Restoring a certification authority from backup

Author Uwe Gradenegger Posted on Categories Certification Authority database, Certification Authority, Backup and restore Tags Exit module, Hardware security module (HSM), SafeNet, certlm.msc

The following describes how to restore a certification authority from backup. In addition to the disaster case, this procedure is also part of the migration of a certification authority to a new server .

Overview

The restore of a certification authority is divided into the following substeps, which must be processed exactly in the specified order:

Implementation

Do you know TameMyCerts? TameMyCerts is an add-on for the Microsoft certification authority (Active Directory Certificate Services). It extends the function of the certification authority and enables the application of rule sets to realize the secure automation of certificate issuance. TameMyCerts is unique in the Microsoft ecosystem, has already proven itself in countless companies around the world and is available under a free license. It can be downloaded via GitHub and used free of charge. Professional maintenance is also offered.

Restore the certification authority certificate

Restoring the CA certificate differs depending on whether a hardware security module is used or not, and is described in the following two articles:

If the intention is to remove old certification authority certificates from the certification authority configuration at a later date, these do not have to be imported. The certification authority certificates that are to be actively used later are sufficient.

Installing the certification authority role on the target server

Once the certification authority certificates with the private keys have been installed on the target server, the certification authority role is installed. The decisive difference to the installation of a new certification authority is that in this case no new key pair is generated, but the existing one continues to be used.

The certification authority is online again immediately after installation, populated with the configured certificate templates and accepts certificate requests. However, since the configuration of the certification authority and the certification authority database are still missing, there is a great risk that "incorrect" certificates will be issued. For this reason, it is essential that maintenance mode is activated on the certification authority immediately after the following step in order to prevent requests from enrollees until the restore and the functional test are complete.

Since Windows Server 2008, the installation of the Certification Authority role consists of two steps:

  • Installing the role files. This step is described in this article .
  • Configuration of the certification authority role. This step is described below.

After the certification authority role has been installed, the role configuration can be started via Server Manager. In the upper right corner you should see an exclamation mark; the role configuration wizard can be started via the option "Configure Active Directory Certificate Services...".

In the following dialog, the credentials of the user account with which the role configuration is performed are specified. The user account must be a member of the "Enterprise Administrators" group or have the corresponding delegated permissions.

It is recommended that one logs on interactively (i.e. directly at the console or via Remote Desktop) with the account intended for the installation of the certification authority and does not make any changes in this dialog. Selecting a different user account may lead to unforeseen interactions (for example, in connection with Gemalto / SafeNet HSMs, the account must also have permissions on the partition).

In the next dialog, the "Certification Authority" option is selected.

Depending on the certification authority type, "Enterprise CA" or "Standalone CA" is selected. The following instructions describe how to restore an Active Directory integrated certification authority, i.e. an enterprise CA.

Depending on the certification authority type, a distinction is made between a root certification authority (Root CA) or a subordinate certification authority (Subordinate CA).

The "Subordinate CA" option includes all certification authority types that are not root certification authorities - i.e. also intermediate certification authorities.

In the next dialog, an existing key pair is used instead of a new one as in a new installation. Since the CA certificates were already restored before, the option "Select a certificate and use its associated private key" is selected.

In the next dialog, the certification authority certificate is now selected. If the certification authority has several certification authority certificates, the newest one should be selected.

If the certification authority has multiple certification authority certificates, these are added back to the certification authority configuration in the subsequent step via the registry restore.

If the list of certificates is empty even though the CA certificate has been correctly restored, see the article "When restoring a certification authority, the certification authority certificate is not selectable during role installation ".

The following Windows PowerShell command can be helpful in identifying the latest CA certificate:

Get-ChildItem Cert:\LocalMachine\My | Sort-Object NotBefore | Select-Object -Property Thumbprint,NotBefore,NotAfter

The following dialog is used to specify the location for the certification authority database.

The certification authority database can later be moved to another drive or folder with little effort. The procedure is described in the article "Moving the certification authority database to another directory or drive ".

Now all relevant parameters are set and the installation of the certification authority role can be completed.

The success of the role installation is confirmed accordingly.

Putting the certification authority into maintenance mode

After the certification authority role has been installed, it is immediately available for requesting certificates and can directly issue certificates again. However, since the configuration and the certification authority database have not yet been restored, it is necessary to put the certification authority into maintenance mode. The procedure is described in the article "Putting an Active Directory integrated certification authority (Enterprise Certification Authority) into maintenance mode ".

Restore the registry of the certification authority

The registry of the certification authority contains all settings concerning the certification authority server, among others:

  • Configuration of CRL distribution point (CDP) and Authority Information Access (AIA) for the issued certificates
  • Configuration of publication points for CRLs
  • Maximum validity period for issued certificates
  • Configuration of validity and overlap periods of CRLs
  • Settings regarding private key archival (recovery agents and key generation for the CA Exchange certificates)
  • Security permissions on the certification authority

The individual configuration settings must be selected or removed manually in the registry file for the restore. The exact procedure for importing the registry values is described in the article "Restoring the registry of a certification authority".

Restore the certification authority database

Before the certification authority can be put back into operation, the certification authority database must still be restored.

To do this, open the management console for the certification authority (certlm.msc) and right-click on the certification authority. In the context menu, select "All Tasks" - "Restore CA...".

Since the certification authority service must not be running for the restore of the certification authority, you are notified of this. Clicking on "OK" stops the certification authority service.

The wizard for restoring the certification authority is then opened. Clicking on "Next" takes you to the next dialog.

In the following dialog, the option "Certificate database and certificate database log" is selected. The CA certificate including keys has already been restored, so the corresponding option is not required here. "Browse" is used to select the location of the certification authority database to be restored.

When selecting the folder, it is important that the restore routine expects a subfolder called "DataBase". So the respective parent folder must be selected.

The wizard can now be completed.

You will now be asked whether the certification authority service should be restarted. If there are incremental backups to be restored, "No" must be selected here and the incremental backups must be restored in chronologically ascending order according to the same scheme.

Restore the delta between backup and failure

The certification authority must be able to revoke certificates. For this, every (still valid) certificate ever issued must be recorded in the certification authority database. Typically, there is a delta between the time of the last backup and the actual failure of a system.

Microsoft therefore provides for a copy of each issued certificate to be sent to a mailbox with the SMTP exit module each time a certificate is issued.

Alternative methods could include the development of your own exit module which, for example, writes the issued certificates to a network share or uploads them to an API endpoint.

The procedure for restoring the data from the SMTP exit module is described in the article "Restoring certificates from the SMTP Exit Module data ".

Optional: compacting (defragmenting) the certification authority database

It is a good idea to compact the certification authority database before the certification authority is put back into operation. However, this only makes sense if a large number of entries has been deleted or is now deleted before compacting from the certification authority database, as otherwise no disk space can be gained. The procedure is described in the article "Compacting (defragmenting) the certification authority database ".

Optional: Remove old certification authority certificates from the configuration of a certification authority

If the certification authority has been in operation for a while, there may be older certification authority certificates that have long since expired. These can be removed from the configuration of the certification authority on this occasion, so that it starts without importing the certificates.

The procedure is described in the article "Removing old certification authority certificates from the configuration of a certification authority ".

Optional: Customize connected services

If additional services work with the certification authority and the server name has changed during the restore, their configuration may have to be adjusted.

For the Network Device Enrollment Service (NDES), see the article "Moving Network Device Enrollment Service (NDES) to another certification authority ".

Perform a functional test

Before the certification authority is put into operation, it is essential to perform a detailed functional test to ensure that the certification authority is working as intended. A checklist and the procedure can be found in the article "Performing a functional test for a certification authority ".

Take the certification authority out of maintenance mode

After all tests are completed, the certification authority can exit maintenance mode. The procedure is described in the article "Putting an Active Directory integrated certification authority (Enterprise Certification Authority) into maintenance mode ". Please make sure that the configuration of the certification authority and Active Directory are in sync, otherwise no certificates can be requested .

External sources