Publish Root CA CRL to network drive

isuckatservers69

10/31/23, 3:00 PM

I am currently "prototyping" a Windows PKI with AD CS Role. I have two-tier hierarchy (Root Offline CA -> Enterprise Sub-CA -> Digital Certs).

Furthermore, I am trying to publish the CRL of my Root CA to a network drive. Let me explain my setup:

I have a Domain-Controller (DCVS01), serving for the domain foonet.local. Additionally, I have a Windows Server 2019 (WS01) which is in the domain. This Server runs IIS and shares the wwwroot\CertEnroll folder and with that creating a network share. The last server I have is the Windows Server (WS02) which is not joined in the Domain and also has the AD CS Installed for the Root Offline CA.

I am currently configuring the CRL for WS02 (The Root CA). I have correctly mounted the network drive with the following command: net use Z: \\IP_ADDRESS\CertEnroll /persistent:yes /user:service.crlshare PASSWORD

(I created a service account in the domain with the name service.crlshare)

I have tested it and I can write, read without an issue. The IIS Server is also reachable. When I try to add the Network-Share to the CRL-Settings for publishing, it does not work. Here are all the distribution points/paths I tried:

Z:\<CaName><CRLNameSuffix><DeltaCRLAllowed>.crl

file://\\IP_ADDRESS\CertEnroll\<CaName><CRLNameSuffix><DeltaCRLAllowed>.crl

\\IP_ADDRESS\CertEnroll\<CaName><CRLNameSuffix><DeltaCRLAllowed>.crl

Upon trying to publish, I get the following error: The directory name is invalid. 0x8007010b (WIN32/HTTP: 267 ERROR_DIRECTORY)

Besides the different CDP's, here is what I tried:

Make sure permissions are alright (WS02 can read & write to the network drive)
Make sure the network drive is mounted so that no auth is needed since it's mounted
Check permissions on WS01 (service.crlshare) has permissions to read and modify
Checked if the WS01 is accessible (network-wise) by WS02 is accessible
Files are served correctly by the Webserver (IIS)

Is it even possible to publish it the way I thought of it? I can not find any error in my setup. Thanks for the help in advance

547

1 + 3

windows

active-directory

pki

active-directory-adcs

garethTheRed

10/31/23, 6:31 PM

That isn't an Offline Root CA - that's an Online Root CA which isn't joined to a domain. USB sticks, CD/DVDs, or similar are the way to export a CRL from an _Offline_ CA. Remember that the CA service runs as SYSTEM, not your service account.

isuckatservers69

11/1/23, 9:16 AM

Since the CA runs as SYSTEM, I assume i cannot authenticate/allow the SYSTEM of WS02 to push to the network share in this case?

garethTheRed

11/1/23, 4:59 PM

I believe the SYSTEM accounts acts as the computer on the network. If you insist that your _offline_ CA can be online, then you could try adding the computer to the ACLs of the share.

Score:0

Server

CryptoDan

11/3/23, 5:10 AM

You can bypass this problem using WINRM for copying the file.

It is more secure then SMB, you ca also manage the credential you use, and you can trigger the copy process using a schedule task that detects event ID 4872. This event indicates a new crl file was published.

+ 0

Elon Musk

I sit in a Tesla and translated this thread with Ai:

EN: Publish Root CA CRL to network drive

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.