Skip to content
Docs sslbrain sslbrain.com

Internal certificates from Windows CA

Copy link to the page “Internal certificates from Windows CA”

The Windows CA source gets certificates from your own Active Directory Certificate Services (AD CS). The service agent on a Windows server sends the request to the CA. The rules renew and install the certificates like any other.

The appliance creates the key and the CSR, and the agent only gets the CSR. The private key goes to a server only when a rule installs the certificate (private key export).

When you need this

Copy link to the section “When you need this”
  • Servers and services with internal names, which a public CA will not issue for, need certificates that the domain’s machines trust.
  • You have an AD CS, and the certificates should keep coming from it, but be renewed and installed automatically.

Before you start

Copy link to the section “Before you start”
  • The Enterprise licence with the Windows CA add-on. Contact FairSSL to have it enabled.
  • An approved service agent on a Windows server that can reach the CA (Windows servers).
  • A template that is published on the CA under Certificate Templates and allows “Supply in the request”. The computer account of the agent’s server, DOMAIN\SERVER$, needs Read and Enroll on it.

The default WebServer template gives only Domain Admins and Enterprise Admins the Enroll permission. Make a copy of it, or give the computer account Enroll on the template you use.

Create the source

Copy link to the section “Create the source”

  1. Open Modules and click Download licensed modules and updates. Click Aktiver next to Windows CA, then Restart and apply (modules). The Aktiver button is shown in Danish. Only the application on the appliance restarts, not the virtual machine.

  2. Open Sources › Sources, click Add source and choose Windows CA.

  3. Choose the agent under Service agent.

  4. Click Find CAs through the agent and choose the CA. The answer arrives when the agent next checks in. If the CA is not on the list, choose Another CA (type it) and enter it as Server\CA name, for example DC19.corp.local\Corp CA.

  5. Click Fetch templates through the agent and choose the template. If you type the name yourself with Another template name (type it), use the template’s name, not its display name.

  6. Save the source.

The page warns if the template builds the subject from Active Directory, does not allow a SAN, or requires approval by a certificate manager. If it requires approval, the source waits until the request has been approved on the CA.

Use the source in a profile

Copy link to the section “Use the source in a profile”

  1. Open Profiles and click Create certificate profile (create a profile).

  2. Give the profile a name, for example Internal Windows CA, and click Add next to the Windows CA source.

  3. Choose RSA 2048, 3072 or 4096 bit as the Default key type, and click Create profile. The source marks only RSA as ready for production.

  4. Create the rule as in step 8, and choose the profile under Profile.

The appliance looks for an answer from the CA every 5 minutes. Check now sends the request at once.

Check that it works

Copy link to the section “Check that it works”
  • The source shows Windows CA request with the status Issued and the Request ID on the CA. The same Request ID is listed under Issued Certificates in the Certification Authority console.
  • The certificate is listed under Certificates › Managed by sslbrain.
  • The server delivers the certificate (step 8).

If it fails

Copy link to the section “If it fails”

The source shows the reason under The last request failed.

  • The CA or Active Directory refused the agent access: give the computer account of the agent’s server Read and Enroll on the template, and the right to request certificates on the CA. If the server is a domain controller, the account is a member of Domain Controllers, not Domain Computers.
  • The CA does not issue from this template: add the template under Certificate Templates on the CA, or choose a template the CA issues from.
  • The CA denied the request: the reason is under Failed Requests on the CA.
  • The request is waiting for approval: approve it on the CA. The source checks every 15 minutes for up to a week.
  • The service agent has not checked in for more than 15 minutes: check that the sslbrainagent service is running on the server.
  • The service agent refused the task before the script ran: the agent cannot verify the module’s scripts, or its version is too low. Update the agent.
  • The service agent checks in but has not reported the task within a day: the reason is in the agent’s log under C:\ProgramData\sslbrain\logs on the server.

After a failure the source waits an hour. After 3 failures in a row the source goes into error, retries once a day and raises the Renewal failed alert. See Renewal fails.