Category: High availability

Active Directory Certificate Services have existed (albeit under a different name) in their basic form since Windows NT 4.0. The Active Directory-based architecture used today was introduced with Windows 2000 Server. AD CS is very well integrated into the Windows ecosystem and continues to enjoy great popularity worldwide in companies and government agencies of all sizes.

People like to point out the many possibilities offered by Active Directory Certificate Services. Rarely, however, is it pointed out what is not possible with them. In fact, the product has by now reached its limits in many places.

What these are will be explained in more detail below in order to better decide whether AD CS can be the right solution for planned projects.

Continue reading "Limits of Microsoft Active Directory Certificate Services"

It is generally a good idea to ensure the availability of the Certificate Enrollment Web Services (Certificate Enrollment Policy Web Service, CEP, and Certificate Enrollment Web Service, CES) at all times.

The following describes how this can be achieved with the Windows feature "Network Load Balancing" (NLB).

Continue reading "Using Microsoft Network Load Balancing (NLB) for Certificate Enrollment Web Services (CEP, CES)"

It is generally a good idea to ensure the availability of the CRL distribution points (CDP), Authority Information Access (AIA), and if available, Online Responders (OCSP) at all times.

Access to the revocation information is even more critical than access to the certification authority itself. If the revocation status of a certificate cannot be checked, it is possible (depending on the application) that the certificate is not considered trustworthy and the associated IT service cannot be used.

Continue reading "Using Microsoft Network Load Balancing (NLB) for the CRL distribution points (CDP), Authority Information Access (AIA) and Online Responders (OCSP)"

Assume the following scenario:

• The certification authority is configured to use the SMTP exit module to send e-mail notifications about the events on the certification authority.
• The configured SMTP server is not always reliably accessible, for example, because it is not designed to be highly available.
• If the SMTP server fails, the certification authority will operate very slowly because the e-mail notifications cannot be delivered. In some circumstances, the certification authority service will no longer start.

Continue reading "Combining the SMTP Exit Module with a local SMTP server for increased resilience"