Skip to content

Commit fd3166c

Browse files
FriedrichWeinmannFriedrichWeinmann
committed
update
1 parent acc080c commit fd3166c

File tree

4 files changed

+148
-1
lines changed

4 files changed

+148
-1
lines changed

‎documentation/components/components.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -44,6 +44,7 @@ Forest level settings are global settings found in the schema and configuration
4444
These apply to _all_ domains in a given forest.
4545

4646
+ [Forest Level](forest/forestlevel.html)
47+
+ [Certificates](forest/certificates.html)
4748
+ [NTAuthStore](forest/ntauthstore.html)
4849
+ [Schema (ldif)](forest/schema-ldif.html)
4950
+ [Schema](forest/schema.html)

‎documentation/components/forest/certificates.md

Lines changed: 140 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,140 @@
1+
# Certificates
2+
3+
> This Component does NOT follow the usual pattern of the corresponding "Register"-Command's parameters are mapped straight through
4+
> Reading the configuration guidance is strongly recommended!
5+
6+
## Synopsis
7+
8+
The certificates [Component](../components.html) allows you to manage certificates in the forest-wide certificate stores.
9+
This can include several different kinds of certificates, such as Root CA certificates or NTAuth certificates.
10+
11+
## Supported Certificate types
12+
13+
The following kinds of certificates can be managed through this component:
14+
15+
|Name|System Name|Description|
16+
|---|---|---|
17+
|NTAuth Certificate|NTAuthCA|CA able to authenticate users|
18+
|Root Certificate Authority|RootCA|Trusted Root Certificate Authority. Certificates issued by it will be trusted.|
19+
|Sub Certificate Authority|SubCA|An intermediate Certificate Authority. Certificates issued by it will be trusted.|
20+
|Cross-Signing Certificate Authority|CrossCA|A Cross-Signing CA, used to mark another CA as trusted.|
21+
|Key Recovery Agent Certificate|KRA|Used for Key Recovery Agents|
22+
23+
This Component supports adding and removing certificates.
24+
You can declare the defined list of certificates as authorative (removing non-defined certificates) or merely add your certificates to the list of already existing certs.
25+
26+
## Defining Configuration
27+
28+
Fundamentally, there are a few aspects you can define:
29+
30+
+ Certificate to remove (by thumbprint)
31+
+ Certificate to add (full, public certificate needed)
32+
+ Which Certificate type to claim authority over
33+
34+
All Json/psd1 bits are combinable, you can use as many json/psd1 files as desired to define your environment.
35+
36+
### Removing a Certificate
37+
38+
Removing a certificate requires specifying the type and the thumbprint of the certificate:
39+
40+
```json
41+
{
42+
"Delete": [
43+
{
44+
"Type": "RootCA",
45+
"Thumbprint": "9D385AC584BE4370BF11C91BE0720FA04DD0071F"
46+
}
47+
]
48+
}
49+
```
50+
51+
### Adding a Certificate
52+
53+
There are two ways to define adding a certificate:
54+
55+
+ Json configuration
56+
+ .cer file
57+
58+
> .cer file
59+
60+
The easiest solution is to place the certificate as a .cer file in the Context folder.
61+
In order for this solution to work, the filename _must_ begin with the type of certificate it is.
62+
63+
For example: `RootCA_contoso.com.cer` would add the certificate to the RootCA store.
64+
65+
> Json configuration
66+
67+
To define it in json, create it thus:
68+
69+
```json
70+
{
71+
"Add": [
72+
{
73+
"Type": "RootCA",
74+
"Certificate": "H4sIAAAAAAAEAO1YW3OiyhZ+P1XnP1i+Zo5cVUwlqeoGMV5AuWjEmak5II1gQJAGUX/9QY2JGszM7JmpXbXrVB4kq1d/vS5fr7Xgrm/NcWmEYuyFi/syVaEqZIUql9aBv8D3ZTdJoluCwFMXBSauBN40DnHoJJVpGBBRmOX7XOT7BE2SLEGy5Yd//6tUussxSypy2vZ9mTyIcqEuv5PtpA/aBicoqOR70DT5/PWO0AtWQRybm+Klw8a3tfxJPj72tJMdJ1ZRbxacWXYmPz1EQ9M09pJNhY83URLOYjNyN5VxlWzwKE48x5uaCcKXAvrU4t8BeB3vMgoXkTgoh1oSe4vZw2ct3at//bYmSVL4tv8B30olXr7XEU7Yc/n5f5/bGKco/mt7NRR7pl+S08AqgGAFpsZzkOV5tiGSHMdWqxxZr9K8ILJMHcAPoeUwKUHkhDF6h0uRRC2nKE2WKOqWrd2SjRKQvgsGnKTAxiMWVaLoW3KPNfgYS3dzb6M88O/j3RAYrgr4KsfCZu4hCUWK4hsUbJJ1mhQByQoCSdYp8XxfntdjJk+ye0Jv+pLGcr7wxvEScbH8f178c3mR53cQhxE+E+VCCEryfVk1M8FMzPKD1G7zN3OeB6g7A1kbgllb0XWrnUjrDtd2xSdga1tHYZZbIMPZ89J99lqNjIRAwSIQgCIpbCYAQxgpiiCA0XAylklZAEjMyI0kNDNJMLK+rtCS4Jt7mb6XrSUB7GUSBGthDiQ4k0cQSBIcqf6UUcjcLtieX57ZFAHo80DhwG6dn3Xz5yZgIVrxrjqQxRXBBEbfGoqMEvVvxu54KEC252CJQTdIXypOOnVldxzcQFsLacg1xS3Zx8u1RWbZPGZ7DVuxdUzVIqD3rLETVmG7tpkasTgJ9XRZZ7uQXhApVwuh91xfLQbk8wxXY7Fvh92JL9YZUTT4QYubq3HoL+WbJ2Vjj42enY2YBHBLPZhQxuDJBcsG7DcSqmk2HaVLc0tH3wwsYrK0jSiRgCP2M3ZMKt3xrArWUyvcDteJZMw6ag/qzDxqaJpGRL3lRq06y2d33lWzqbPu+NsxFyN7EbIExE1JHfk1LVCb1eFjHobHzVjoBGAgYd8Kal0u3oJlCOOWOGf6hiCErI0kmWnQE4qXVStmZozSzrMLYEiBTJ+D/i4/jwoHgcM18zzxYKZkj0qed5X0ITQyERjtbmZAqAwfcx61eB63gDIUYSZBCZItQA1tYaY8QajzqaAKNNWtDWO6sZIsLei1JDXL+mOhgGP7fDeB0VolXbqqTmRJWpCwFm17g3YQ4Sep0U+cCUNXNwOjZtVp16+BdS1wUrBisT1H28ctjCj7qT6VgbuNtAUBrYW45qpbC2xUk5B5uTvuyQPWxz2/w+HHdFuXmZtqT7W2IxWvB6bVSZl10G9STc4EraG94CzC7Rme3vHampY1blqa1yI5f9PdbtejcGb1/U517lLOinxUxIneUiZ8Ghn0agSX9ZGUxGKPz56VOb0yZlaPVdXajRHOu4pU1azn5iDoZ95GYwl72MvkaceaLGaeThvYE6wNp224Z38mY40PMPsUh73teKRWueraXzUkk+IHLLviNE0fNbCvjTqrTJoB2JQ7srsiaka30xJIQWn3ck5sDdKa3d/fERCcVw3ifdm4k7TLMqLtqshAG5iJmxeR1/FwsBsNtd1o+DrpfDmZY25ve+HU9CVz6noL9EUyvvxoxbsjrpsQo0Xyq4Zcx+ddz7dlM0Dlh18wdtel93BC7K1Q+diUmfKF4tlYSr9fPZ39JHNhzlCQe18BaRIGZpLP8pWXI9oLJ7wcGy8BiobHIwvORsjjxmObOR9Ni5rPXr+oAb2Flk/jXeZ2idgZXn74bkre9h7ycWZGofIx7HG48mwUv8adLYrsDvzHKXTlRCI/8qrZahgm5YePHBMQnsZedAjIFUXZ83eqkrn2gjTQvC26HO3OvefztpAHOh+0Xv2vXvH/jXsFzDzqfI9/b+cVE/Ac5ToJD/EsIOIB4Ei7n7HmGlX3iNfoul98CfoQo3hPvsKIn2oOTIyzMLavaRYV2uPKFQ69IAsejnxzsydTAfg14PdVfC99IUnumP1Kj9rV6/GTrN+9f+TgYozQCXih0e97TAHoWx19d6XrH5bSwgv/XSq/nPFHa+lPFJy/WmnzQcnfO5fv1TcRutIo+TAIzIWNKyeHHkPwUc16RH4kev412NdPHrbv/2enW1kH/u8o7seLpmkLM2ovrhTBPaQU2qmPDsAfGvmRXQeQXwD4keJ+aI1mZFqe7yUewuUHzQ1T384zMUUYf5iIcOffx61wPxzg11vDfbcRXGkVp9znQ9/PyZ+7hV/uQR4q5J/I/0t9/vyjU8un0kean14/WjIVcvf3qcSnfpLG6H6B0iQ2/U+lQWr53rSLNnr4jHJFynLywa1m2kyNRUz169c/2ZdOvz1eJmlP6uL87CCLtxYX1+IqX1gz4eGWtDEfLhIzH67i8oNj+ji/V/Bi9j8rwpdglw3kb38J+LOvAL/xBeDYB9+P/5ff5F4VC/rbpe4P5vUsq6c5fSPcUbr/xQ//A4VCukUdGAAA"
75+
}
76+
]
77+
}
78+
```
79+
80+
Not the neatest way to define a certificate, so while this method is supported, it is not recommended.
81+
The certificate data is created using the command `ConvertTo-PSFClixml`.
82+
83+
For example this line would generate the data from the local computer's certificate store:
84+
85+
```powershell
86+
Get-ChildItem Cert:\LocalMachine\My\ | Where-Object Subject -eq 'CN=contoso.com' | ConvertTo-PSFClixml
87+
```
88+
89+
### Establishing Authority
90+
91+
To declare authority over a type of certificate, define it thus:
92+
93+
```powershell
94+
@{
95+
Authority = @(
96+
@{
97+
Type = "RootCA"
98+
Authorative = $true
99+
},
100+
@{
101+
Type = "SubCA"
102+
Authorative = $true
103+
}
104+
)
105+
}
106+
```
107+
108+
### Combining Settings
109+
110+
All three sets of json/psd1 configuration can exist in the same configuration file or be split across multiple ones as desired.
111+
Example with all settings combined:
112+
113+
```json
114+
{
115+
"Authority": [
116+
{
117+
"Type": "RootCA",
118+
"Authorative": true
119+
},
120+
{
121+
"Type": "SubCA",
122+
"Authorative": true
123+
}
124+
],
125+
"Delete": [
126+
{
127+
"Type": "RootCA",
128+
"Thumbprint": "9D385AC584BE4370BF11C91BE0720FA04DD0071F"
129+
}
130+
],
131+
"Add": [
132+
{
133+
"Type": "RootCA",
134+
"Certificate": "H4sIAAAAAAAEAO1YW3OiyhZ+P1XnP1i+Zo5cVUwlqeoGMV5AuWjEmak5II1gQJAGUX/9QY2JGszM7JmpXbXrVB4kq1d/vS5fr7Xgrm/NcWmEYuyFi/syVaEqZIUql9aBv8D3ZTdJoluCwFMXBSauBN40DnHoJJVpGBBRmOX7XOT7BE2SLEGy5Yd//6tUussxSypy2vZ9mTyIcqEuv5PtpA/aBicoqOR70DT5/PWO0AtWQRybm+Klw8a3tfxJPj72tJMdJ1ZRbxacWXYmPz1EQ9M09pJNhY83URLOYjNyN5VxlWzwKE48x5uaCcKXAvrU4t8BeB3vMgoXkTgoh1oSe4vZw2ct3at//bYmSVL4tv8B30olXr7XEU7Yc/n5f5/bGKco/mt7NRR7pl+S08AqgGAFpsZzkOV5tiGSHMdWqxxZr9K8ILJMHcAPoeUwKUHkhDF6h0uRRC2nKE2WKOqWrd2SjRKQvgsGnKTAxiMWVaLoW3KPNfgYS3dzb6M88O/j3RAYrgr4KsfCZu4hCUWK4hsUbJJ1mhQByQoCSdYp8XxfntdjJk+ye0Jv+pLGcr7wxvEScbH8f178c3mR53cQhxE+E+VCCEryfVk1M8FMzPKD1G7zN3OeB6g7A1kbgllb0XWrnUjrDtd2xSdga1tHYZZbIMPZ89J99lqNjIRAwSIQgCIpbCYAQxgpiiCA0XAylklZAEjMyI0kNDNJMLK+rtCS4Jt7mb6XrSUB7GUSBGthDiQ4k0cQSBIcqf6UUcjcLtieX57ZFAHo80DhwG6dn3Xz5yZgIVrxrjqQxRXBBEbfGoqMEvVvxu54KEC252CJQTdIXypOOnVldxzcQFsLacg1xS3Zx8u1RWbZPGZ7DVuxdUzVIqD3rLETVmG7tpkasTgJ9XRZZ7uQXhApVwuh91xfLQbk8wxXY7Fvh92JL9YZUTT4QYubq3HoL+WbJ2Vjj42enY2YBHBLPZhQxuDJBcsG7DcSqmk2HaVLc0tH3wwsYrK0jSiRgCP2M3ZMKt3xrArWUyvcDteJZMw6ag/qzDxqaJpGRL3lRq06y2d33lWzqbPu+NsxFyN7EbIExE1JHfk1LVCb1eFjHobHzVjoBGAgYd8Kal0u3oJlCOOWOGf6hiCErI0kmWnQE4qXVStmZozSzrMLYEiBTJ+D/i4/jwoHgcM18zzxYKZkj0qed5X0ITQyERjtbmZAqAwfcx61eB63gDIUYSZBCZItQA1tYaY8QajzqaAKNNWtDWO6sZIsLei1JDXL+mOhgGP7fDeB0VolXbqqTmRJWpCwFm17g3YQ4Sep0U+cCUNXNwOjZtVp16+BdS1wUrBisT1H28ctjCj7qT6VgbuNtAUBrYW45qpbC2xUk5B5uTvuyQPWxz2/w+HHdFuXmZtqT7W2IxWvB6bVSZl10G9STc4EraG94CzC7Rme3vHampY1blqa1yI5f9PdbtejcGb1/U517lLOinxUxIneUiZ8Ghn0agSX9ZGUxGKPz56VOb0yZlaPVdXajRHOu4pU1azn5iDoZ95GYwl72MvkaceaLGaeThvYE6wNp224Z38mY40PMPsUh73teKRWueraXzUkk+IHLLviNE0fNbCvjTqrTJoB2JQ7srsiaka30xJIQWn3ck5sDdKa3d/fERCcVw3ifdm4k7TLMqLtqshAG5iJmxeR1/FwsBsNtd1o+DrpfDmZY25ve+HU9CVz6noL9EUyvvxoxbsjrpsQo0Xyq4Zcx+ddz7dlM0Dlh18wdtel93BC7K1Q+diUmfKF4tlYSr9fPZ39JHNhzlCQe18BaRIGZpLP8pWXI9oLJ7wcGy8BiobHIwvORsjjxmObOR9Ni5rPXr+oAb2Flk/jXeZ2idgZXn74bkre9h7ycWZGofIx7HG48mwUv8adLYrsDvzHKXTlRCI/8qrZahgm5YePHBMQnsZedAjIFUXZ83eqkrn2gjTQvC26HO3OvefztpAHOh+0Xv2vXvH/jXsFzDzqfI9/b+cVE/Ac5ToJD/EsIOIB4Ei7n7HmGlX3iNfoul98CfoQo3hPvsKIn2oOTIyzMLavaRYV2uPKFQ69IAsejnxzsydTAfg14PdVfC99IUnumP1Kj9rV6/GTrN+9f+TgYozQCXih0e97TAHoWx19d6XrH5bSwgv/XSq/nPFHa+lPFJy/WmnzQcnfO5fv1TcRutIo+TAIzIWNKyeHHkPwUc16RH4kev412NdPHrbv/2enW1kH/u8o7seLpmkLM2ovrhTBPaQU2qmPDsAfGvmRXQeQXwD4keJ+aI1mZFqe7yUewuUHzQ1T384zMUUYf5iIcOffx61wPxzg11vDfbcRXGkVp9znQ9/PyZ+7hV/uQR4q5J/I/0t9/vyjU8un0kean14/WjIVcvf3qcSnfpLG6H6B0iQ2/U+lQWr53rSLNnr4jHJFynLywa1m2kyNRUz169c/2ZdOvz1eJmlP6uL87CCLtxYX1+IqX1gz4eGWtDEfLhIzH67i8oNj+ji/V/Bi9j8rwpdglw3kb38J+LOvAL/xBeDYB9+P/5ff5F4VC/rbpe4P5vUsq6c5fSPcUbr/xQ//A4VCukUdGAAA"
135+
}
136+
]
137+
}
138+
```
139+
140+
Json/psd1 files and .cer files can freely coexist.

‎documentation/components/forest/nav.json

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,10 @@
88
"Label": "Forest Level",
99
"Link": "forestlevel.html"
1010
},
11+
{
12+
"Label": "Certificates",
13+
"Link": "certificates.html"
14+
},
1115
{
1216
"Label": "NTAuthStore",
1317
"Link": "ntauthstore.html"

‎documentation/components/forest/ntauthstore.md

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,8 @@
55
The NTAuthStore [Component](../components.html) allows you to define certificates to apply to the central enterprise store of trusted certificates.
66
Useful for rolling out trust to a central PKI in a dedicated forest.
77

8+
> While still functional, this [Component](../components.html) has been superseded by the more capable [Certificates](certificates.html) [Component](../components.html)
9+
810
## Defining Configuration
911

1012
To define the certificates to register, simply drop the .cer files in the `forest/ntAuthStore` folder of a [Context](../../basics/contexts.html).
@@ -20,7 +22,7 @@ To define the authorative mode, create a json file (name not important) in the `
2022

2123
```json
2224
{
23-
Authorative: true
25+
"Authorative": true
2426
}
2527
```
2628

0 commit comments

Comments
 (0)