Can I use Active Directory as a CA for creating test SSL certificates for IIS?

Question

We have an internal test version of our website, which is available (via internal DNS zones) as www.mysite.com.test

I'd like to create an SSL certificate for www.mysite.com.test, so that our testers don't get an invalid certificate warning (the 'real' certificate is bound to www.mysite.com)

I know how to create self-signed certs using OpenSSL, but I'm wondering if there's some way of associating the certificate authority with our Active Directory domain, so that any user on a PC that's a member of the domain will accept the self-signed cert without having to explicitly install it (or explicitly install the self-signing certificate authority as a trusted authority)

Any ideas?

Solution 1

You can add trusted roots through group policy. So make a self signed cert, roll this out as a trusted root, then any cert you sign with it will be trusted.

Policy Object Name/Computer Configuration/Windows Settings/Security Settings/Public Key Policies/Trusted Root Certification Authorities

Setting up the MS Certificate Authority is not required

Solution 2

If you have a server running the AD CS role issue a certificate, then it isn't self-signed anymore, it's issued by your internal CA. To answer the larger point, yes you can do this. You'll have to install the Active Directory Certificate Services role and create/distribute te certificates from there. No need to touch OpenSSL for this use case.

Solution 3

To answer your question exactly: no, you can't create a self-signed cert using Active Directory. However, I think your question is mixing different things.

• Self-signed certificates are NOT issued by an authority (that's why they are self signed)
• You can integrate a certificate authority with Active Directory in order to automatize server and users certificates.

For creating self-signed certs, you have plenty of options. The simplest one, if you're a windows shop, is to do it through IIS (see this: http://technet.microsoft.com/library/cc753127%28WS.10%29). You can also do it with OpenSSL (quite messy but works), with the makecert.exe tool that comes with the .NET SDK or with a number of similar tools (I use my own tool for this but, that's just me).

For integrating a CA with AD, the simplest way is to install the certificate services role on a machine and configure it for AD integration (although in your case, it doesn't seem to be a necessity unless you want to use it for other things).

Finally, you might want to create your own root that isn't integrated with AD. Unless you have to work with client certificate authentication, have many different servers (with different names) that you want to use in testing (and perhaps with automated testing) or if you want to be able to test some aspect of your application that uses special certificate properties or chaining, it's probably not worth the trouble.

In your case, assuming I understood it correctly and all you want to do is test your web app with a certificate, all I would do is generated a self-signed cert (using whatever tool you like best) and then install that certificate in the correct store on your test machine (to avoid certificate warnings and errors)

Comments

[JamesRyan]

You don't need the MS certificate authority to do this if you have already made the certificates using OpenSSL

[JamesRyan]

He isn't actually asking to use AD as a CA. He is asking how to roll out certificates to a domain. His title is wrong but you don't answer the actual problem.

[Dylan Beattie]

Thanks. The problem here is that it isn't a test machine, it's about two dozen people who are involved in testing various things across a number of different products, which means installing and authorising the certificate becomes a bit of a headache. Thanks for the advice, though - certificate services looks like a good idea...

[Dylan Beattie]

Fantastic. Exactly what I was looking for but didn't know how to ask for. :)

[MDMarra]

@JamesRyan Absolutely correct, I read the last paragraph of the question as him wanting a CA that integrates fully with AD. I didn't mean to imply that you can't distribute a cert made in OpenSSL - just that it would be unnecessary with an ADCS server.

[Stephane]

Test doesn't mean it's limited to a single system. It means it's limited to a specific security zone in which you accept additional risk as the price paid for the flexibility necessary for testing. It's pretty common to have two different CAs used for a single application: of is used for testing only (and is generally a private one since it'y way cheaper this way) the other being a public one that is used for general deployment.