wiederherstellung V3 Certificate Templates ausstellen Role Separation (ISIS-MTT) OCSP / SCEP Unterstützung

8 Windows Server 2008 PKI Versionen
Funktion Standard Edition Enterprise Edition Erweiterte Kryptografie-Unterstützung Ja Failover Cluster Unterstützung Enterprise PKI (PKIview) Rollenbasierte Installation Upgrademöglichkeiten Von Standard CA Von Standard oder Enterprise CA Unbeaufsichtigte Installation V3 Zertifikatvorlagen Nein

9 Windows Server 2008 PKI Versionen
Funktion Standard Edition Enterprise Edition Einschränkung von Registrierungs-Agenten Nein Ja Einschränkungen der Zertifikat-Verwaltung Erweiterungen der Schlüsselarchivierung SCEP OCSP

10 Windows Server 2008 CA-Arten
Stammzertifizierungsstelle des Unternehmens Untergeordnete Zertifizierungsstelle des Unternehmens Eigenständige Stammzertifizierungsstelle Eigenständige untergeordnete Zertifizierungsstelle

11 Was ist neu? Cryptography Next Generation (CNG)
Online Certificate Status Protocol Support Network Device Enrollment Service Web Enrollment Erweiterungen Neue Gruppenrichtlinieneinstellungen Restricted Enrollment Agent Enterprise PKI (PKIView)

12 CNG – Crypto Next Generation
Installation von zusätzlichen CSP Möglichkeit zur Nutzung eigener CSP Unterstützung für Kernel Mode Betrieb FIPS Level 2 mit CC (Common Criteria) Unterstützung für alle CryptoAPI 1.0 Algorithmen Unterstützung für Elliptic Curve Cryptography (ECC)

13 Suite B - Algorithmen Elliptic Curve Cryptography (ECC) Hash: SHA2
ECDSA_P256, ECDSA_P384, ECDSA_P521 ECDH_P256, ECDH_P384, ECDH_P521 Hash: SHA2 SHA256, SHA384, SHA512 Symmetrisch: AES AES128, AES192, AES256

14 Installation

15 Demo { Installation } 3/28/2017 8:11 PM
© 2007 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

16 Verwaltung CA-Konsole Server Manager Zertifikatvorlagen Certutil.exe
Webkonsole ( PKIview.msc (CA Health) KRT.EXE (W2K3 Reskit) Microsoft Certificate Lifecycle Manager

17 Demo { Verwaltung} 3/28/2017 8:11 PM
© 2007 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

18 Zertifikatvorlagen Version 1 Zertifikatvorlagen
Windows 2000 / 2003 Standard CA Version 2 Zertifikatvorlagen Windows Server 2003 Enterprise CA, Windows Server 2008 Standard und Enterprise CA Version 3 Zertifikatvorlagen Windows Server 2008 Enterprise CA

19 Autoenrollment Zertifikate werden automatisch mit Hilfe von Gruppenrichtlinien auf den Clients „ausgerollt“ Anpassung der Zertifikatsvorlagen + Berechtigungen + GPO Einstellung Windows 2000 CA Nur für Computer Windows 2003/Windows 2008 CA Computer und Benutzer (Windows XP und Windows Vista)

20 Neue Enrollment API Problem
Alte API war schwer zu verwalten und zu benutzen Lösung Ablösung der xenroll.dll und scrdernl.dll Neue API COM basiert Entwickler freundlich – Einfach zu implementieren Funktionen können gescripted werden

21 { Gruppenrichtlinien}
3/28/2017 8:11 PM { Gruppenrichtlinien} Demo © 2007 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

22 Schlüsselarchivierung und -Wiederherstellung
CA muss für KA aktiviert werden KRA – Key Recovery Agent Certificate Zertifikatvorlagen müssen für Schlüsselarchivierung eingerichtet sein Wiederherstellung mit CERTUTIL.EXE oder KRT.EXE Export in .PFX Datei Sicherer Transfer zum Benutzer

23 Beantragen eines KRA-Zertifikats
Aufgrund der Brisanz der Schlüsselwiederherstellungsagenten wird das Zertifikat nicht sofort ausgestellt, sondern muss vom CA-Verwalter ausgestellt werden

24 Wiederherstellung archivierter Schlüssel

25 Role Separation

26 OCSP Das Online Certificate Status Protocol ist ein Internet-Protokoll, das es Clients ermöglicht, den Status von X.509-Zertifikaten bei einem Validierungsdienst abzufragen. Mittels OCSP kann der Status eines Zertifikats durch Anfrage bei einem OSCP-Responder abgefragt werden.

27 OCSP-Responder Der OCSP-Responder liefert als Antwort „good“ (Zertifikat ist gültig und nicht gesperrt) oder „revoked“ (Zertifikat ist gesperrt) oder „unknown“ (Zertifikat ist unbekannt)

28 3/28/2017 8:11 PM { OCSP } Demo © 2007 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

29 CRL – Certificate Revocation List
CRL = Zertifikatsperrliste Eine einfache Tabelle welche widerrufene oder abgelaufene Zertifikate einer Zertifizierungsstelle enthält Clients / Applikationen rufen in bestimmten Intervallen vollständige oder Delta-Sperrlisten ab

30 CRL – Certificate Revocation List

31 OCSP versus CRL Vorteile OCSP Nachteile OCSP
OCSP-Responder sind zeitgenauer als Sperrlisten OCSP kann nicht gesperrte von gefälschten Zertifikaten unterscheiden Nachteile OCSP OCSP liefert nur Auskünfte zum Sperrstatus von Zertifikaten

32 OCSP versus CRL Vorteile CRL Nachteile CRL Einfache Implementierung
Relativ weit verbreitet auf der Client-Seite Nachteile CRL Sperrlisten sind nur Negativlisten und prüfen nicht die Zertifikatsgültigkeit Sperrlisten können sehr gross werden. Sperrlisten können veraltet sein, da keine Online-Abfrage erfolgt

33 PKI Health Ehemals Bestandteil des Windows Server 2003 Ressource Kit
Bestandteil der AD CS Rolle

34 Demo { PKI Health} 3/28/2017 8:11 PM
© 2007 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

35 CAPI 2 Diagnostics Überwachung aller relevanten CryptoAPI-Operationen
Überwachung muss manuell aktiviert werden Event Viewer – Applications and Services Logs – Microsoft – Windows – CAPI2 - Operational CryptoAPI1 und 2 Unterstützung

36 Demo { CAPI2 Diagnostics} 3/28/2017 8:11 PM
© 2007 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

37 Certificate Lifecylce Manager
Identity Management Solution Nachfolger des MIIS Vereinfachte Verwaltung von Zertifikaten Vereinfachte Smartcard-Verwaltung Self Service Portal Vollständige Active Directory Integration

38 { Certificate Lifecylce Manager }
3/28/2017 8:11 PM { Certificate Lifecylce Manager } Demo © 2007 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

39 PKI Links Windows PKI blog http://blogs.technet.com/pki
Technology Centers - Public Key Infrastructure for Windows Server Cryptography API: Next Generation

40 3/28/2017 8:11 PM © 2007 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION. © 2007 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

41 Windows Server 2008 weitere Ressourcen
3/28/2017 8:11 PM Windows Server 2008 weitere Ressourcen Windows Server 2008 Tech Center Windows Server 2008 Webcasts: Windows Server 2008 Produktseite: Microsoft Virtualization: © 2007 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

42 Ask the Experts Wir freuen uns auf Ihre Fragen: Technische Experten stehen Ihnen während der gesamten Veranstaltung in der Haupthalle zur Verfügung.