Planning certificate deployment

Microsoft Forefront Threat Management Gateway uses digital certificates in a number of common scenarios:

• Publishing a Web server or Outlook® Web Access server over an HTTPS connection.
• Publishing a non-Web server over an HTTPS connection.
• Configuring a VPN site-to-site connection with L2TP/IPsec or IPsec tunneling.

The following table summarizes the type of certificates used in these scenarios.

Setting Up a Local Certification Authority

You can use Microsoft Certificate Services to set up a local CA to issue certificates. A local Microsoft CA can be one of two types:

**Standalone CA—**This type of CA is useful when there is no domain environment and automatic deployment of certificates to users and computers is not required. This type of CA has the following characteristics:

• Active Directory is not required.
• The CA has no knowledge of the user or computer requesting the certificate. Information is explicitly supplied when the request is made.
• All requests for certificates are set to "pending" until approved by the CA administrator.
• You cannot use the Certificate Request wizard in Certificate Services to request or manage certificates. You must use a Web page.
• The user account requesting the certificate must be defined locally on the standalone CA computer if client certificates are required, you must define the user account requesting the certificate locally on the standalone CA computer.
• You cannot add or remove certificate templates from the standalone CA.
• You must add the self-signed standalone CA certificate manually to the Trusted Root Certification Authorities store of the requesting computer. There is some limited domain support when a standalone CA is installed by a domain user in a domain. In this case, the CA root certificate is added to the Trusted Root Certification Authorities store for all domain users and computers.

Enterprise CA—This type of CA uses Active Directory to verify that users, computers, and services requesting certificates have authorization to receive the type of certificate they are requesting. Certificates and Certificate Revocation Lists (CRL) are published by the CA to Active Directory. You can use the Certificate Request Wizard in Certificate Services to request and manage certificates.

The following sections describe the main steps required to install and configure a local Microsoft standalone or enterprise CA. These sections only provide an overview of the configuration steps for a local CA. For a more complete list, see the topics in Understanding Certificate Services at Microsoft TechNet.

Installing a root CA

The root CA is the top-level CA. The root CA should not be used to issue certificates to users or computers. Instead, you should set up a CA hierarchy of subordinate CAs. The root CA can be kept offline and brought online only to perform tasks related to subordinate CAs and CRLs.

To install an enterprise CA, you must be a member of the Enterprise Admins group. To install a standalone CA that will store certificates in Active Directory, you must be a member of the Domain Admins group. To install a standalone CA that will not use Active Directory, you must be a member of the Administrators group on the local server.

For instructions see the following resources at Microsoft TechNet:

• Install an enterprise root certification authority.
• Install a stand-alone root certification authority.

For more information see the following resources at Microsoft TechNet:

• Enterprise certification authorities.
• Standalone certification authorities.
• Certificate services best practices.

Installing a subordinate CA

We recommend setting up a subordinate CA to issue certificates.

For instructions see the following resources at Microsoft TechNet:

• Install an enterprise subordinate certificate authority.
• Install a stand-alone certification authority.

For more information see the following resources at Microsoft TechNet:

• Enterprise certification authorities.
• Standalone certification authorities.

Configuring templates for enterprise CAs

A certificate template profiles certificates based on their intended use. A certificate requester is able to select from a variety of certificate types that are based on certificate templates, depending on their access rights. The certificate template saves users from low-level, technical decisions about the type of certificate that they need. If none of the preset certificate templates meet your needs, you can create new certificate templates and customize them for a variety of different uses. Certificate templates are only used by enterprise CAs.

For instructions see the following resources at Microsoft TechNet:

• Add a certificate template to a certification authority.
• Create a new certificate template.
• Allow subjects to request a certificate that is based on the template.

For more information see the following resources at Microsoft TechNet:

• Certificate templates overview.
• For standalone CA information, see Manage certificate requests on a standalone certificate authority.

Configuring key archival and recovery

In Windows 2003 Certificate Services, key archival and recovery allow CA administrator to archive the private keys associated with certificates that are issued. Key archival and recovery only apply to enterprise CAs.

For instructions see the following resources at Microsoft TechNet:

• Example implementation: Key archival and recovery.

For more information see the following resources at Microsoft TechNet:

• Key archival and recovery.

Configuring and managing certificate revocation

There are a number of tasks associated with managing certificate revocation, including scheduling CRL publication, using delta CRLs to minimize download of lengthy CRLs and designating CRL distribution points.

For instructions see the following resources at Microsoft TechNet:

• Manage certificate revocation.

For more information see the following resources at Microsoft TechNet:

• Revoking certificates and publishing CRLs.

Setting up Web enrollment services

A set of CA Web pages provides a simple user interface to connect to a CA via a Web browser and perform common tasks such as requesting certificates. For a standalone CA, this is the primary request method. For an Enterprise CA, the Certificates MMC snap-in can be used in addition to the Web page.

For instructions see the following resources at Microsoft TechNet:

• Set up certificate authority Web enrollment support.

For more information see the following resources at Microsoft TechNet:

• Certificate authority Web enrollment services.