Securing Windows Server 2003

Implementing a Public PKI

Now that you’ve decided to use a public certification authority and outsource your PKI, you must determine how to incorporate it into your current environment. The vendor you’ve selected will undoubtedly provide a great deal of consultation and advice on how best to configure your environment to interact with its hierarchy. Because the public certification authority could be running any CA server and client software to create and maintain its certification hierarchy, at some points I cannot provide detailed steps. I will not assume that you’ve chosen any particular public authority or software, as there is no single best vendor among the numerous options. Therefore, our procedures will focus on Windows Server 2003 family servers and Windows XP client computers. I can summarize the elements of this type of deployment as follows:

1. Set up a secure communication channel between your network and the vendor’s. This is normally handled by the vendor.

2. Configure the certificate revocation list (CRL) to be published to a location accessible to your network’s subjects and verify its publication. This is normally established with agreement between you and the vendor, as you may want the CRL published to a specific point within your network to reduce bandwidth usage.

3. Verify exactly who needs a certificate and what its intended use will be. This should have already been completed in your planning process based on a risk and needs analysis and incorporated into your vendor ...