How to integrate with a Microsoft CA

  • 2 minute(s) read
Prev Next

This document provides information on how to integrate with a Microsoft certificate authority. For more information about the Microsoft certificate authority fields, see Certificate authorities.

Requirements

Info
  • If you don’t want to provide granular non-administrative access as per the permissions, you can grant local administrator permission on the Microsoft CA. However, this practice isn’t recommended as it grants excessive privileges, increasing the attack surface and potentially compromising the security of the system. It’s crucial to minimize privileges to ensure the principle of least privilege and protect sensitive information.
  • The following procedures were tested and validated in Windows Server 2019.

Enable permissions on the CA

  1. On the CA object, click Properties > Security.
  2. Enable the Request certificate permission.
  3. Grant permission to the service user on the certificate template that will be used by CLM to sign certificates.
    1. Open the CA console.
    2. Click Certificate Templates > Manage.
    3. In the new console, find the template and click Properties.
    4. Go to the Security tab and add the service user you want to grant permission by clicking on the Enroll checkbox.
    5. Click OK to save the changes.

Provide access to WinRM resources

  1. Open the command prompt and run the following commands:
    1. winrm configSDDL default
      1. After running the command, select the Execute permission in the Allow column.
    2. Set-PSSessionConfiguration -Name Microsoft.PowerShell -ShowSecurityDescriptorUI
      1. After running the command, select the Full Control (All Operations) permission in the Allow column.

Provide access to the WMI namespace

  1. Open Windows’ Run command, type wmimgmt.msc and press enter.
  2. In the WmiMgmt console, click Properties under WMIControl (Local).
  3. In the Security tab, select Root and click Security to configure permissions.
  4. Add the Remote Management Users group to the groups or user names section.
  5. Select the added group and click Advanced to access the advanced security settings.
  6. Edit the permissions to apply to “This namespace and sub namespaces”.
  7. Check the following permissions:
    1. Execute Methods
    2. Enable Account
    3. Remote Enable

Integrate with a Microsoft CA

  1. On Segura, in the navigation bar, hover over the Products menu and select Certificate Manager.
  2. In the side menu, select Management > Authorities > Certificate authorities.
  3. In the top right corner, click Add, and select Microsoft CA.
  4. In the Name * field, enter a name to identify the CA.
  5. Select the button Status to activate or deactivate the CA.
  6. In the IP for connection with CA * field, enter the IP address of the connection.
  7. In the CA host name * field, enter the CA host name.
    1. To obtain the CA full host name, run the certutil command in the Microsoft CA server and copy the value of the Config line.
  8. In the Plugin for connection * field, select the plugin for connection.
  9. In the Port field, enter the port for connection.
  10. In the Access credential * field, select the access credential.
  11. Click Save.