Windows 2000 Certificate Services - Help Request (Understanding and operation).

  • Thread starter Thread starter Go:gul
  • Start date Start date
G

Go:gul

Hi,

I have just had to install Windows 2000 Certificate services and setup
a two-machine CA for our company. While the installation has gone
without a hitch, I am left with two machines which do not act as i had
expected and it is probably my understanding of the system which is at
fault.

I wonder if someone with more experience of this stuff could help me
out here?

I have a CA root server (Active Directory) and a CA Subordinate server
(Active Directory).

I can connect to both through the web interface and request and get
new certificates which can be successfully installed into Internet
Explorer.

Question 1:

As I understand it, I am supposed to do all my requests on the
subordinate server and leave the CA root alone. However, If I do this
then the CA Root server only ever shows (in the past 48 hours at
least), the certificates which were issued directly from itself. It
does not show the certificates issued or revoked or failed which were
produced as a result of requests from the subordinate server.

Should activity on the CA subordinate server not be reflected in the
CA Root server (as it is the ultimate controller of this system)?

Question 2:

I have exported a certificate and imported it into Outlook 2002. It
(Outlook) is capable of sending signed messages and recognising signed
messages sent from a different account as signed.

It fails completely with any attempt to encrypt a message and send it
to a user account which has already sent a signed message. I get a
warning that there is a problem with the other persons certificate and
that it is not trusted.

Question 3:

There are alot of options for what type of encryption I want when I
request a certificate. Can someone tell me what the best all round
secure setting is when requesting a certificate through the "request
form"?

Thanks for the help here.
 
microsoft.public.win2000.security news group, Go:gul
Question 1:

As I understand it, I am supposed to do all my requests on the
subordinate server and leave the CA root alone. However, If I do this
then the CA Root server only ever shows (in the past 48 hours at
least), the certificates which were issued directly from itself. It
does not show the certificates issued or revoked or failed which were
produced as a result of requests from the subordinate server.

Should activity on the CA subordinate server not be reflected in the
CA Root server (as it is the ultimate controller of this system)?
Click to expand...

Nope. Each CA will only ever display the certificates that it has
issued. You're lacking a basic understanding of how PKI works here. The
root CA provides the top level of trust in your PKI, it doesn't control
the other CAs.
Question 2:

I have exported a certificate and imported it into Outlook 2002. It
(Outlook) is capable of sending signed messages and recognising signed
messages sent from a different account as signed.

It fails completely with any attempt to encrypt a message and send it
to a user account which has already sent a signed message. I get a
warning that there is a problem with the other persons certificate and
that it is not trusted.
Click to expand...

Based on which template? Are you sure that you've got a certificate that
is good for both signing and encryption?
Question 3:

There are alot of options for what type of encryption I want when I
request a certificate. Can someone tell me what the best all round
secure setting is when requesting a certificate through the "request
form"?
Click to expand...

This is a big topic, and you really need to start with the basics. PKI,
given its importance and nature, is not something you can get "almost"
right and expect it to work, or to be secure. I'd suggest taking a
course in PKI (Microsoft has a great one), or at the very least reading
the help files, and the white papers, etc, on the Microsoft web site.
 
 
Back
Top