Home / server / Questions / 1005252
In Process
StanTastic
Asked: 2020-03-03 01:22:50 +0800 CST

Deploying in-house ACME server for Microsoft ADCS?

  • 772

I'm quite new to ACME, but already somewhat experienced with ADCS (Active Directory Certificate Services).

We use ADCS for all our internal needs: client auth, VPN, EFS etc., also for issuing TLS certificates.

Now, you may have already heard that Apple will no longer honor certificates with >1 year lifetime starting September 1st; this will put some strain on our limited webmaster resources (and to add insult to injury, every department has their own webmasters). I figured that maybe the easy way out is to implement in-house ACME using ADCS, but after some googling I have to admit I haven't found a solution that does it. Is it my poor googling skills, or there's just no such software?

ad-certificate-services

4 Answers

  1. Microsoft ADCS does not support ACME nateively and I'm not aware of any 3rd party connector that integrates ACME with ADCS.

    Microsoft ADCS supports Enrollment Web Services that use SOAP WS-* transport and is defined in two protocol specifications: [MS-XCEP] and [MS-WSTEP].

    In internal environments and external (workgroups when using enrollment web services) envrionments, it is possible to use certificate autoenrollment functionality that performs initial certificate provisioning and automatic certificate renewal. I wrote a technical whitepaper about how certificate autoenrollment works: Certificate Autoenrollment in Windows Server 2016. The blog post contains a link to a downloadable copy of the document.

    • 1

  2. There is, as far as I know, any good way to directly get a certificate from an internal Microsoft certificate authority via ACME.

    But what you could do is run your own ACME server to issue certificates. It's signing certificate could be signed by your root certificate. So all your clients will trust certs it issues. There are a few ACME servers to choose from.

    • 1

  3. Apple will no longer honor certificates with >1 year lifetime starting September 1st

    While this is true, it only applies to certs issued via the set of publicly trusted root CAs that come with the OS. Your internal CA can continue issuing multi-year certs without any problems. Here's a support article direct from Apple about it.

    If you're still looking for an ACME server that can interface with ADCS, here's a project on Github that is supposed to be able to do it. But I haven't played with it, so I don't know how complete it is.

    https://github.com/glatzert/ACME-Server-ACDS

    Grant's answer about standing up a standalone ACME compatible CA that is a sub-CA of your internal root would also work and might actually be easier depending on your environment.

    • 1

  4. I have been able to close that gap with a GitHub project.

    https://github.com/grindsa/acme2certifier

    It serves the purpose of ACME proxy for those CA servers that don't support ACME natively quite well. The integration with ADCS is simple through the Web enrollment service. All you need is a service account and the certificate template on ADCS you want to use.

    The project even has support for External account binding so you can authenticate the requests towards the ACME proxy.

    • 1