Windows Server 2008 PKI Marc Grote 3/28/2017 8:11 PM Windows Server 2008 PKI Marc Grote Telta Citynetz Eberswalde + IT Training Grote © 2007 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Inhalte Bestandteile einer PKI CA-Hierarchien Windows 2008 PKI CA-Arten Zertifikatvorlagen Certificate Lifecycle Manager OCSP / CRL Schlüssel Archivierung CA-Konsole Certutil PKI Health

Was ist eine PKI Als Public-Key-Infrastruktur bezeichnet man in der Kryptologie und Kryptografie ein System, welches es ermöglicht, digitale Zertifikate auszustellen, zu verteilen und zu prüfen. Die ausgestellten Zertifikate werden zur Absicherung computergestützter Kommunikation verwendet.

Einsatzgebiete Smartcards E-Mail Signatur und –Verschlüsselung IPSec PPTP EAP-TLS L2TP/IPSec SSL / TLS EFS Code Signatur

Bestandteile einer PKI Digitale Zertifikate Certification Authority Registration Authority Certificate Revocation Lists Verzeichnisdienst Validierungsdienst

CA-Hierarchien

Windows Server 2008 CA Windows Server 2008 Standard Alle Basisfunktionen einer Windows 2003 PKI Später erwähnte Erweiterungen Windows 2008 Enterprise und Datacenter Schlüssel Archivierung und Wiederherstellung V3 Certificate Templates ausstellen Role Separation (ISIS-MTT) OCSP / SCEP Unterstützung

Windows Server 2008 PKI Versionen Funktion Standard Edition Enterprise Edition Erweiterte Kryptografie-Unterstützung Ja Failover Cluster Unterstützung Enterprise PKI (PKIview) Rollenbasierte Installation Upgrademöglichkeiten Von Standard CA Von Standard oder Enterprise CA Unbeaufsichtigte Installation V3 Zertifikatvorlagen Nein

Windows Server 2008 PKI Versionen Funktion Standard Edition Enterprise Edition Einschränkung von Registrierungs-Agenten Nein Ja Einschränkungen der Zertifikat-Verwaltung Erweiterungen der Schlüsselarchivierung SCEP OCSP

Windows Server 2008 CA-Arten Stammzertifizierungsstelle des Unternehmens Untergeordnete Zertifizierungsstelle des Unternehmens Eigenständige Stammzertifizierungsstelle Eigenständige untergeordnete Zertifizierungsstelle

Was ist neu? Cryptography Next Generation (CNG) Online Certificate Status Protocol Support Network Device Enrollment Service Web Enrollment Erweiterungen Neue Gruppenrichtlinieneinstellungen Restricted Enrollment Agent Enterprise PKI (PKIView)

CNG – Crypto Next Generation Installation von zusätzlichen CSP Möglichkeit zur Nutzung eigener CSP Unterstützung für Kernel Mode Betrieb FIPS 140-2 Level 2 mit CC (Common Criteria) Unterstützung für alle CryptoAPI 1.0 Algorithmen Unterstützung für Elliptic Curve Cryptography (ECC)

Suite B - Algorithmen Elliptic Curve Cryptography (ECC) Hash: SHA2 ECDSA_P256, ECDSA_P384, ECDSA_P521 ECDH_P256, ECDH_P384, ECDH_P521 Hash: SHA2 SHA256, SHA384, SHA512 Symmetrisch: AES AES128, AES192, AES256

Installation

Demo { Installation } 3/28/2017 8:11 PM © 2007 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Verwaltung CA-Konsole Server Manager Zertifikatvorlagen Certutil.exe Webkonsole (http://caserver/certsrv) PKIview.msc (CA Health) KRT.EXE (W2K3 Reskit) Microsoft Certificate Lifecycle Manager

Demo { Verwaltung} 3/28/2017 8:11 PM © 2007 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Zertifikatvorlagen Version 1 Zertifikatvorlagen Windows 2000 / 2003 Standard CA Version 2 Zertifikatvorlagen Windows Server 2003 Enterprise CA, Windows Server 2008 Standard und Enterprise CA Version 3 Zertifikatvorlagen Windows Server 2008 Enterprise CA

Autoenrollment Zertifikate werden automatisch mit Hilfe von Gruppenrichtlinien auf den Clients „ausgerollt“ Anpassung der Zertifikatsvorlagen + Berechtigungen + GPO Einstellung Windows 2000 CA Nur für Computer Windows 2003/Windows 2008 CA Computer und Benutzer (Windows XP und Windows Vista)

Neue Enrollment API Problem Alte API war schwer zu verwalten und zu benutzen Lösung Ablösung der xenroll.dll und scrdernl.dll Neue API COM basiert Entwickler freundlich – Einfach zu implementieren Funktionen können gescripted werden

{ Gruppenrichtlinien} 3/28/2017 8:11 PM { Gruppenrichtlinien} Demo © 2007 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Schlüsselarchivierung und -Wiederherstellung CA muss für KA aktiviert werden KRA – Key Recovery Agent Certificate Zertifikatvorlagen müssen für Schlüsselarchivierung eingerichtet sein Wiederherstellung mit CERTUTIL.EXE oder KRT.EXE Export in .PFX Datei Sicherer Transfer zum Benutzer

Beantragen eines KRA-Zertifikats Aufgrund der Brisanz der Schlüsselwiederherstellungsagenten wird das Zertifikat nicht sofort ausgestellt, sondern muss vom CA-Verwalter ausgestellt werden

Wiederherstellung archivierter Schlüssel

Role Separation

OCSP Das Online Certificate Status Protocol ist ein Internet-Protokoll, das es Clients ermöglicht, den Status von X.509-Zertifikaten bei einem Validierungsdienst abzufragen. Mittels OCSP kann der Status eines Zertifikats durch Anfrage bei einem OSCP-Responder abgefragt werden.

OCSP-Responder Der OCSP-Responder liefert als Antwort „good“ (Zertifikat ist gültig und nicht gesperrt) oder „revoked“ (Zertifikat ist gesperrt) oder „unknown“ (Zertifikat ist unbekannt)

3/28/2017 8:11 PM { OCSP } Demo © 2007 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

CRL – Certificate Revocation List CRL = Zertifikatsperrliste Eine einfache Tabelle welche widerrufene oder abgelaufene Zertifikate einer Zertifizierungsstelle enthält Clients / Applikationen rufen in bestimmten Intervallen vollständige oder Delta-Sperrlisten ab

CRL – Certificate Revocation List

OCSP versus CRL Vorteile OCSP Nachteile OCSP OCSP-Responder sind zeitgenauer als Sperrlisten OCSP kann nicht gesperrte von gefälschten Zertifikaten unterscheiden Nachteile OCSP OCSP liefert nur Auskünfte zum Sperrstatus von Zertifikaten

OCSP versus CRL Vorteile CRL Nachteile CRL Einfache Implementierung Relativ weit verbreitet auf der Client-Seite Nachteile CRL Sperrlisten sind nur Negativlisten und prüfen nicht die Zertifikatsgültigkeit Sperrlisten können sehr gross werden. Sperrlisten können veraltet sein, da keine Online-Abfrage erfolgt

PKI Health Ehemals Bestandteil des Windows Server 2003 Ressource Kit Bestandteil der AD CS Rolle

Demo { PKI Health} 3/28/2017 8:11 PM © 2007 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

CAPI 2 Diagnostics Überwachung aller relevanten CryptoAPI-Operationen Überwachung muss manuell aktiviert werden Event Viewer – Applications and Services Logs – Microsoft – Windows – CAPI2 - Operational CryptoAPI1 und 2 Unterstützung

Demo { CAPI2 Diagnostics} 3/28/2017 8:11 PM © 2007 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Certificate Lifecylce Manager Identity Management Solution Nachfolger des MIIS Vereinfachte Verwaltung von Zertifikaten Vereinfachte Smartcard-Verwaltung Self Service Portal Vollständige Active Directory Integration

{ Certificate Lifecylce Manager } 3/28/2017 8:11 PM { Certificate Lifecylce Manager } Demo © 2007 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

PKI Links Windows PKI blog http://blogs.technet.com/pki Technology Centers - Public Key Infrastructure for Windows Server 2003 http://www.microsoft.com/windowsserver2003/technologies/pki/default.mspx Cryptography API: Next Generation http://msdn2.microsoft.com/en-us/library/Aa376210

3/28/2017 8:11 PM © 2007 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION. © 2007 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Windows Server 2008 weitere Ressourcen 3/28/2017 8:11 PM Windows Server 2008 weitere Ressourcen Windows Server 2008 Tech Center http://www.microsoft.com/germany/technet/prodtechnol/windowsserver/2008/default.mspx Windows Server 2008 Webcasts: http://www.microsoft.com/germany/technet/webcasts/windowsserver2008.mspx Windows Server 2008 Produktseite: http://www.microsoft.com/germany/windowsserver2008/default.mspx Microsoft Virtualization: http://www.microsoft.com/virtualization/default.mspx © 2007 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Ask the Experts Wir freuen uns auf Ihre Fragen: Technische Experten stehen Ihnen während der gesamten Veranstaltung in der Haupthalle zur Verfügung.