4. Configuring Additional CA Server Settings
You need to complete some important tasks while you
are working on a certificate server. At this point, you have learned
how to install an Enterprise Root CA, configure automatic certificate
requests, set up web enrollment, and revoke a certificate. We will
finish this section by covering some of the following tasks:
Key archival
Key archival allows a key to be stored for later
recoverability if necessary. In a Windows Server 2008 CA, key archival
is automatic. The private key portion of a public-private key pair is
archived and can be recovered when needed.
Note that when a private key is recovered, the data
or messages that it was associated with are not recovered. Key recovery
only allows an individual to recover lost or damaged keys and allows an
administrator to assume the role of an account for data access or
recovery.
Key recovery agent
The key recovery agent is a role (a set of rights) that you can give an individual so that they have the permission to recover a lost or damaged key.
Assigning administrative roles
Using the Certificate Authority MMC, you can assign users or administrators rights to help manage the certificate server.
To assign an individual a role, right-click the name
of the server in the Certificate Authority MMC and choose Properties.
Click the Security tab. Add the individual and choose their roles.
Database backup and restore
One task that all administrators need to perform
is backing up and restoring the certificates and keys. To back up and
restore certificates, you use the Certificate Authority MMC. Exercise 5 will walk you through backing up your Certificate Authority server.
Open the Certificate Authority MMC by selecting Start => Administrative Tools => Certificate Authority. In the left pane, right-click the name of the server, then choose All Tasks => Back Up CA.
When the Certificate Authority Backup Wizard appears, click Next. At
the Items To Back Up screen, click the Private Key And CA Certificate
check box. Next to the Back Up To This Location field, click the Browse
button. Choose a location for your backup and click OK. Click Next.
At the Select A Password screen, enter and confirm a password. For this exercise use P@ssw0rd. Click Next.
At the Completing The Certificate Authority Backup Wizard screen, click Finish.
Close the Certificate Authority MMC.
|
