I'm on my Windows ten management VM and where possible this is where we'll be doing the configuration
of the servers from will be using the Windows Admin Center, which is a download from Microsoft as well
as server manager, which is installed using the remote server administration tools.
Let's open up server manager and let's add the domain controller because I've installed Active Directory
Certificate Services there.
All right, click on all servers and add a server.
Because this Windows ten VM is joined to the domain.
I can type in the name of the domain controller, which is DC and it's found.
So let's add this server to the list of servers we want to manage.
It'll take a second to resolve and the server gets added to the list.
Now I can open tools and certificate authorities listed here if you don't see links here for some of
the roles installed on the server, like the DNS role which will be using in the upcoming demo, Microsoft
provides a workaround with some scripts to install the RSA tools.
I've created a short link here to that information.
Let's open up certificate authority and we'll get this error because by default the snap and tries to
attach to the local computer certificate authority and of course Certificate Services isn't installed
on this Windows ten VM.
So let's click.
Okay.
And when the window opens, you right click on the Certification Authority and select re target certification
authority, then select another computer and we could type in the name of the server with Active Directory
Certificate Services installed, which is the domain controller.
But let's clear this and browse instead.
The Certificate Authority installed on the network is picked up.
So let's select that same domain controller computer with ADCs installed and now we can manage the certificate
authority.
Let's go down to certificate templates and right click and select manage.
This opens up the cert template console.
We're going to issue a certificate with the requirements we need for ADF's.
So let's make a copy of another certificate as a starting place.
I'll choose the web server certificate because the ad FS certificate will have most of the same properties.
So let's duplicate this template and I'll go to the general tab and change the display name for the
new certificate template on the subject name tab.
Let's make sure we can supply the subject name in the certificate request.
Now on the security tab, we want to add domain computers, which is a group and Active Directory containing
all the computers in the domain.
Then we'll check the permission so the domain computers can enroll for this certificate.
The extensions we need for this certificate are already included because we created this template by
duplicating the web server certificate template.
Under request handling, we need to check to allow the private key to be exported because when we request
and create the actual certificate, we'll need to exported with the private key and imported into that
add FS server as well as the web application proxy servers.
Now let's click apply and okay.
Now before you can actually request certificates to be created with this template, you need to close
this template console.
And back in the certificate manager console, right click on certificate templates again, but this
time select new certificate template to issue.
There's the ad FS template we just created, so let's select that and click.
Okay.
Now this template is ready to be used to create certificates.
Let's close this.
And I'm still on my Windows ten Management VM.
So let's search for certificates.
And in the search results, select manage computer certificates.
That opens up the Microsoft management console with the certificate snap and loaded and scoped to this
local computer certificate store.
Let's open up the personal store and we're going to use this computer to create a certificate that we'll
export from here and import onto the ADF's server.
So.
All right, click on the personal store.
And under all tasks select to request new certificate.
The certificate enrollment dialog opens.
I'll click next in next again.
And here are the certificate templates that are available to domain computers, including this Windows
ten VM.
Let's choose the ad FS Template Certificate and click the link to configure its settings.
For the subject name, let's choose common name and the value will be the name of the ADF first service.
This is important.
This isn't the name of the server because you can have multiple ADF's servers in a farm and they all
share the same certificate and the same service name.
So we want to use the service name.
The name I'm going to use is asked company dot pre will be creating a DNS record to point this domain
name to the single ADF RFS server in the farm.
Or if there are multiple servers, the DNS record will point to the load balancer.
Let's add this.
And now we need to configure some alternative names.
The first DNS name will be the same as the subject name.
Now these next two subject alternative name DNS values are specific to certain authentication scenarios.
For device registration, you need to include the prefix enterprise registration.
If you plan to use certificate authentication, for example, using smart cards, there's another DNS
value you can add if you want the certificate authentication to take place on Port 443.
There's actually two modes available for certificate authentication either using the same hostname,
but with different ports.
So certificate authentication would use port 49443.
Or another approach is to use the same port with different hostnames.
So certificate authentication can still take place on port 443, which makes it easier for networks
that might have restrictions on non-standard ports and for certificate authentication.
ADF's will use the hostname certain off then the name of your ADF's service.
Okay, let's go to the general tab and give the certificate a friendly name for the interface on the
private key tab.
Let's just make sure the private key is marked as exportable, which it is by default in the template.
Our setup is pretty simple.
So the default enrollment server is already selected.
Now let's click apply and okay.
And let's finish the creation of this certificate.
Now the certificate has been installed on this Windows ten VM.
But of course, this isn't where we want it ultimately installed.
We wanted on the ADF's server.
So let's right click this certificate and select all tasks and export that opens the certificate export
wizard.
I'll click next.
And yes, we want to export the private key because that will be needed on the ADF's server.
Let's export the extended properties and it will be a file that we create.
I'll use a password to protect the private key and leave the default encryption.
Let's save the exported certificate to the desktop to make it easy to find and click save and next and
finish.
It says the export was successful.
Let's just go to the desktop and there's our SSL certificate.
Now let's copy this certificate over to the ad FS server to be used during ad fs configuration.
I created a file share on the ad fs server and gave permissions to my administrator account to access
it.
So I'll type in the share name on the network and now paste in the certificate.
This share was created as a folder at the root of the C drive on the ADF's server.
So we can access the certificate there using PowerShell when we install ADF's.
So let's do that in the next clip.