Quellcode durchsuchen

Added doc for Active Directory Certificate Services

develop
Robin Thoni vor 3 Jahren
Ursprung
Commit
c69f37415a
Signiert von: Robin THONI <robin@rthoni.com> GPG-Schlüssel-ID: 4E09DEF46B99E61E
1 geänderte Dateien mit 21 neuen und 1 gelöschten Zeilen
  1. 21
    1
      README.md

+ 21
- 1
README.md Datei anzeigen

@@ -5,7 +5,7 @@
5 5
 - Setup `ALL_TZ` to the current timezone
6 6
 - Set `ALL_RESTART_POLICY` to `unless-stopped`
7 7
 
8
-## Generate CA
8
+## Generate Root and Intermediate CA
9 9
 
10 10
 ```shell
11 11
 mkdir -p data/step-ca/home/secrets
@@ -14,3 +14,23 @@ chmod 600 data/step-ca/home/secrets/password
14 14
 chown -R 1000:1000 data/step-ca/home
15 15
 docker run -it --rm -v `pwd`/data/step-ca/home:/home/step smallstep/step-ca:0.15.6 step ca init --ssh --address '0.0.0.0:443' --provisioner 'admin-provisioner' --password-file 'secrets/password' --dns '127.0.0.1,localhost,pki.example.com' --name 'Example Inc.'
16 16
 ```
17
+
18
+## Active Directory
19
+
20
+- Install AD-CS as Subordinate CA
21
+- Generate private key using the wizard
22
+- Finish the setup
23
+- Copy the generated csr to `data/step-ca/home/certs`
24
+- Run on the `step-ca` container
25
+    ```shell
26
+    step certificate sign --profile intermediate-ca certs/ad.csr certs/root_ca.crt secrets/root_ca_key
27
+    ```
28
+  Note: `step` might complaint if there's an emtpy trailing line at the end of the CSR
29
+- Copy the generated certificate on stdout AND `certs/root_ca.crt` somewhere to the AD-CS server
30
+- Run on the AD-CS server
31
+    ```shell
32
+    certutil -installcert C:\cert.crt # Install the signed certificate in AD-CS
33
+    certutil -f -dspublish C:\root.crt RootCA # Publish the root CA in AD 
34
+    ```
35
+- Optionally remove the root and intermediate certificates files as they now imported in the store
36
+- Start AD-CS

Laden…
Abbrechen
Speichern