FAQ

• Better Certificate Lifecycle Management: Modern PKI solutions offer more comprehensive and automated tools for managing the lifecycle of certificates. This includes issuance, renewal, revocation, and monitoring of certificates, significantly reducing administrative overhead and increasing security.
• More Use Cases with Less Effort: A more modern PKI can support a wider range of use cases, often with significantly less effort. These include advanced integrations, support for mobile devices, IoT security, and cloud environments. This allows your company to flexibly respond to new requirements and technological developments.

Yes, it is possible to seamlessly integrate the Microsoft CA (AD CS) with the CLM. This allows you to leverage your existing Microsoft CA for additional, non-Windows-specific use cases, such as issuing certificates for Linux servers via ACME.

For customers using a Microsoft PKI, two options are available:

• Professional Package: Your Microsoft PKI continues to operate, and the CLM also manages certificate-based processes. This enables centralized management and automation of certificates, enhancing efficiency and security.
• Ultimate Package: If the CLM Autoenrollment Connector is used with the Ultimate Package, the Microsoft PKI can be fully replaced by the MTG PKI without the need to change Active Directory-based processes. This provides seamless integration and allows you to benefit from the advanced features and greater flexibility of the modern PKI.

These options offer you the opportunity to leverage the benefits of a modern PKI while continuing to use or gradually replace your existing infrastructure.

Microsoft AD CS Migrationschart

With the CLM Autoenrollment Connector, you have a connection from your Public CA or the MTG PKI to Microsoft Active Directory. This allows you to replace your Microsoft PKI (AD CS)!

• Start using the future-proof MTG PKI immediately for a wider range of application scenarios within and outside the Windows environment.
• Maintain all established and automated Windows processes for issuing, renewing, and deploying certificates in the Microsoft Active Directory.
• Additionally, integrate a Public CA for the use of public certificates within your automated Windows processes.

The introduction of the Autoenrollment component heavily depends on the customer’s specific application scenario. Therefore, numerous additional services on the customer’s side are necessary before use. If needed, 360° GSA provides support for integrating the Microsoft PKI with the MTG PKI.

For easier integration, a test simulator can be provided upon request, which is installed locally to test all options. The simulator is a Java application that simulates a simple PKI. This significantly aids in autonomously testing the MS integration of the Autoenrollment Connector.

Microsoft AD CS Migrationschart

The Microsoft CA (ADCS) can manage certain certificates, but the scope of additional capabilities is limited. Those in need of comprehensive Certificate Lifecycle Management (CLM) should look for suitable extensions, such as our offering.

A modern CLM offers numerous advantages, including:

• Web-based User Self Services: These allow users to manage certificates independently, significantly reducing administrative overhead.
• Flexible Customizable Certificate Policies: These enable precise customization of certificate policies to meet the specific requirements of your organization.
• Detailed Configuration Options: These allow for the exact definition of roles and permissions to meet security requirements and compliance mandates.

With a modern CLM, you can not only manage the lifecycle of your certificates more efficiently but also significantly enhance the security and flexibility of your IT infrastructure.

We cannot answer that question definitively. To our knowledge, the Active Directory Certificate Services (ADCS) currently do not support the following interfaces:

• Enrollment over Secure Transport (EST)
• Automatic Certificate Management Environment (ACME) (although there are third-party solutions available)
• Certificate Management Protocol (CMP)
• REST or SOAP-based interfaces for certificate requests are also not available.

There are specialized providers on the market that can fill these gaps with licensable components. However, our current 360° Managed PKI & CLM offering covers all the above components at no additional cost in both the Professional and Ultimate packages.

This means that with our solution, you receive comprehensive support for various use cases without having to worry about additional costs or compatibility issues. This ensures that your PKI meets all current and future requirements.

The Active Directory Certificate Services (AD CS) have essentially existed (albeit under different names) since Windows NT 4.0. The architecture based on Active Directory that is used today was introduced with Windows 2000 Server.

AD CS are well integrated into the Windows ecosystem and continue to enjoy widespread popularity in organizations and agencies of all sizes worldwide. This long-standing integration and widespread use speak to the reliability and stability of the Microsoft PKI.

However, this also means that the underlying technology and some of the implemented protocols may not reflect the latest innovations and security standards. To meet modern security requirements and benefit from the latest developments in cryptography and PKI technology, supplementing or replacing with a more modern PKI solution may be advisable.

A modern PKI not only provides higher security and better automation features but also offers comprehensive support for current and future use cases in hybrid and cloud-based environments.

The Certification Authority database in Active Directory Certificate Services (AD CS) is implemented as a monolithic structure per server. This means that it cannot be consolidated across multiple Certification Authorities and must be operated directly on the respective Certification Authority servers.

The Certification Authority database does not support database replication for true clustering. In the current cluster implementation, only one cluster node can and should access the database files through the file system. This significantly limits the possibilities for implementing true high availability.

However, modern PKI solutions offer advanced options for high availability, including database replication and support for true cluster environments. This ensures that your PKI infrastructure remains available and reliable even in the event of failures of individual components.

By deploying a modern PKI solution, you can significantly improve the availability and resilience of your certification services.

Yes, certificate templates are stored in Active Directory. However, there are some limitations:

• Automatic creation and editing: There is no official method for automatically creating and editing certificate templates. This means that changes must be made manually, which can be time-consuming and error-prone.
• Global configuration: The configuration of certificate templates affects all issued certificates from a specific Certification Authority. If differentiated handling is required, an additional Certification Authority needs to be set up.
• Additional resources: Setting up additional Certification Authorities requires deploying additional Windows servers, resulting in additional costs and administrative overhead.

Modern PKI solutions offer much more flexibility and automation in this regard. They allow for finer granularity in managing certificate policies and templates and support automatic processes for creation and management. This significantly reduces administrative overhead and minimizes the risk of errors. By deploying a modern PKI, you can optimize certificate integration and management, reduce operating costs, and enhance the efficiency of your IT infrastructure.

When configuration changes are made to a Certification Authority, it requires a restart of the service. This results in a temporary interruption in the availability of the Certification Authority.

This interruption can be critical, especially if the Certification Authority is frequently used or if the changes need to be made during important operational hours. Modern PKI solutions offer advantages in this regard through features such as:

• No restart required: Many modern PKI systems allow configuration changes to be made without requiring a service restart. This minimizes downtime and ensures continuous availability.
• Redundant configuration: Some solutions provide the option to make and test changes on a redundant instance before going live. This ensures that the primary instance remains available.
• Automated rollbacks: In case of an error, modern PKI systems can perform automatic rollbacks to the previous configuration to quickly return to full functionality.

By deploying a modern PKI solution, you can maximize the availability of your certification services while increasing flexibility and efficiency in managing and configuring your PKI infrastructure.

Yes, but the standard policy module from Windows does not allow the creation of rules for manual certificate requests. This often results in errors during certificate issuance, such as missing attributes, unrecognized syntax errors, the possibility of multiple CNs, and incorrect issuances that can have security implications.

With the CLM Autoenrollment Connector, you have a connection from your 360° Managed PKI & CLM to the Microsoft Active Directory. This allows you to replace your Microsoft PKI (ADCS) with minimal effort!

Start using the future-proof MTG PKI immediately for a wider range of scenarios both within and outside the Windows ecosystem.
Retain all established and automated Windows processes for issuing, renewing, and deploying certificates within the Microsoft Active Directory.
Additionally, integrate a Public CA for utilizing public certificates within your automated Windows processes.

The introduction of the autoenrollment component heavily depends on the customer’s specific scenario. Therefore, numerous additional services are required on the customer’s side before use. MTG provides support, if needed, for integrating the Microsoft PKI with the MTG PKI.

For easier integration, a test simulator can be provided upon request, which is installed locally to test all options. The simulator is a Java application simulating a simple PKI, significantly aiding in autonomously testing the MS integration of the autoenrollment connector.

A key interface for certificate enrollment in ADCS is RPC/DCOM or MS-WCCE, which is proprietary and more optimized for on-premise environments and less so for the cloud-native world. This interface is restricted to Active Directory authentication methods. Another essential interface is SCEP, which, however, often leads to increased complexity in implementing certain automation processes.
To our knowledge, ADCS currently does not support the following important interfaces:

• Enrollment over Secure Transport (EST)
• Automatic Certificate Management Environment (ACME) (though third-party solutions exist)
• Certificate Management Protocol (CMP)
• REST or SOAP-based interfaces for certificate enrollment are also unavailable.

There are specialized providers in the market that can address these gaps with licensable components. Our current 360° Managed PKI & CLM offering covers all the mentioned interfaces and features at no additional cost in the Professional and Ultimate packages.
This modern PKI solution allows you to utilize common interfaces and supports automation and integration into various IT environments, including cloud services, significantly enhancing your flexibility and efficiency.

The Network Device Enrollment Service (NDES) has several limitations that should be considered during implementation and usage:

• Lack of policy definition: NDES does not allow the definition of specific policies for certificate enrollment. This means that each combination of Certification Authority, certificate template, and password policy must be individually configured.
• Separate server instances: Each combination of Certification Authority, certificate template, and password policy requires its own paid Windows Server instance. This can lead to significant additional costs and administrative overhead.
• No high availability: High availability is not possible with NDES because there is no replication mechanism for one-time passwords. A server failure would therefore result in an interruption of certificate services.
• Outdated CSP interfaces: NDES uses outdated Cryptographic Service Provider (CSP) interfaces, limiting the use of modern cryptographic techniques and technologies.
• No support for elliptic curves: NDES does not support elliptic curves, which are used in many modern cryptographic applications. This can affect the security and efficiency of your PKI.

For a modern and future-proof PKI implementation, you should consider exploring alternative solutions that do not have these limitations. Modern PKI solutions offer more extensive features, better scalability, high availability options, and support for current cryptographic standards, including elliptic curves.

Since the certification authority servers are members of the Active Directory, they can be compromised in various ways, such as through group policies, unauthorized accounts logging in with administrator rights, or compromised service accounts.

The same applies to the publication of Certificate Revocation Lists (CRLs) and the request for OCSP response signing certificates. These are authenticated using Active Directory mechanisms. Security-critical CRL and OCSP servers, often connected to the Internet, are therefore usually located in the same Active Directory forest as the certification authorities and are often administered using the same accounts. This increases the risk that compromising a CRL or OCSP server also jeopardizes the certification authorities.

Modern PKI solutions offer advanced security mechanisms to mitigate these risks, including:

• Isolated environments: OCSP responders and CRL servers can be operated in isolated environments separate from the certification authorities to prevent the spread of compromises.
• Stronger authentication mechanisms: Implementing multi-factor authentication and role-based access control reduces the risk of unauthorized access.
• Regular security audits: Regular audits and security assessments can help identify and address potential vulnerabilities early on.
  By using modern PKI technologies and best practices, you can significantly increase the security and reliability of your OCSP responders and certification authorities.

Protecting access to your Active Directory (AD) is especially important when using the MTG PKI together with the MS AD Gateway. Here are some measures you can take to increase security:

• Virtual Private Network (VPN): Use a VPN to ensure a secure and encrypted connection for accessing your network and AD. This is a fundamental measure to prevent unauthorized access.
• Multi-Factor Authentication (MFA): Implement MFA for all users accessing the AD. This ensures that, in addition to the password, another form of identity verification is required, significantly enhancing security.
• Network Access Control (NAC): Deploy NAC to control network access based on user roles, device types, and other criteria. NAC helps grant access only to authorized devices and users.
• Segmentation and Microsegmentation: Divide your network into smaller, isolated segments. This restricts access to the AD to specific network segments and minimizes the spread of potential threats.
• Least Privilege Principle: Ensure that users have only the minimum necessary rights required for their tasks. This reduces the risk of insider threats and inadvertent errors.
• Monitoring and Logging: Implement comprehensive monitoring and logging mechanisms to detect unusual activities early and respond accordingly. Use Security Information and Event Management (SIEM) solutions for log analysis and management.
• Hardened AD Servers: Secure your AD servers through specialized hardening measures. This includes removing unnecessary services, regular security updates, and using secure configuration standards.

By combining these measures, you can effectively protect access to your Active Directory and significantly enhance the security of your entire IT infrastructure.

Yes, that’s possible without any issues.

The “Key Storage Provider” interface is not designed to work with network appliances. For example, if a Network Hardware Security Module (HSM) is used and the connection to it is temporarily interrupted, the Certification Authority service will no longer be able to access the private key of the Certification Authority. This leads to several issues:

• Failed certificate requests: Since the Certification Authority service can no longer access the private key, all certificate requests fail until the connection is restored and the service is restarted.
• Revocation list generation: Revocation lists also cannot be generated, affecting the management and enforcement of certificate revocations.