diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust-validate-pki.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust-validate-pki.md new file mode 100644 index 0000000000..05245e0de6 --- /dev/null +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust-validate-pki.md @@ -0,0 +1,95 @@ +--- +title: Configure and validate the Public Key Infrastructure in an on-premises certificate trust model +description: Configure and validate the Public Key Infrastructure when deploying Windows Hello for Business in a certificate trust model. +ms.date: 01/03/2023 +appliesto: +- ✅ Windows 10 and later +- ✅ Windows Server 2016 and later +ms.topic: tutorial +--- +# Configure and validate the Public Key Infrastructure - on-premises certificate trust + +[!INCLUDE [hello-on-premises-key-trust](./includes/hello-on-premises-cert-trust.md)] + +Windows Hello for Business must have a Public Key Infrastructure (PKI) when using the *key trust* or *certificate trust* models. The domain controllers must have a certificate, which serves as a root of trust for clients. The certificate ensures that clients don't communicate with rogue domain controllers. + + Hybrid certificate trust deployments issue users with a sign-in certificate that enables them to authenticate using Windows Hello for Business credentials to the domain controllers. Additionally, hybrid certificate trust deployments issue certificates to registration authorities to provide defense-in-depth security when issuing user authentication certificates. + +## Deploy an enterprise certification authority + +This guide assumes most enterprises have an existing public key infrastructure. Windows Hello for Business depends on an enterprise PKI running the Windows Server *Active Directory Certificate Services* role. + +### Lab-based PKI + +The following instructions may be used to deploy simple public key infrastructure that is suitable **for a lab environment**. + +Sign in using *Enterprise Administrator* equivalent credentials on a Windows Server where you want the certification authority (CA) installed. + +>[!NOTE] +>Never install a certification authority on a domain controller in a production environment. + +1. Open an elevated Windows PowerShell prompt +1. Use the following command to install the Active Directory Certificate Services role. + ```PowerShell + Add-WindowsFeature Adcs-Cert-Authority -IncludeManagementTools + ``` +3. Use the following command to configure the CA using a basic certification authority configuration + ```PowerShell + Install-AdcsCertificationAuthority + ``` + +## Configure the enterprise PKI + +If you don't have an existing PKI, review [Certification Authority Guidance](/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/hh831574(v=ws.11)) to properly design your infrastructure. Then, consult the [Test Lab Guide: Deploying an AD CS Two-Tier PKI Hierarchy](/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/hh831348(v=ws.11)) for instructions on how to configure your PKI using the information from your design session. + +Expand the following sections to configure the PKI for Windows Hello for Business. + +
+ +[!INCLUDE [dc-certificate-template](includes/dc-certificate-template.md)] + +
+ +[!INCLUDE [dc-certificate-template-supersede](includes/dc-certificate-supersede.md)] + +
+ +[!INCLUDE [web-server-certificate-template](includes/web-server-certificate-template.md)] + +
+
+Unpublish Superseded Certificate Templates + +[!INCLUDE [unpublish-superseded-templates](includes/unpublish-superseded-templates.md)] + +
+ +
+
+Publish certificate templates to the CA + +A certification authority can only issue certificates for certificate templates that are published to it. If you have more than one CA, and you want more CAs to issue certificates based on the certificate template, then you must publish the certificate template to them. + +Sign in to the CA or management workstations with **Enterprise Admin** equivalent credentials. + +1. Open the **Certification Authority** management console +1. Expand the parent node from the navigation pane +1. Select **Certificate Templates** in the navigation pane +1. Right-click the **Certificate Templates** node. Select **New > Certificate Template** to issue +1. In the **Enable Certificates Templates** window, select the *Domain Controller Authentication (Kerberos)*, and *Internal Web Server* templates you created in the previous steps. Select **OK** to publish the selected certificate templates to the certification authority +1. If you published the *Domain Controller Authentication (Kerberos)* certificate template, then unpublish the certificate templates you included in the superseded templates list + - To unpublish a certificate template, right-click the certificate template you want to unpublish and select **Delete**. Select **Yes** to confirm the operation +1. Close the console + +
+ +## Configure and deploy certificates to domain controllers + +[!INCLUDE [dc-certificate-deployment](includes/dc-certificate-deployment.md)] + +## Validate the configuration + +[!INCLUDE [dc-certificate-validate](includes/dc-certificate-validate.md)] + +> [!div class="nextstepaction"] +> [Next: prepare and deploy AD FS >](hello-key-trust-adfs.md) \ No newline at end of file diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-pki.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-pki.md index 6e820da88a..2e03da09bd 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-pki.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-pki.md @@ -1,89 +1,3 @@ ---- -title: Configuring Hybrid Azure AD joined Windows Hello for Business - Public Key Infrastructure (PKI) -description: Discussing the configuration of the Public Key Infrastructure (PKI) in a Hybrid deployment of Windows Hello for Business -ms.date: 4/30/2021 -appliesto: -- ✅ Windows 10 and later -ms.topic: article ---- - -# Configure Hybrid Azure AD joined Windows Hello for Business - Public Key Infrastructure - -[!INCLUDE [hello-hybrid-key-trust](./includes/hello-hybrid-cert-trust.md)] - -Windows Hello for Business deployments rely on certificates. Hybrid deployments use publicly-issued server authentication certificates to validate the name of the server to which they are connecting and to encrypt the data that flows between them and the client computer. - -All deployments use enterprise issued certificates for domain controllers as a root of trust. Hybrid certificate trust deployments issue users with a sign-in certificate that enables them to authenticate using Windows Hello for Business credentials to non-Windows Server 2016 domain controllers. Additionally, hybrid certificate trust deployments issue certificates to registration authorities to provide defense-in-depth security when issuing user authentication certificates. - -## Certificate Templates - -This section has you configure certificate templates on your Windows Server 2012 (or later) Active Directory Certificate Services issuing certificate authority. - -### Domain Controller certificate template - -Clients need to trust domain controllers and the best way to do this is to ensure each domain controller has a Kerberos Authentication certificate. Installing a certificate on the domain controller enables the Key Distribution Center (KDC) to prove its identity to other members of the domain. This provides clients a root of trust external to the domain - namely the enterprise certificate authority. - -Domain controllers automatically request a domain controller certificate (if published) when they discover an enterprise certificate authority is added to Active Directory. However, certificates based on the *Domain Controller* and *Domain Controller Authentication* certificate templates do not include the **KDC Authentication** object identifier (OID), which was later added to the Kerberos RFC. Inclusion of the **KDC Authentication** OID in domain controller certificate is not required for key trust authentication from Hybrid Azure AD-joined devices. The OID is required for enabling authentication with Windows Hello for Business to on-premises resources by Azure AD-joined devices. The steps below to *Create a Domain Controller Authentication (Kerberos) Certificate Template* and *Configure Certificate Superseding for the Domain Controller Authentication (Kerberos) Certificate Template* to include the **KDC Authentication** OID in the domain controller certificate may be skipped if you only have Hybrid Azure AD Joined devices in your environment, but we recommend completing these steps if you are considering adding Azure AD-joined devices to your environment in the future. - -By default, the Active Directory Certificate Authority provides and publishes the Kerberos Authentication certificate template. However, the cryptography configuration included in the provided template is based on older and less performant cryptography APIs. To ensure domain controllers request the proper certificate with the best available cryptography, use the **Kerberos Authentication** certificate template as a baseline to create an updated domain controller certificate template. - -#### Create a Domain Controller Authentication (Kerberos) Certificate Template - -Sign-in a certificate authority or management workstations with _Domain Admin_ equivalent credentials. - -1. Open the **Certification Authority** management console. - -2. Right-click **Certificate Templates** and click **Manage**. - -3. In the **Certificate Template Console**, right-click the **Kerberos Authentication** template in the details pane and click **Duplicate Template**. - -4. On the **Compatibility** tab, clear the **Show resulting changes** check box. Select **Windows Server 2008 R2** from the **Certification Authority** list. Select **Windows 7.Server 2008 R2** from the **Certificate Recipient** list. - -5. On the **General** tab, type **Domain Controller Authentication (Kerberos)** in Template display name. Adjust the validity and renewal period to meet your enterprise's needs. - - > [!NOTE] - > If you use different template names, you'll need to remember and substitute these names in different portions of the lab. - -6. On the **Subject** tab, select the **Build from this Active Directory information** button if it is not already selected. Select **None** from the **Subject name format** list. Select **DNS name** from the **Include this information in alternate subject** list. Clear all other items. - -7. On the **Cryptography** tab, select **Key Storage Provider** from the **Provider Category** list. Select **RSA** from the **Algorithm name** list. Type **2048** in the **Minimum key size** text box. Select **SHA256** from the **Request hash** list. Click **OK**. - -8. Close the console. - -#### Configure Certificate Superseding for the Domain Controller Authentication (Kerberos) Certificate Template - -Many domain controllers may have an existing domain controller certificate. Active Directory Certificate Services provides a default certificate template for domain controllers--the Domain Controller certificate template. Later releases provided a new certificate template--the Domain Controller Authentication certificate template. These certificate templates were provided prior to update of the Kerberos specification that stated Key Distribution Centers (KDCs) performing certificate authentication needed to include the **KDC Authentication** extension. - -The Kerberos Authentication certificate template is the most current certificate template designated for domain controllers, and should be the one you deploy to all your domain controllers (2008 or later). - -The auto-enrollment feature in Windows enables you to effortlessly replace these domain controller certificates. You can use the following configuration to replace older domain controller certificates with a new certificate based on the Kerberos Authentication certificate template. - -Sign-in a certificate authority or management workstations with _Enterprise Admin_ equivalent credentials. - -1. Open the **Certification Authority** management console. - -2. Right-click **Certificate Templates** and click **Manage**. - -3. In the **Certificate Template Console**, right-click the **Domain Controller Authentication (Kerberos)** (or the name of the certificate template you created in the previous section) template in the details pane and click **Properties**. - -4. Click the **Superseded Templates** tab. Click **Add**. - -5. From the **Add Superseded Template** dialog, select the **Domain Controller** certificate template and click **OK**. Click **Add**. - -6. From the **Add Superseded Template** dialog, select the **Domain Controller Authentication** certificate template and click **OK**. - -7. From the **Add Superseded Template dialog**, select the **Kerberos Authentication** certificate template, and click **OK**. - -8. Add any other enterprise certificate templates that were previously configured for domain controllers to the **Superseded Templates** tab. - -9. Click **OK** and close the **Certificate Templates** console. - -The certificate template is configured to supersede all the certificate templates listed in the superseded templates list. However, the certificate template and the superseding of certificate templates is not active until you publish the certificate template to one or more certificate authorities. - -> [!NOTE] -> A domain controller's certificate must chain to a certificate in the NTAuth store in Active Directory. By default, online "Enterprise" Active Directory Certificate Authority certificates are added to the NTAuth store at installation time. If you are using a third-party CA, this is not done by default. If the domain controller certificate does not chain to a trusted CA in the NTAuth store, user authentication will fail. -> You can view an AD forest's NTAuth store (NTAuthCertificates) using PKIVIEW.MSC from an ADCS CA. Open PKIView.msc, then click the Action menu -> Manage AD Containers. - ### Enrollment Agent certificate template Active Directory Federation Server used for Windows Hello for Business certificate enrollment performs its own certificate lifecycle management. Once the registration authority is configured with the proper certificate template, the AD FS server attempts to enroll the certificate on the first certificate request, or when the service first starts. diff --git a/windows/security/identity-protection/hello-for-business/includes/dc-certificate-supersede.md b/windows/security/identity-protection/hello-for-business/includes/dc-certificate-supersede.md index 84d5d061fa..d70b292d62 100644 --- a/windows/security/identity-protection/hello-for-business/includes/dc-certificate-supersede.md +++ b/windows/security/identity-protection/hello-for-business/includes/dc-certificate-supersede.md @@ -3,6 +3,9 @@ ms.date: 12/28/2022 ms.topic: include --- +
+Supersede existing domain controller certificates + The domain controllers may have an existing domain controller certificate. The Active Directory Certificate Services provides a default certificate template for domain controllers called *domain controller certificate*. Later releases of Windows Server provided a new certificate template called *domain controller authentication certificate*. These certificate templates were provided prior to the update of the Kerberos specification that stated Key Distribution Centers (KDCs) performing certificate authentication needed to include the *KDC Authentication* extension. The *Kerberos Authentication* certificate template is the most current certificate template designated for domain controllers, and should be the one you deploy to all your domain controllers.\ @@ -26,4 +29,6 @@ The certificate template is configured to supersede all the certificate template > The domain controller's certificate must chain to a root in the NTAuth store. By default, the Active Directory Certificate Authority's root certificate is added to the NTAuth store. If you are using a third-party CA, this may not be done by default. If the domain controller certificate does not chain to a root in the NTAuth store, user authentication will fail. >To see all certificates in the NTAuth store, use the following command: > -> `Certutil -viewstore -enterprise NTAuth` \ No newline at end of file +> `Certutil -viewstore -enterprise NTAuth` + +
\ No newline at end of file diff --git a/windows/security/identity-protection/hello-for-business/includes/dc-certificate-template.md b/windows/security/identity-protection/hello-for-business/includes/dc-certificate-template.md index d29011fbe6..bdaf368c6a 100644 --- a/windows/security/identity-protection/hello-for-business/includes/dc-certificate-template.md +++ b/windows/security/identity-protection/hello-for-business/includes/dc-certificate-template.md @@ -3,6 +3,9 @@ ms.date: 12/28/2022 ms.topic: include --- +
+Configure domain controller certificates + Clients must trust the domain controllers, and the best way to do it is to ensure each domain controller has a *Kerberos Authentication* certificate. Installing a certificate on the domain controllers enables the Key Distribution Center (KDC) to prove its identity to other members of the domain. The certificates provide clients a root of trust external to the domain, namely the *enterprise certification authority*. Domain controllers automatically request a domain controller certificate (if published) when they discover an enterprise CA is added to Active Directory. However, certificates based on the *Domain Controller* and *Domain Controller Authentication* certificate templates don't include the *KDC Authentication* object identifier (OID), which was later added to the Kerberos RFC. Therefore, domain controllers need to request a certificate based on the *Kerberos Authentication* certificate template. @@ -46,3 +49,5 @@ Sign in to a CA or management workstations with *Domain Administrator* equivalen - Select **SHA256** from the **Request hash** list 1. Select **OK** 1. Close the console + +
\ No newline at end of file diff --git a/windows/security/identity-protection/hello-for-business/toc.yml b/windows/security/identity-protection/hello-for-business/toc.yml index 723a434f3b..3024019caf 100644 --- a/windows/security/identity-protection/hello-for-business/toc.yml +++ b/windows/security/identity-protection/hello-for-business/toc.yml @@ -41,10 +41,8 @@ items: - name: Overview href: hello-hybrid-cert-trust.md - - name: Configure Windows Hello for Business settings - items: - name: Configure and validate the PKI - href: hello-hybrid-cert-whfb-settings-pki.md + href: hello-hybrid-cert-trust-validate-pki.md - name: Configure AD FS href: hello-hybrid-cert-whfb-settings-adfs.md - name: Configure Group Policy settings