How to make a stand-alone certification authority that is running Windows Server 2003 with Service Pack 1 or an x64-based version of Windows Server 2003 compliant with ISIS-MTT version 1.1
IN THIS TASK
To make the Windows certification authority (CA) compliant with ISIS-MTT version 1.1, you must complete specific configuration steps. This step-by-step article describes how to enroll certificates that comply with the ISIS-MTT requirements for a stand-alone CA.
Note Your CA must be a server that is running Microsoft Windows Server 2003 Service Pack 1 (SP1), an x64-based version of Windows Server 2003, or a later version of Windows.
Important The configuration changes that are documented in this article must be applied to the CA that enrolls the certificate. In a PKI topology, this is the parent CA of the certificate requester. If a CA certificate is requested from a subordinate CA, the type of CA that requests the certificate is not relevant.
Use the step-by-step directions in this article if the following conditions are true:
- The issuing CA issues ISIS-MTT-compliant certificates to subordinate CAs or to end-entities.
- The issuing CA takes one of the following roles:
- Stand-alone root CA
- Stand-alone subordinate CA
- Configure the issuing CA to force UTF8 encoding.
- Mark the key usage attribute as critical during certificate submission processing.
- For CA certificates, omit the digital signature entry in the key usage section.
Enforce UTF8 encodingAfter you configure a CA to force UTF8 encoding, the UTF8 setting applies to all certificates that are issued with this CA. At the CA that must issue ISIS-MTT-compliant certificates, follow these steps:
- Click Start, click Run, type cmd, and then click OK.
- Type the following, and then press ENTER: certutil -setreg ca\forceteletex +0x20This command sets the flag so that the CA always encodes the subject with UTF8.
- To stop and then restart the CA service, type the following at a command prompt. Press ENTER after each command.net stop "certificate services"net start "certificate services"
- Type the following at a command prompt, and then press ENTER: certutil -setreg ca\forceteletex -0x20
- To stop and then restart the CA service, type the following commands. Press ENTER after each command.net stop "certificate services"net start "certificate services"
back to the top
Submit the certificate requestBecause stand-alone CAs do not support certificate templates, the key properties must be set during certificate request processing. To do this, follow these steps:
- On the issuing CA, click Start, point to Administrative Tools, and then click Certification Authority.
- Right-click your certificate, and then click Properties.
- Click the Policy Module tab, and then click Properties.
- Click Set the certificate request status to pending. The administrator must explicitly issue the certificate, and then click OK.
- Create a certificate request file to use with the subordinate CA or with the end-entity.
- On the subordinate CA or end-entity, submit the certificate request to the stand-alone CA. To do this, use one of the following methods.
Method 1: Submit the CA by using a Web interfaceFor information about how to submit the CA by using a Web interface, visit the following Microsoft Web site, and then see "To request a certificate from a Windows Server 2003 CA using a PKCS #10 or PKCS #7 file":http://technet2.microsoft.com/windowsserver/en/library/7E918937-B0CC-4094-9009-4E0798986BEF1033.mspx
Method 2: Submit the CA by using the Certreq command
- At a command prompt, type certreq -submit Path_To_Request_File\Certificate_Request_Filename, and then click OK.
- In the Select a certification authority (CA) you want to use list, click the certificate request file from your issuing CA, and then click OK.
- Note the certificate Request-ID that is returned.
Note The ISIS-MTT standard requires that the name of a CA contain the following distinguished name attributes:
- countryName (c)
- organizationName (o)
back to the top
Change the key usage, and then mark it as criticalBy default, the setting for key usage of CA certificates in Windows is different from the setting for key usage of CA certificates in ISIS-MTT. A CA certificate that is compliant with ISIS-MTT carries the following key usage:
To modify the pending CA certificate request to set the key usage and to mark it as critical, type the following at a command prompt, and then press ENTER:
back to the top
Leave the default key usage, but mark it as criticalUse this method only if the key usage was not changed and must be set to critical.
To do this, type the following at a command prompt, and the press ENTER:
back to the top
Issue and verify the certificate
- Issue the pending request.
- To verify that the certificate was created correctly, type the following command at a command prompt, and then press ENTER: certutil -v Path_Of_File/Certificate_File
- View the file output to make sure that the common name is formatted as CERT_RDN_UTF8_STRING.
- Make sure that the key usage is set correctly.
- Make sure that the Critical flag is set for the key usage object identifier 22.214.171.124.
Interpret key usageThe key usage is represented as a bit string. The first byte is the encoding of the bit string type. This is static 03. The second bit defines the length of the value and is set to 02. The following bits represent the actual value of the bit string where 01 is fixed. The key usage values are defined in the Wincrypt.h include file as follows:
#define CERT_NON_REPUDIATION_KEY_USAGE 0x40
#define CERT_KEY_ENCIPHERMENT_KEY_USAGE 0x20
#define CERT_DATA_ENCIPHERMENT_KEY_USAGE 0x10
#define CERT_KEY_AGREEMENT_KEY_USAGE 0x08
#define CERT_KEY_CERT_SIGN_KEY_USAGE 0x04
#define CERT_OFFLINE_CRL_SIGN_KEY_USAGE 0x02
#define CERT_CRL_SIGN_KEY_USAGE 0x02
#define CERT_ENCIPHER_ONLY_KEY_USAGE 0x01
back to the top
Technical support for Windows x64 editionsYour hardware manufacturer provides technical support and assistance for Microsoft Windows x64 editions. Your hardware manufacturer provides support because a Windows x64 edition was included with your hardware. Your hardware manufacturer might have customized the Windows x64 edition installation with unique components. Unique components might include specific device drivers or might include optional settings to maximize the performance of the hardware. Microsoft will provide reasonable-effort assistance if you need technical help with your Windows x64 edition. However, you might have to contact your manufacturer directly. Your manufacturer is best qualified to support the software that your manufacturer installed on the hardware.
For product information about Microsoft Windows XP Professional x64 Edition, visit the following Microsoft Web site:
Article ID: 888180 - Last Review: 10/11/2007 02:32:42 - Revision: 4.4
- kbwinservds kbactivedirectory kbcertservices kbhowtomaster kbinfo KB888180