How To Create ADCS CA Templates For EZCA Integration

Introduction

In this page we will walk you through how to set up your ADCS CA to have an enrollment agent certificate and use that enrollment certificate to issue certificates.

Creating Enrollment Certificate

  1. Open The Certificate Authority management console.
  2. Right click the Certificate Templates Folder. ADCS Setup
  3. Click Manage.
  4. Right click the Enrollment Agent Template ADCS Setup
  5. Select the Duplicate option.
  6. Switch to the General tab.
  7. Change the Name to EZCA Enrollment Agent.
  8. Change validity period to 2 months. ADCS Setup
  9. Navigate to the Security tab.
  10. Click Add.
  11. Click Object Types. ADCS Setup
  12. Add Service Accounts.
  13. Click OK.
  14. Enter the name of your gMSA. Note: if you have not created your gMSA go to the create gMSA section of these docs ADCS Setup
  15. Click OK.
  16. Back in the security tab, make sure the gMSA has read and enroll rights to this template. ADCS Setup
  17. Navigate to the Subject Name tab.
  18. Select the “Supply in the request” option. ADCS Setup
  19. Save the changes and exit the dialog by Clicking the OK button.
  20. Back in the Certificate Authority management console, click on Certificate Templates.
  21. Once in the Certificate Templates page, right click any whitespace and select New > Certificate Template to Issue. ADCS Setup
  22. Select the EZCA Enrollment Template that we just created. ADCS Setup
  23. Your CA can now issue this certificate to the EZCA gMSA. Repeat the last 3 steps on each CA that you want to enable this template.

Create EZCA Test Certificate Template

To ensure high uptime, EZCA will create test certificates in each of the registered CAs every few minutes. To enable this, we will create a short lived template for EZCA to Issue.

  1. Open The Certificate Authority management console.
  2. Right click the Certificate Templates Folder. ADCS Setup
  3. Click Manage.
  4. Right click the Web Server Template ADCS Setup
  5. Select the Duplicate option.
  6. Switch to the General tab.
  7. Change the Name to EZCA Test Template.
  8. Change validity period to 1 hour. ADCS Setup
  9. Navigate to the Security tab.
  10. Click Add.
  11. Click Object Types. ADCS Setup
  12. Add Service Accounts.
  13. Click OK.
  14. Enter the name of your gMSA. Note: if you have not created your gMSA go to the create gMSA section of these docs ADCS Setup
  15. Click OK.
  16. Back in the security tab, make sure the gMSA has read and enroll rights to this template. ADCS Setup
  17. Navigate to the Issuance Requirements tab
  18. Select the option of “This number of authorized signatures” and make sure the number is one.
  19. Change the application policy to the “Certificate Request Agent” ADCS Setup
  20. Save the changes and exit the dialog by Clicking the OK button.
  21. Back in the Certificate Authority management console, click on Certificate Templates.
  22. Once in the Certificate Templates page, right click any whitespace and select New > Certificate Template to Issue. ADCS Setup
  23. Select the EZCA Test Template that we just created. ADCS Setup
  24. Your CA can now issue this certificate to the EZCA gMSA if it signs the request with its enrollment agent certificate. Repeat the last 3 steps on each CA that you want to enable this template.

Modify Certificate Template for EZCA

The final change we have to make to our ADCS configuration is modify the certificate template that you will want EZCA to manage to be able to be issued by EZCA.

  1. Open The Certificate Authority management console.
  2. Right click the Certificate Templates Folder. ADCS Setup
  3. Click Manage.
  4. Right click the template you want to modify
  5. Click properties
  6. Navigate to the Security tab.
  7. Click Add.
  8. Click Object Types. ADCS Setup
  9. Add Service Accounts.
  10. Click OK.
  11. Enter the name of your gMSA. Note: if you have not created your gMSA go to the create gMSA section of these docs ADCS Setup
  12. Click OK.
  13. Back in the security tab, make sure the gMSA has read and enroll rights to this template. ADCS Setup
  14. Navigate to the Issuance Requirements tab
  15. Select the option of “This number of authorized signatures” and make sure the number is one.
  16. Change the application policy to the “Certificate Request Agent” ADCS Setup
  17. Save the changes and exit the dialog by Clicking the OK button.
  18. Now EZCA will be able to issue certificates for this template.

How to Enable Revocation in Active Directory Certificate Services (ADCS)

EZCA will need to revoke certificates that it issues. To enable this, you will need to enable revocation in your ADCS configuration.

  1. Open The Certificate Authority management console.
  2. Right click the Certificate Authority Name. ADCS Setup Revocation for Smartcards
  3. Click Properties.
  4. Navigate to the Security tab.
  5. Click Add.
  6. Click Object Types. SmartCard Template Permissions
  7. Add Service Accounts.
  8. Click OK.
  9. Enter the name of your gMSA.
  10. Click OK.
  11. Back in the security tab, make sure the gMSA has “Issue and Manage Certificates” and “Request Certificates” rights. SmartCard Template
  12. Click OK.