Разворачиваем RCA (Microsoft PKI)

Channel:

Heavily Armed Nerd

Subscribers:

1,590

Published on September 2, 2023 11:50:39 AM ● Video Link: https://www.youtube.com/watch?v=53D7ZHd0CVo

Duration: 33:51

855 views

27

Установка основного сервера выдачи сертификатов в иерархии PKI


Команды из видео:
notepad C:\Windows\CAPolicy.inf


[Version]
Signature=”$Windows NT$”
[PolicyStatementExtension]
Policies=InternalPolicy
[InternalPolicy]
OID= 1.2.3.4.1455.67.89.5
[Certsrv_Server]
RenewalKeyLength=4096
RenewalValidityPeriod=Years
RenewalValidityPeriodUnits=20
CRLPeriod=Years
CRLPeriodUnits=20
CRLDeltaPeriod=Days
CRLDeltaPeriodUnits=0
LoadDefaultTemplates=0

Define the Active Directory Configuration Partitions Distinguished Name.

certutil -setreg ca\DSConfigDN "CN=configuration,DC=HeavilyArmedNerd,DC=local"

certutil -setreg ca\DSDomain "DC=HeavilyArmedNerd,DC=local"



This will sets the overlap period between the CRL and the Delta CRL.
certutil.exe –setreg CA\CRLOverlapPeriodUnits 3

_______________________________________________________
This command will sets the CRL Overlap Period to weeks.
certutil.exe –setreg CA\CRLOverlapPeriod “Weeks”

_______________________________________________________
This command will sets the maximum certificate validity period of certificates issued by this.
CA
certutil.exe –setreg CA\ValidityPeriodUnits 10

net stop certsvc
net start certsvc