{"id":4936,"date":"2020-10-15T03:44:23","date_gmt":"2020-10-15T03:44:23","guid":{"rendered":"https:\/\/pariswells.com\/blog\/?p=4936"},"modified":"2020-12-15T03:44:43","modified_gmt":"2020-12-15T03:44:43","slug":"enabling-ldaps-on-windows-core-dcs-using-enterprise-ca","status":"publish","type":"post","link":"https:\/\/pariswells.com\/blog\/research\/enabling-ldaps-on-windows-core-dcs-using-enterprise-ca","title":{"rendered":"Enabling LDAPS on Windows Core DCs using Enterprise CA"},"content":{"rendered":"

# Example .inf file:<\/p>

[Version]<\/p>

Signature=”$Windows NT$”<\/p>

 <\/p>

[NewRequest]<\/p>

Subject = “CN=dcname.domain.com.au”<\/p>

KeySpec = 1<\/p>

KeyLength = 2048<\/p>

Exportable = TRUE<\/p>

MachineKeySet = TRUE<\/p>

SMIME = FALSE<\/p>

PrivateKeyArchive = FALSE<\/p>

UserProtected = FALSE<\/p>

UseExistingKeySet = FALSE<\/p>

ProviderName = “Microsoft RSA SChannel Cryptographic Provider”<\/p>

ProviderType = 12<\/p>

RequestType = PKCS10<\/p>

KeyUsage = 0xa0<\/p>

 <\/p>

[EnhancedKeyUsageExtension]<\/p>

OID = 1.3.6.1.5.5.7.3.1 ; Server Authentication<\/p>

 <\/p>

# Create CSR<\/p>

certreq -new C:\\temp\\cert.inf c:\\temp\\csr.csr<\/p>

# Issue cert on CA<\/p>

certreq -submit -attrib “CertificateTemplate:2016KerberosAuthentication” “C:\\Users\\matt.soltau\\Desktop\\csr.csr”<\/p>

– Copy cert.cer from CA to DC<\/p>

# Accept cert on DC<\/p>

certreq -accept c:\\temp\\cert.cer<\/p>

# Copy Cert form Personal store to ADDS service<\/p>

# Find Thumbprint (PowerShell)<\/p>

> Cd Cert:\\LocalMachine\\My\\<\/p>

> Get-ChildItem<\/p>

Copy-Item “HKLM:\\SOFTWARE\\Microsoft\\SystemCertificates\\MY\\Certificates\\<Thumbprint>” “HKLM:\\SOFTWARE\\Microsoft\\Cryptography\\Services\\NTDS\\SystemCertificates\\MY\\Certificates\\”<\/p>","protected":false},"excerpt":{"rendered":"

# Example .inf file:[Version]Signature=”$Windows NT$” [NewRequest]Subject = “CN=dcname.domain.com.au”KeySpec = 1KeyLength = 2048Exportable = TRUEMachineKeySet = TRUESMIME = FALSEPrivateKeyArchive = FALSEUserProtected = FALSEUseExistingKeySet = FALSEProviderName = “Microsoft RSA SChannel […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-4936","post","type-post","status-publish","format-standard","hentry","category-research"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t