Windows security permissions required for Certification Authority Web Enrollment (CAWE)
Assuming one implements Microsoft's Active Directory Administrative Tiering Model, or applies similar hardening measures to one's servers, this will impact Certification Authority Web Enrollment (CAWE).
Certification Authority Web Enrollment is a very old feature from the Windows 2000 days - and was last adapted with the release of Windows Server 2003. Accordingly, the code is old and potentially insecure. Likewise, the feature supports no certificate templates with version 3 or newer - this means that certificate templates that use features introduced with Windows Vista / Windows Server 2008 or newer cannot be used. It is recommended that you do not use Certification Authority Web Enrollment and instead request certificates via built-in tools or the PSCertificateEnrollment PowerShell module.
Required permissions
Do you know TameMyCerts? TameMyCerts is an add-on for the Microsoft certification authority (Active Directory Certificate Services). It extends the function of the certification authority and enables the application of rule sets to realize the secure automation of certificate issuance. TameMyCerts is unique in the Microsoft ecosystem, has already proven itself in countless companies around the world and is available under a free license. It can be downloaded via GitHub and used free of charge. Professional maintenance is also offered.
The service account under which CAWE runs (the identity of the IIS application pool) requires the following rights to function properly:
On the certification authority...
- Access this Computer over the Network (SeNetworkLogonRight) on the certification authority.
On the CAWE server...
- Act as part of the operating system (SeTcbPrivilege).
- Impersonate a Client after Authentication (SeImpersonatePrivilege).
- Log on as a Batch Job (SeBatchLogonRight), if it is a domain account or...
- Log on as a Service (SeServiceLogonRight), if it is a Group Managed Service Account (gMSA) .
Related links:
External sources
- User Rights Assignment (Microsoft)
- Credential theft made easy with Kerberos delegation (Microsoft)