OpsMgr2007 Certificate Management

= 1&nb= sp; Introduction<= span lang=3DEN-AU style=3D'text-transform:uppercase'>

The purpose of this document is to = provide practical guidance for deploying a System Center Operations Manager 2007 infrastructure that is designed to manage computers that are in Workgroups = and un-trusted Domains.

1.1 &= nbsp; Authentication and Encryp= tion is Required<= /span>

Agent-Server mutual authentication = and encryption is mandated in for all agent-Server communication. Kerberos authentication is the default mechanism used for this purpose in System Cen= ter Operations Manager 2007.

Since Kerberos authentication can o= nly occur within a trust boundary, Active Directory Domains form the basic unit= of a Kerberos trust boundary as seen by System Center Operations Manager 2007. This boundary is automatically expanded to other Domains in the same name s= pace (the same Active Directory Tree), and between Domains that are in different Active Directory Trees but still in the same Active Directory Forest, via transitive trusts. An Active Directory Domain administrator is also able to explicitly form trust relationships between Domains or Forests, if required= .

In environments where trust relatio= nships cannot be established, because the computers are configured in Workgroups or different Domains that are isolated for security reasons, System Center Operations Manager 2007 can use Digital Certificates to perform authenticat= ion and encryption.

1.2&= nbsp; Operations Manager Certif= icate Usage

When System Center Operations Manag= er 2007 communication needs to occur across trust boundaries, such as when a server that you want to monitor lies in a Workgroup or an un-trusted Domain, Certificates can be used to satisfy the mutual authentication requirement. Through manual or scripted configuration, Certificates can be obtained and associated with the computers and the Operations Manager services running on them. When a service that needs to communicate with a service on a different computer starts and attempts to authenticate, the Certificates will be exchanged and mutual authentication completed. The Certificates used for this purpose must trust the same Root Certification Authority (CA) Chain and adhere to a specific format for Serv= er Authentication, Client Authentication and Information Exchange (encryption)= .

1.3 Infrastructure and Deploy= ment Implications

The implicatio= n of this is that any computers that must communicate across the trust boundary = must have Certificates installed, including the Management Server, in order to communicate successfully. Therefore, the following must be considered:=

¾&nb= sp; An Enterprise or Standalone Certification Authority must be available, or installed and configured, to generate the required Certificates

¾&nb= sp; The Root CA Certificate is the same for a= ll computers, but each computer also needs a unique Operations Manager Certifi= cate that is generated for it

¾&nb= sp; Standard procedures for requesting and is= suing the Certificates must be established and deployment mechanism for installing the Root CA Certificate and the Operations Manager Certificate must be decided upon

¾&nb= sp; Agent deployment must be performed manual= ly or via a different deployment mechanism, such as Systems Management Server, as= you cannot use the built-in Discovery and Deployment mechanism across trust boundaries

2 = Certificate Implementation

2.1 Requirements and Format

In order to manage servers in a Wor= kgroup, the Management Servers and the managed servers must have Certificates insta= lled on them. When you obtain and install Certificates for use with System Center Operations Manager 2007, be mindful of the following:

¾ Certificates used on various components in Operations Manager = 2007 (for example, agent, Gateway Server, Management Server, or Root Management Server) must be issued by the same Root Certification Authority (CA).

¾ Each computer must contain the Root CA Certificate in its Trus= ted Root Certification Authorities store and any intermediate Certification Authorities in the Intermediate Certification Authorities store, so the Roo= t CA Certificate Chain must be installed.

¾ Each computer requires its own unique Operations Manager Certificate.

¾ The Subject Name field for the Operations Manager Certificate = must contain the DNS fully qualified domain name (FQDN) or the NetBIOS name of t= he host computer the Certificate is destined for.

¾ The Certificate must be in PFX (PKCS#12) format and include the Certificate's private key.

¾ The Certificates need to support the following two extended key usage fields, server authentication and client authentication, which are represented by the two OIDs 1.3.6.1.5.5.7.3.1 and 1.3.6.1.5.5.7.3.2.=

Note: When entering OIDs, separate = each OID by a comma. For example, enter 1.3.6.1.5.5.7.3.1,1.3.6.1.5.5.7.3.2.

If using an Enterprise Certification Authority based on Windows Certificate Services, you may create a Certifica= te template to simplify the request process.

2.2 Deployment Process=

The high-level process for Certific= ate deployment is:

1. Export the Root CA Certificate Chain file=

2. On each computer, import the Root CA Certificate Chain file

3. For each computer, generate (request and = issue) a unique Operations Manager Certificate

4. On each computer, import its unique Opera= tions Manager Certificate

3 = Exporting the Root CA Certificate Chain

This proc= ess only needs to be performed once, as the same Root CA file can be used for all computers that require it. Alternatively, you can use the Certificate Servi= ces Website to download the Root CA Certificate Chain to a file.

At the Certification Authority, launch the Command Prompt and enter:

<= span lang=3DEN-AU style=3D'font-family:"Courier New"'>certutil.exe –ca.chain {path and filename}.p7b

The Root CA Certificate Chain file will be saved at the path that you provide.<= /span>

The CertUtil tool is documented at the following URL: http://technet2.mic= rosoft.com/windowsserver/en/library/a3d5dbb9-1bf6-42da-a13b-2b220b11b6fe103= 3.mspx?mfr=3Dtrue

4 &= nbsp; Importing the Root CA Certificate Chain

This process must be performed for = each server that requires a Certificate, including the Management Server(s). Alternativ= ely, you can install the Root CA Certificate using the Certificates Console as described in the previous section.

You can instal= l the Root CA via Command Line using the “CertMgr.exe” tool that ships with the .= NET Framwork 2.0 SDK. The .NET Framework 2.0 SDK from the following URL: http://www.microsoft.com/dow= nloads/details.aspx?FamilyID=3Dfe6f2099-b7b4-4f47-a244-c96d69c35dec&Dis= playLang=3Den

After installi= ng the .NET Framework 2.0 SDK, the “CertMgr.exe” tool will be located in the folder “C:\Program Files\Microsoft.NET\SDK\v2.0\BIN”

Copy the tool = to the computer where you are going to install the Root CA Certificate.=

The command li= ne parameters are:

certmgr.exe –add –all {path and filename}.p7b –s –r localmach= ine root

Include the pa= th in the name of the Root CA Certificate file.

You may use th= e –h switch to see the other command line parameters, for example:

certmgr.exe -h

5      =        Generating Operations Manager Certificates

5.1         Configure the Certificati= on Authority for Automatic Issuance

If you do not configure the Certifi= cation Authority for Automatic Issuance, Certificates will remain in a Pending mode (not issued) until an Administrator manually issues them and this will prev= ent full automation of the process. This process is only performed once on the computer that is the Certification Authority. To set the Automatic Issuance policy:

1.      Launch the Certificat= ion Authority Console, found in Ad= ministrative Tools

2.      Right click on the Root CA computer and select Properties

3.      Select the Policy Mod= ule tab and click on the Properties button

4.      Change the Request Ha= ndling property to “Follow the settings i= n the certificate template, if applicable. Otherwise automatically issue the certificate.”

5.      Click OK, then OK again to close all dialogs, th= en close the Certification Authority Console.

You will need to restart Certificat= e Services for this change to take effect, which you can find in the Services Console,= or you can use the following commands:

net stop certsvc

net start certsvc

5.2&= nbsp;        Automated (Scripted) Proc= ess

5.2.1           Script Prerequisites

In order to run the PowerShell script you must:

1.      Verify that the Certification Authority Policy is configured f= or Automatic Issuance, as described in the previous section (6.1).

2.      Have PowerShell 1.0, or later, installed on the computer hosti= ng the Certification Authority role

3.      Change the PowerShell Execution Policy to Remote Signed, or Unrestricted, to allow your scripts to run. Remote Signed is the preferred method as it is more secure than enabling the Unrestricted setting. To chan= ge the Execution Policy to Remote Signed, open a PowerShell command prompt and enter:

set-executionpolicy remote= signed

5.2.2           PowerShell Script Code

The following Powershell script will automate the Operations Manager Certificate issuance process. Copy and paste the following script into a text file with= a “.ps1” extension, and replace the values for ServerName, CAName and Password with = your own, where ServerName and CAName refer to your Certification Authority’s na= me (the name you see in the Certification Authority MMC Snap-In), and Password= is the password that will be used to secure the generated “.pfx” files with. T= he script uses a text file named “computers.txt” which contains the list of computer fully qualified domain names (FQDNs), to generate the Certificates. Place the script and file with computer names in the same folder. The Certificates will be created in the same folder that the script is executed from.

<= span lang=3DEN-AU style=3D'font-family:"Courier New"'>

<= span lang=3DEN-AU style=3D'font-family:"Courier New"'>$CAName =3D "ServerName\CAName"=

<= span lang=3DEN-AU style=3D'font-family:"Courier New"'>$password =3D "Password"

<= span lang=3DEN-AU style=3D'font-family:"Courier New"'>foreach ($comp in (Get-Con= tent computers.txt))

<= span lang=3DEN-AU style=3D'font-family:"Courier New"'>{=

<= span lang=3DEN-AU style=3D'font-family:"Courier New"'>    $inffile =3D $comp + ".inf"

<= span lang=3DEN-AU style=3D'font-family:"Courier New"'>    "[NewRequest]" >> $inffile

<= span lang=3DEN-AU style=3D'font-family:"Courier New"'>    'Subject=3D"CN=3D' + $comp + '"' >> $inffile

<= span lang=3DEN-AU style=3D'font-family:"Courier New"'>    "Exportable=3DTRUE" >> $inffile

<= span lang=3DEN-AU style=3D'font-family:"Courier New"'>    "KeyLength=3D1024" >> $inffile

<= span lang=3DEN-AU style=3D'font-family:"Courier New"'>    "KeySpec=3D1" >> $inffile

<= span lang=3DEN-AU style=3D'font-family:"Courier New"'>    "KeyUsage=3D0xf0" >> $inffile

<= span lang=3DEN-AU style=3D'font-family:"Courier New"'>    "MachineKeySet=3DTRUE" >> $inffile

<= span lang=3DEN-AU style=3D'font-family:"Courier New"'>    "[EnhancedKeyUsageExtension]" >> $inffile

<= span lang=3DEN-AU style=3D'font-family:"Courier New"'>    "OID=3D1.3.6.1.5.5.7.3.1" >> $inffile

<= span lang=3DEN-AU style=3D'font-family:"Courier New"'>    "OID=3D1.3.6.1.5.5.7.3.2" >> $inffile

<= span lang=3DEN-AU style=3D'font-family:"Courier New"'>    "[RequestAttributes]" >> $inffile

<= span lang=3DEN-AU style=3D'font-family:"Courier New"'>    'CertificateTemplate=3D"ComputerOffline"' >> $inffile

<= span lang=3DEN-AU style=3D'font-family:"Courier New"'>    $reqfile =3D $comp + ".req"

<= span lang=3DEN-AU style=3D'font-family:"Courier New"'>    $certfile =3D $comp + ".cer"             <= /span>

<= span lang=3DEN-AU style=3D'font-family:"Courier New"'>    $pfxname =3D $comp + ".pfx"

<= span lang=3DEN-AU style=3D'font-family:"Courier New"'>    certreq -New $inffile $reqfile

<= span lang=3DEN-AU style=3D'font-family:"Courier New"'>    certreq -Submit -config "$CAName" $reqfile $certfile

<= span lang=3DEN-AU style=3D'font-family:"Courier New"'>    certreq -accept $certfile

<= span lang=3DEN-AU style=3D'font-family:"Courier New"'>    certutil -exportpfx -p $password $comp $pfxname

<= span lang=3DEN-AU style=3D'font-family:"Courier New"'>    certutil -delstore my $comp

<= span lang=3DEN-AU style=3D'font-family:"Courier New"'>}=

<= span lang=3DEN-AU style=3D'font-family:"Courier New"'>

5.2.3           Running the Script=

1.      Create a text file that lists all of the computers that you wo= uld like to generate Certificates for. It is recommended to use the computers’ fully qualified domain names (FQDNs), or NetBIOS names if they are configur= ed in a Workgroup.

2.      Place the script and text file in the same folder on the compu= ter hosting the Certification Authority, or on a share that the script can be executed from.

3.      Change the script parameters to meet your needs: the CA Server= Name, CA Name, Password, and name of the computer list file

4.      To run the script, at the computer hosting the Certification Authority role, launch the PowerShell command prompt and enter:

{path\scriptfile}.ps1

If you navigate to the path of the script file folder first, y= ou may use dot-notation like this:

.\{scriptfile}<= /b>.ps1

...replacing path with the folder path to t= he script, and scriptfile with the name of the script

The Certificates (.pfx files) that= are generated will be saved in the same folder that the script is executed from= .

6          &= nbsp; Importing Operations Manager Certificates

After you have received the Certifi= cate files (.pfx) and corresponding passwords, the “MOMCertImport.exe” command-line tool must be used to config= ure the Operations Manager service to use the Certificate. The tool can be foun= d on the SCOM 2007 installation media. The 32-bit version is in \SupportTools\i386, and the 64-bit version is in \SupportTools\amd64<= /b>.

Copy the tool to the computer where= you will be performing the import operation.

1.      At the computer where the Certificate is to be installed, laun= ch the command prompt and navigate to the location of the MOMCertImport tool. At t= he command prompt, type:

momcertimport {Certificate File} /Password {Certificate Password}

The C= ertificate file should have the extension “.p= fx”. If you omit the password parameter (/Password) you will be prompted to= enter it.

For e= xample, if the name of the Certificate file is “certificate.pfx” and the password created during the export process is “mypassword”, the command-line would be:

momcertimport c:\certificate.pfx /Password mypassword

When = the command is executed successfully, the cursor will return without any errors= .

2.      If the Agent is already installed, you must restart the Operat= ions Manager Health Service. You may do this in the Services Console, or at the command prompt stop the Operations Manager Health Service by entering:

net stop healthservice

...th= en restart the Operations Manager Health Service by entering:

net start healthservice

Note: As of Operations Manager 2007 SP1, the “momcertimport” tool w= ill launch a GUI if no certificate is specified in the command line. If you have issues using the command line, simply run the tool alone and attempt to ins= tall the certificate via the GUI.

7      =        References

= ¾ “Operations Manager 2007 Deployment Guide”, Christopher Fox, Microsoft Corporation;
Published March 2007; http://www.microsoft.com/technet/opsmgr/2007/library/proddocs.mspx

= ¾ “Operations Manager 2007 Online Help”, Microsoft Corporation;<= br> Published March 2007; http://te= chnet.microsoft.com/en-us/library/bb381409.aspx

= ¾ “Operations Manager 2007 Security Guide”, Jim Downing, Microso= ft Corporation;
Published April 2007; http://www.microsoft.com/technet/opsmgr/2007/library/proddocs.mspx

¾ “Operations Manager 2007 Supported Configurations”, Microsoft Corporation;
Published March 2007; http://te= chnet.microsoft.com/en-us/library/bb309428.aspx

Date	Author	Version	Change reference
01/24/2008	Baju Margosutjahjo	1.0	Customer-ready version
04/30/2009	Baju Margosutjahjo	1.5	Updated content for SP1 at end of section 6, Public-ready version<= o:p>
05/07/2009	Daniele Muscetta	1.6	Content modifications in sections 5.2.1 and 5.2.2

Name	Version approved	Position	Date