Securing AD CS

Securing the Certificate Services infrastructure is critical to maintaining the integrity and confidentiality of cryptographic operations within Active Directory Certificate Services (AD CS). This section outlines best practices for configuring firewalls, access controls, and secure communication protocols to protect the Certification Authority (CA) and its associated services.

Firewall Configuration¶

The CA server must be protected by strict firewall rules to limit exposure to unauthorized access.
- Allowed Ports:
- LDAP (389, 636) for directory communication.
- Kerberos (88) for authentication.
- HTTP/HTTPS (80, 443) for the Certificate Enrollment Web Service.
- RPC (135 for endpoint discovery, dynamic ports for actual communication).
- Ensure only necessary ports are open and restrict access to trusted IP ranges.

Example:

# Allow LDAP over SSL (port 636)
New-NetFirewallRule -DisplayName "Allow LDAP SSL" -Direction Inbound -Protocol TCP -LocalPort 636 -Action Allow

Block Unused Ports: Disable unused protocols (e.g., SMB, RDP) to reduce attack surfaces.
Use Stateful Inspection: Ensure the firewall enforces stateful inspection to block unsolicited traffic.

Access Control and Role Separation¶

Implement granular access controls to limit who can manage or interact with the CA.
- Principle of Least Privilege: Assign minimal permissions to users and services. For example:
- Restrict certificate enrollment to specific user groups.
- Use the CertEnroll permission in Active Directory to control enrollment access.

Example:

# Set access control on the CA's certificate store
Set-ADObject -Identity "CN=CA,CN=Services,CN=Configuration,DC=example,DC=com" -Replace @{msDS-CA-AccessControl=@{}}

Separate Administrative Roles: Avoid granting CA administrative rights to non-privileged users. Use dedicated service accounts with limited permissions.

Secure Communication Protocols¶

Ensure all communication between the CA and other systems is encrypted.
- TLS/SSL Enforcement:
- Disable outdated protocols (e.g., SSLv2, TLS 1.0) and enforce TLS 1.2 or higher.
- Use strong cipher suites (e.g., AES-256, SHA-256).

Example:

# Check TLS protocol settings
Get-TlsSetting

Encrypt RPC Traffic: Ensure RPC communication is encrypted using the RpcAuth protocol.

Certificate Template Security¶

Configure certificate templates to enforce security policies and restrict unauthorized issuance.
- Key Usage and Extended Key Usage: Define allowed purposes (e.g., server authentication, client authentication).
- Validity Periods: Set appropriate expiration dates to minimize risk of long-term certificate misuse.

Example:

# Modify a certificate template to restrict key usage
Set-CATemplate -Name "MyTemplate" -KeyUsage DigitalSignature, KeyEncipherment

Audit Template Usage: Regularly review template configurations to ensure compliance with organizational policies.

Monitoring and Auditing¶

Enable logging and monitoring to detect suspicious activity.
- Log CA Events: Use Event Viewer to track certificate issuance, revocation, and enrollment attempts.
- Automate Alerts: Configure PowerShell scripts or SIEM tools to alert on unusual activity (e.g., failed enrollment attempts).

Example:

# Query CA logs for failed enrollment events
Get-WinEvent -FilterHashtable @{LogName='Application'; ID=12345}

Private Key Protection¶

Secure the CA’s private key to prevent unauthorized use.
- Hardware Security Modules (HSMs): Use HSMs to store private keys and enforce cryptographic operations.
- Strong Passwords: Protect the private key with a strong password and store it in a secure location.

Key takeaways¶

Configure firewalls to restrict access to the CA server and only allow necessary ports.
Implement strict access controls and role separation to limit administrative privileges.
Enforce encrypted communication (TLS 1.2+) and disable insecure protocols.
Secure certificate templates with appropriate key usage and validity periods.
Monitor CA logs and protect private keys using HSMs or strong encryption.