Windows 2008 PKI combat 3: Certificate Services

(continued) The delegate registration agent feature allows you to accurately define what a registered agent can do and what it can't do. It allows you to delegate a temporary smart card registration for someone, like setting up a receptionist, in case a user drops his/her smart card at home.

The next added feature is called Network Device Registration Service, or SCEP, which is integrated into the local installation. This is a simple feature that allows users to register their credentials through a normal Windows installation.

Manageability is an important feature that has been greatly improved. For example, performance counters have been added to Certificate Services, allowing PKI administrators to more easily monitor the performance of CAs across the organization.

Certificate Services Manageability Demo

Windows Reliability and Performance Monitor are an MMC that provides tools for analyzing system performance. This tool provides a way to monitor and document the performance of many aspects of Windows Server 2008.

The default monitor shows the current processor usage. It is not needed in our demo. To add a performance monitor, we click the Add Counter button in the toolbar. The list of available counters will display all available counters in the operating system. Today we are concerned about certificate services.

By expanding the CA you will see a list of available options. These options will give us a better understanding of which configuration options are best for a particular environment. We will add the request processing time as our CA counter. As shown in Figure 24.

We are able to monitor our OCSP configuration and we will monitor the request processing time for this service. As shown in Figure 25.



now selected counter is displayed in the Details column again. For counters like this small data set, it would be better to view it offline as a report. As shown in Figure 26. Turning results into graphics for a large amount of data will be best.

because we will monitor only a request, which is not enough. The report shows the total processing time of the CA's request, as well as for the OCSP server.

We will create another new certificate and then monitor our results. This certificate will be a duplicate of the certificate that has been created.

In Reliability and Performance Monitor, the CA request processing time counter will now have a value. As shown in Figure 27.

The delegate registration feature in Windows Server 2008 allows for more precise configuration of delegation options than ever before. Delegate a registered agent to allow registration of agents, certificate templates, and users. Previous systems allowed PKI registration agents to register any type of certificate on behalf of anyone in the forest.

We will focus on the available features of the delegated registration agent, in its configuration. When we enable the limit we will see a warning confirming that this feature only works on Windows Server 2008 servers. As shown in Figure 28.

registered agent section allows a specified limit in a domain registered agent. These can be added or removed from the Enrollment Agents column. When you restrict the registration agent, a warning message appears, which prompts that the restrictions on the delegated registration agent can only be enforced on CAs in Windows Server 2008 and later. Before designing a delegated proxy, verify that your registered proxy policy is applicable to your PKI environment.

The Certificate Templates section allows you to restrict different registration templates in the CA. The permissions section restricts the permissions of the specified user when they are registered.