Skip to content
Posted in

PKI

Microsoft Active Directory Certificate Services (AD CS) using Azure Blob Storage

Posted byManimit Haldar 22 Minutes
Active Directory Certificate Services Two Tier PKI Hierarchy

Deploying an Active Directory Certificate Services is a straightforward way for enterprises to build their PKI infrastructure. But it does have its shortcomings, such as

  • Lack of deployment in multiple regions
  • High latency on CDP and AIA points

To overcome this, organizations need to deploy region-specific PKI infrastructure, which can be harder to maintain and introduces complexity to the whole infrastructure.

But using Azure, organizations can deploy a PKI infrastructure that can be operated worldwide with low latency and high availability.

In this article, we will be showing you how your own PKI architecture on Azure.

Note: If this is your first time deploying a PKI, I recommend following ADCS Two Tier PKI Hierarchy Deployment as it is a more straightforward approach and also touches the basics.

Prerequisites

  • An Azure account where we will create Virtual Machines and blob storage
  • A custom domain name
  • An offline Windows Server VM, which will be our Root CA

[NOTE: This is a test scenario. As such, CDP and AIA points may not match your requirements. Do use values that are appropriate as per your requirements.]

Preparing CDP and AIA points

We will create blob storage that will act as our CDP/AIA points for our PKI infrastructure. We will also associate it with our custom domain to redirect it to our blob.

Creating Azure Blob Storage

  1. First, we would need to log into our Azure account and navigate to Storage Accounts

    Azure Blob Storage

  2. We will be creating a new storage account. So click Create on the top left corner.

    storage accounts

  3. Provide the necessary details on the basics. For Redundancy, I would recommend at least Zone-redundant Storage (ZRS)

    Zone-redundant Storage (ZRS)

  4. On the Advanced tab, leave everything on default and click next

  5. On the Networking tab, it is recommended to have public access from selected virtual networks and IP addresses and select the Virtual network where all the virtual machines will be deployed. If no virtual network exists, do create one.

    Azure Networking tab
  6. On the Data Protection tab, click Next.
  7. On the Encryption tab, leave everything default and click Next.
  8. Provide relevant tags and click Next.
  9. On the review tab, you can review everything looks good and click Create.

This will create the blob storage. Next, we will associate this blob storage with our custom domain and ensure it is accessible via HTTP.

Mapping a custom domain to Azure Blog Storage

For this step, you would need a custom domain. Once you log in, you can navigate to DNS settings

  1. In DNS settings, navigate to DNS records and enter a CNAME record.

  2. Now we need to retrieve the hostname for your storage account. For this, we can navigate Settings > Endpoints on the left pane and copy the static website under Static Website. It should be something like https://pkitest.z13.web.core.windows.net (https://.z13.web.core.windows.net/)

    Remove the https:// and additional /. It would look like pkitest.z13.web.core.windows.net, which is our hostname

  3. Now in the DNS settings, for the hostname of the custom domain, provide pkitest and for the hostname, provide the hostname of the storage endpoint

    Provide custom domain

    Click to create a record

  4. Navigate to Azure Storage account, click on Networking under Security + Networking and select Custom Domain on the tab above.

  5. Provide the subdomain you created.

    Security and Networking

  6. Click Save. After successful validation, you will get a validation notification

    validation notification for azure account

Disabling secure transfer required

For this blob being a CDP/AIA point, we need HTTP access to the blog, which is why we would need to turn off the secure transfer. If enabled, HTTP access would not be possible; our PKI wouldn’t be able to use this blob as CDP/AIA point.

  1. Navigate to Configuration under Settings

  2. Set Secure Transfer Required to Disabled

    Disabling secure transfer required

  3. Click Save

Testing Accessibility of Storage Account

This section will ensure our storage account is accessible via a custom domain.

  1. First, we would create a container and upload a file to it

  2. Navigate to Containers under Data Storage

    Testing Accessibility of Storage Account

  3. On the top left corner, click

  4. Provide the name, set public level access as a blob, and click Create

    The container will be created

    public level access as a blob

  5. Click on the name and navigate inside it

  6. On the top left corner, click

  7. Select any file for testing (preferably a pdf or txt file)

    upload file in azure portal

  8. Click Upload, and once uploaded, it should be available in the container

    azure container

  9. Now, we will try to access the file using a custom domain. The URL should be

    http://<subdomain.customdomain>/<mycontainer>/<myblob>

    So for us, the domain should be

    http://pkitest.encryptionconsulting.com/pkitest/TestFile.pdf

    Ensure the file is opened in HTTP and it does display the file or downloads it

    preparing CDP and AIA points

This concludes our section on preparing CDP and AIA points. Next, we will begin creating our PKI. Now you may delete the test file from the container as it would only contain the cert and CRLs.

Creating Domain Controller

This Step-by-Step guide uses an Active Directory Domain Services (AD DS) forest named encon.com. DC01 functions as the domain controller.

Firstly, we will deploy a VM on Azure. Ensure both the IPs are static.

While deploying, ensure,

  1. VMs are deployed on the same Virtual Network
  2. If deployed on the same region, ensure the subnet is the same

  3. Public IP Address is static

    Creating Domain Controller

  4. Once the VM is created, navigate to Networking under Settings and click on the Network Interface

    Networking under Virtual Machine
    1. Navigate to IP Configuration under settings

    2. Click on ipconfig1 on the menu and change IP private settings to Static from Dynamic

      azure ipconfig1
    3. Click Save and go back to the VM

Provide other parameters as per your requirement and create the VM.

Configuring Network

Once the VM is created, log in and follow the steps below

  1. Login to DC01 as a local user
  2. Click Start, type ncpa.cpl , and press ENTER
  3. Click on Ethernet, and then click Properties under Activity
  4. Double Click on Internet Protocol Version 4 (IPv4)
  5. Only change the DNS Server Address, and provide the private IPv4 of DC01

  6. For Alternate DNS, provide 8.8.8.8 or any other public DNS service you want.

    Configuring Network in Virtual Machine
  7. Click OK and restart the VM from the Portal
  8. Once Restarted, log in to DC01 as a local user
  9. Click Start, type sysdm.cpl , and press ENTER
  10. Changer PC name to DC01, and Restart Now when prompted.

Installing Active Directory Domain Services and Adding a new Forest

  1. Open Server Manager. To do so, you can click the Server Manager icon in the toolbar or click Start, then click Server Manager.
  2. Click Manage, and then click Add Roles and Features
  3. Before you Begin, click Next
  4. On Installation Type, click Next
  5. On Server Selection, click Next
  6. On Server Roles, choose Active Directory Domain Services, click Add Features, and then click Next
  7. On Features, click Next
  8. On AD DS, click Next
  9. On Confirmation, click Install.

  10. After installation, either

    1. Click on Promote this server to a domain controller on Add Roles and Features Wizard

      Installing Active Directory Domain Services and Adding a new Forest

    2. Or, click on Promote this server to a domain controller on Post Deployment Configurations in Notifications

      Post Deployment Configurations

  11. On Deployment Configuration, choose to Add a new forest and provide the root domain name (“encon.com”)

    Deployment Configuration and Add new Forest
  12. On Domain Controller options, provide Directory Services Restore Mode password and click Next
  13. Under DNS options, click Next
  14. Under Additional options, click Next
  15. Under Paths, click Next
  16. Under Review options, click Next
  17. Under Prerequisites check, click Install
  18. Once installed, the remote connection would be terminated.

  19. Login to DC01 as encon\

    Azure Remote Desktop Connection
  20. DC01 is now ready

Creating Offline Root CA

The standalone offline root CA should not be installed in the domain. It should not even be connected to a network at all.

We will be creating this Root CA on-premises. I will create this on Proxmox, but you can use VMware or VirtualBox for this installation.

After installing Windows Server 2019, follow the steps below

  1. Log onto CA01 as CA01\Administrator.
  2. Click Start, click Run, and then type notepad C:\Windows\CAPolicy.inf and press ENTER.
  3. When prompted to create a new file, click Yes.

  4. Type in the following as contents of the file.

    [Version]
Signature="$Windows NT$"
[Certsrv_Server]
RenewalKeyLength=2048 ; recommended 4096
RenewalValidityPeriod=Years
RenewalValidityPeriodUnits=20
AlternateSignatureAlgorithm=0
  5. Click File and Save to save the CAPolicy.inf file under C:\Windows directory. Close Notepad

Installing Offline Root CA

  1. Log onto CA01 as CA01\Administrator.
  2. Click Start, and then click Server Manager.
  3. Click Manage, and then click Add Roles and Features
  4. On the Before You Begin page, click Next.
  5. On the Select Server Roles page, select Active Directory Certificate Services, and then click Next.
  6. On the Introduction to Active Directory Certificate Services page, click Next.
  7. On the Select Role Services page, ensure that Certification Authority is selected, then Next.
  8. On the Specify Setup Type page, ensure that Standalone is selected, and then click Next.
  9. On the Specify CA Type page, ensure that Root CA is selected, and then click Next.
  10. On the Set Up Private Key page, ensure that Create a new private key is selected, and then click Next.
  11. Leave the defaults on the Configure Cryptography for CA page, and click Next.
  12. On Configure CA Name page, under the Common name for this CA, clear the existing entry and type Encon Root CA. Click Next.
  13. On the Set Validity Period page, under Select validity period for the certificate generated for this CA, clear the existing entry and type 20. Leave the selection box set to Years. Click Next.
  14. Keep the default settings on the Configure Certificate Database page, and click Next.
  15. Review the settings on the Confirm Installation Selections page and then click Install.
  16. Review the information on the Installation Results page to verify that the installation is successful, and click Close.

Post Installation Configuration on Root CA

  1. Ensure that you are logged on to CA01 as CA01\Administrator.
  2. Open a command prompt. To do so, you can click Start, click Run, type cmd and then click OK.

  3. To define the Active Directory Configuration Partition Distinguished Name, run the following command from an administrative command prompt

    Certutil -setreg CA\DSConfigDN "CN=Configuration,DC=Encon,DC=com"

  4. To define CRL Period Units and CRL Period, run the following commands from an administrative command prompt:

    1. Certutil -setreg CA\CRLPeriodUnits 52
    2. Certutil -setreg CA\CRLPeriod "Weeks"
    3. Certutil -setreg CA\CRLDeltaPeriodUnits 0

  5. To define CRL Overlap Period Units and CRL Overlap Period, run the following commands from an administrative command prompt:

    1. Certutil -setreg CA\CRLOverlapPeriodUnits 12
    2. Certutil -setreg CA\CRLOverlapPeriod "Hours"

  6. To define Validity Period Units for all issued certificates by this CA, type the following command and then press Enter. In this lab, the Enterprise Issuing CA should receive a 20-year lifetime for its CA certificate. To configure this, run the following commands from an administrative command prompt:

    1. Certutil -setreg CA\ValidityPeriodUnits 20
    2. Certutil -setreg CA\ValidityPeriod "Years"

Configuration of CDP and AIA points

Multiple methods are configuring the Authority Information Access (AIA) and certificate revocation list distribution point (CDP) locations. The AIA points to the public key for the certification authority (CA). You can use the user interface (in the Properties of the CA object), certutil, or directly edit the registry. The CDP is where the certificate revocation list is maintained, which allows client computers to determine if a certificate has been revoked. This lab will have three locations for the AIA and four locations for the CDP.

Configuring AIA points

A certutil command is a quick and common method for configuring the AIA. The certutil command to set the AIA modifies the registry, so ensure that you run the command from a command prompt run as administrator. When you run the following certutil command, you will be configuring a static file system location, a HTTP location for the AIA, and a lightweight directory access path (LDAP) location. Run the following command:

certutil -setreg CA\CACertPublicationURLs "1:C:\Windows\system32\CertSrv\CertEnroll\%1_%3%4.crt\n2:http://pkitest.encryptionconsulting.com/pkitest/%1_%3%4.crt\n2:ldap:///CN=%7,CN=AIA,CN=Public Key Services,CN=Services,%6%11"

Note: You need to modify the http address on the AIA location. For this scenario, our http container address was http://pkitest.encryptionconsulting.com/pkitest/, which can vary for you.

Configuring the CDP Points

The certutil command to set the CDP modifies the registry, so ensure that you run the command from a command

certutil -setreg CA\CRLPublicationURLs "1:C:\Windows\system32\CertSrv\CertEnroll\%3%8%9.crl\n2:http://pkitest.encryptionconsulting.com/pkitest/%3%8%9.crl \n10:ldap:///CN=%7%8,CN=%2,CN=CDP,CN=Public Key Services,CN=Services,%6%10"

Note: You need to modify the http address on the CDP location. For this scenario, our http container address was http://pkitest.encryptionconsulting.com/pkitest/, which can vary for you.

At an administrative command prompt, run the following commands to restart Active Directory Certificate Services and publish the CRL

net stop certsvc && net start certsvc

certutil -crl

Creating Issuing CA

Enterprise CAs must be joined to the domain. Before you install the Enterprise Issuing CA (CA02), you must first join the server to the domain. Then you can install the Certification Authority role service on the server.

Firstly, we will deploy a VM on Azure. Ensure both the IPs are static.

While deploying, ensure,

  1. VMs are deployed on the same Virtual Network
  2. If deployed on the same region, ensure the subnet is the same

  3. Public IP Address is static

    Certification Authority role service

  4. Once the VM is created, navigate to Networking under Settings and click on the Network Interface

    5. Network Interface
    1. Navigate to IP Configuration under settings

    2. Click on ipconfig1 on the menu and change IP private settings to Static from Dynamic

      CA Private settings
    3. Click Save and go back to the VM

    Provide other parameters as per your requirement and create the VM.

    Enterprise PKI Services

    Get complete end-to-end consultation support for all your PKI requirements!

    Learn More

    Configuring Network

    1. Login to CA02 as a local user
    2. Click Start, type ncpa.cpl, and press ENTER
    3. Click on Ethernet, and then click Properties under Activity
    4. Double Click on Internet Protocol Version 4 (IPv4)

    5. Only change the DNS Server Address, and provide the private IPv4 of DC01 (if both belong to the same region), or provide the public IP address of DC01 (if they belong to different regions)

      IP address of DC01
    6. Click OK and restart the VM from the Portal
    7. Once Restarted, log in to CA02 as a local user
    8. Click Start, type sysdm.cpl, and press ENTER

    9. Changer PC name to CA02 and provide domain name in the domain. Provide credentials for DC01 and wait until you get a success message

      Issuing CA Configuring Domain
    10. Click on Restart Now when prompted.

    Creating CAPolicy in Issuing CA

    1. Log onto CA01 as CA01\Administrator.
    2. Click Start, click Run, and then type notepad C:\Windows\CAPolicy.inf and press ENTER.
    3. When prompted to create a new file, click Yes.

    4. Type in the following as contents of the file.

      [Version]
Signature="$Windows NT$"
[PolicyStatementExtension]
Policies=InternalPolicy
[InternalPolicy]
OID= 1.2.3.4.1455.67.89.5
URL= http://pkitest.encryptionconsulting.com/pkitest/cps.txt
[Certsrv_Server]
RenewalKeyLength=2048
RenewalValidityPeriod=Years
RenewalValidityPeriodUnits=10
LoadDefaultTemplates=0
    5. Click File and Save to save the CAPolicy.inf file under C:\Windows directory. Close Notepad

    Publishing Root CA Certificates and CRLs in CA02

    1. Log into CA01 as a local administrator
    2. Navigate to C:\Windows\System32\CertSrv\CertEnroll

    3. Copy the CRLs and Certificates present

      Root CA Certificates and CRLs in CA02

    4. Paste the files into the C drive in CA02

      Note: If you are using RDP, you can copy and paste directly

    5. On CA02, to publish Encon Root CA Certificate and CRL in Active Directory, run the following commands at an administrative command prompt.

              certutil -f -dspublish "C:\CA01_Encon Root CA.crt" RootCA
        certutil -f -dspublish "C:\Encon Root CA.crl" CA01

    6. To add Fabrikam Root CA Certificate and CRL in CA02.Fabrikam.com local store, run the following command from an administrative command prompt.

          certutil -addstore -f root "C:\CA01_Encon Root CA.crt"
    certutil -addstore -f root "C:\Encon Root CA.crl"

    Installing Issuing CA

    1. Ensure you are logged in as Encon User in CA02

    2. Click Start, and then click Server Manager

    3. Click Manage, and then click Add Roles and Features

    4. Click Next on Before you Begin

      Installing Issuing CA

    5. On Installation Type, click Next

      issuing CA - Installation type

    6. On Server Selection, click Next

      Destination Server

    7. On Server Roles, choose Active Directory Certificate Services, click on Add Features when prompted and click Next

      Add features - AD CS

    8. On Features, click Next

      CA Features

    9. On AD CS, click Next.

      Active Directory Certificate Services

    10. On Role Services, Choose Certificate Authority Web Enrollment, click on Add Features when prompted, and click Next

      Certificate Authority Web Enrollment

    11. On Web Server Role (IIS) and Role Services, click Next

      Web Server Role (IIS) and Role Services

    12. On Confirmation, click Install

      Web Server (IIS)

    Configuration of Issuing CA

    1. After installation, either

      1. Click on Configure Active Directory Certificate Services on the destination server in Add Roles and Features Wizard

        Configuration of Issuing CA

      2. Or, click on Configure Active Directory Certificate Services on Notification Center

        AD CS Notification Center

    2. On Credentials, click Next

      AD CS credentials

    3. Under Role Services, choose both Certificate Authority as well as Certificate Authority Web Enrollment

      AD CS Role Services

    4. On Setup type, ensure Enterprise CA is chosen and click Next

      Enterprise CA

    5. On CA Type, choose Subordinate CA, and click Next

      AD CS - CA type

    6. On Private Key, choose to Create a new private key

      AD CS - Specify the type of private key

    7. On Cryptography, leave defaults and click Next

      AD CS - cryptography options

    8. On CA Name, provide Common Name as Encon Issuing CA and leave the everything default value.

      AD CS - CA Name

    9. On Certificate Request, ensure Save a certificate request to file is selected and click Next

      AD CS - Certificate Request

    10. On Certificate Database, click Next

      AD CS - Certificate Database

    11. On Confirmation after reviewing, Click Configure

      AD CS Configuration

    12. Issuing CA should now be configured. Click Close.

      AD CS configuration results

    13. After Issuing CA is configured, a file will appear on the C drive. Copy this file to C drive in Root CA.

      Issuing CA is configured

    Issue Encon Issuing CA Certificate

    1. Copy Issuing CA req file to Root CA C drive
    2. Open Command Prompt

    3. Run the command

      certreq -submit "C:\CA02.encon.com_encon-CA02-CA.req"

    4. Select Root CA from the Certification Authority List

      Encon Root CA

    5. Once a request is submitted, you will get a RequestID

      Certificate Request

    6. Open Certificate Authority from Tools in Server Manager

      Certificate Authority tools

    7. Navigate to Pending Requests

      Encon Root CA - pending request

    8. Right Click on the RequestID that you got while submitting the request, click All Tasks, and click Issue

      Choose Certificate Authority

    9. Once issued, navigate to the command prompt again, and run

      certreq -retrieve 2 "C:\CA02.encon.com_Encon Issuing CA.crt"

    10. Select Root CA from the Certification Authority List

      Encon Root CA

    11. Once retrieved, the successful message is displayed

      certification request ID

    12. Copy the issued certificate from Root CA to CA02

      issued certificate from Root CA to CA02

    13. Login to CA02 as an Encon user and copy the certificate to the C drive

    14. Open Certificate Authority from Tools in Server Manager

      Certificate Authority tools

    15. Right-click on Encon Issuing CA, click on All Tasks, and click Install CA Certificate

      Install CA Certificate

    16. Navigate to C drive, and select All files beside File name until the copied certificate is visible

      copy certificates

    17. Select the issued certificate and click Open

      Right-click on Encon Issuing CA, click on All Tasks, and click Start Service

      Encon Issuing CA

    Post Installation Configuration on Issuing CA

    1. Ensure that you are logged on to CA02 as Encon User
    2. Open a command prompt. To do so, you can click Start, click Run, type cmd and then click OK.

    3. To define CRL Period Units and CRL Period, run the following commands from an administrative command prompt:

      1. Certutil -setreg CA\CRLPeriodUnits 1
      2. Certutil -setreg CA\CRLPeriod “Weeks”
      3. Certutil -setreg CA\CRLDeltaPeriodUnits 1
      4. Certutil -setreg CA\CRLDeltaPeriod “Days”

    4. To define CRL Overlap Period Units and CRL Overlap Period, run the following commands from an administrative command prompt:

      1. Certutil -setreg CA\CRLOverlapPeriodUnits 12
      2. Certutil -setreg CA\CRLOverlapPeriod “Hours”

    5. To define Validity Period Units for all issued certificates by this CA, type the following command and then press Enter. In this lab, the Enterprise Issuing CA should receive a 20-year lifetime for its CA certificate. To configure this, run the following commands from an administrative command prompt:

      1. Certutil -setreg CA\ValidityPeriodUnits 5
      2. Certutil -setreg CA\ValidityPeriod “Years”

    Configuration of CDP and AIA points

    Multiple methods are configuring the Authority Information Access (AIA) and certificate revocation list distribution point (CDP) locations. The AIA points to the public key for the certification authority (CA). You can use the user interface (in the Properties of the CA object), certutil, or directly edit the registry.

    The CDP is where the certificate revocation list is maintained, which allows client computers to determine if a certificate has been revoked. This lab will have three locations for the AIA and three for the CDP.

    Configuring AIA points

    A certutil command is a quick and common method for configuring the AIA. The certutil command to set the AIA modifies the registry, so ensure that you run the command from a command prompt run as administrator.

    When you run the following certutil command, you will be configuring a static file system location, a HTTP location for the AIA, and a lightweight directory access path (LDAP) location. Run the following command:

    certutil -setreg CA\CACertPublicationURLs “1:C:\Windows\system32\CertSrv\CertEnroll\%1_%3%4.crt\n2:http://pkitest.encryptionconsulting.com/pkitest/%1_%3%4.crt\n2:ldap:///CN=%7,CN=AIA,CN=Public Key Services,CN=Services,%6%11”

    Note: You need to modify the http address on the AIA location. For this scenario, our http container address was http://pkitest.encryptionconsulting.com/pkitest/, which can vary for you.

    Configuring the CDP Points

    The certutil command to set the CDP modifies the registry, so ensure that you run the command from a command

    certutil -setreg CA\CRLPublicationURLs “65:C:\Windows\system32\CertSrv\CertEnroll\%3%8%9.crl\n2:http://pkitest.encryptionconsulting.com/pkitest/CertEnroll/%3%8%9.crl\n79:ldap:///CN=%7%8,CN=%2,CN=CDP,CN=Public Key Services,CN=Services,%6%10”

    Note: You need to modify the http address on the CDP location. For this scenario, our http container address was http://pkitest.encryptionconsulting.com/pkitest/, which can vary for you.

    Also, as per the CDP point, the CertEnroll folder will exist inside the pkitest container in Azure Blob. This is because the folder will be recursively copied from the CertSrv folder to the blob storage

    At an administrative command prompt, run the following commands to restart Active Directory Certificate Services and publish the CRL

    net stop certsvc & &net start certsvc

    certutil -crl

    Enterprise PKI Services

    Get complete end-to-end consultation support for all your PKI requirements!

    Learn More

    Uploading Certificates and CRLs to the Blob storage

    Per our CDP and AIA points, the certificates would be available at the blob storage in Azure. If we run PKIView.msc at Issuing CA, we will run into errors where the certificates or CRLs are not found

    Uploading Certificates and CRLs to the Blob storage

    To resolve this, we need to upload

    • Root CA certificates
    • Root CA CRL
    • Issuing CA Certificates

    Issuing CA CRLs will be uploaded using a script we will run next.

    To upload the files, copy them from their respective machines and keep them handy on your host machine. You can find these files at C:\Windows\System32\certsrv\CertEnroll on both Root CA and issuing CA.

    Note: Do not copy the CRLs of Issuing CA.

    Issuing CA CRLs

    Once copied, follow the steps below

    1. Navigate to the storage account, and click on the pkitest you created

      Azure Storage account

    2. Click on Containers under Data Storage

      Azure Containers
    3. Click on the pkitest folder

    4. Click on Upload on the top left

      Azure AD Accounts

    5. Click on the browse icon and select all the files that need to be uploaded and click Open

      Microsoft Azure - upload files

    6. Check to Overwrite if files already exist and then click Upload

      Microsoft azure - upload files

    7. After uploading, all the files should be available

      CA02

    Once the files are uploaded, navigate to CA02 and open PKIView.msc again. Now CDP points of Root and Issuing CA should be available, but the AIA point would still show an error as we didn’t copy those files to the pkitest folder

    CDP points of Root and Issuing CA

    Script to copy Issuing CA CRLs

    Before we begin, we need to download AzCopy. Once downloaded, extract the app into C:\ to be accessible. We will be using this location on our script. Change the script’s path if you intend to store the application in a different location.

    AZCopyCode

    Now you would also need a folder to store the code. I would recommend creating a folder on C drive as AZCopyCode. Download the script from below and store it there. We would need to make some changes to make it work.

    Note: This code was initially created by dstreefkerk. As per Windows Server 2022, this code does work. I have made some changes and fixed a few bugs.

    Code: https://github.com/Encryption-Consulting-LLC/AzCopyCode/blob/main/Invoke-UpdateAzureBlobPKIStorage.ps1

    Github Gist to be embedded:

    <script src=”https://gist.github.com/coffee-coded/4cbeb0de02628bc2da6b182dc11bad0b.js”></script>

    Code Changes

    1. Navigate to the storage account, and click on the pkitest you created

      Azure Storage account

    2. Click on Containers under Data Storage

      Azure Containers
    3. Click on the pkitest folder

    4. Click on Shared Access Token under Settings. Provide appropriate permissions, and choose an expiry date (preferably one year)

      Shared Access Token
    5. Click Generate SAS token and copy Blob SAS Token
    6. Open the code in notepad or your preferred code editor

    7. Paste the SAS token for the variable

      $azCopyDestinationSASKey

    8. Navigate to properties under Settings, copy the URL and paste it for $azCopyDestination
    9. Change log and log archive locations if applicable.
    10. Change AzCopy location on $azCopyBinaryPath if you stored azcopy in another location.
    11. Once changes are made, store them in C:\AZCopyCode\Invoke-UpdateAzureBlobPKIStorage.ps1
    12. Open Powershell in CA02
    13. Navigate to C:\AZCopyCode
    14. Run Invoke-UpdateAzureBlobPKIStorage.ps1

    15. Once copied, it will show how many files are copied, with 100% and all done with 0 Failed

      Update Azure Blob storage

    16. Open PKIView.msc, and now no errors should be visible

      PKI View with no errors

    17. The overall PKI should be healthy.

      PKIView.msc

    Troubleshooting

    For this scenario, we suppose you get an error

    CDP Locations

    Copy the URL by right-clicking on the location and copying it to a notepad. It should look something like this

    http://pkitest.encryptionconsulting.com/pkitest/Encon%20Root%20CA.crl%20

    If you try opening this on the browser, it would still give an error as there is a trailing %20 at the end, indicating a space at the end. To resolve this, CDP and AIA points need to be changed on Root CA, and the issuing CA needs to be recreated again.

    Automating the script

    We would automate this script using Task Scheduler to run this script every week. You can tweak this as per your requirements.

    1. Open Task Scheduler

    2. Left click on Task Scheduler (local) and click on Create a Basic Task

      ADCS - Task Scheduler

    3. Provide name and description for the Task

      Provide name and description for the Task

    4. Task Trigger is configured to weekly

      ADCS - Task Trigger

    5. Select Data and Time when the script will run

      ADCS - automatic script

    6. On Action, select Start A program and click Next

      ADCS - Start A program

    7. Under Start, a Program, In Program/Script write

      powershell -file "C:\AZCopyCode\Invoke-UpdateAzureBlobPKIStorage.ps1"
      ADCS - er shell

    8. Click yes on the prompt

      Blob PKI Storage

    9. Check the Open Properties dialog and click Finish

      ADCS - Wizard Properties

    10. Once completed, AZ Copy should be available in Task Scheduler Library.

      AZ Copy available in Task Scheduler Library

    11. Right Click AZ Copy and click Run

    12. Refresh and check History Tab. Action Completed should appear in History

      ADCS full installation

    Conclusion

    This concludes our AD CS installation with Azure Blob Storage. It is easier to manage, but we also achieve high availability using Azure’s Blob Storage. This will help organizations create PKI that can be operational worldwide with minimal latency and high performance no matter where you are. If you face any issues, do remember to reach out to info@encryptionconsulting.com

Discover Our

Related Blogs

Strong Certificate Mapping

March 3, 2025

Microsoft’s Strong Certificate Mapping Enforcement — What It Means for Your PKI and How to Prepare

Read More
PKI Modernizing

February 21, 2025

Modernizing PKI to Prepare for PQC

Read More
Everything about PKIaas

October 9, 2024

Why Organizations Need PKI-as-a-Service

Read More

Explore

More Topics