AD CS operations with FXCNG
This section covers AD CS operations with FXCNG.
For this step, you must log in with an Identity that has a role with the Keys:All Slots permission. You can use the default Administrator role and Admin identities.
The Futurex CNG library enables Windows to associate an Access Control List (ACL) with an HSM key slot. Windows updates this ACL during key pair generation and permission updates. To lock the ACL from changing, perform the following steps:
Connect the Excrypt Manager application to the Vectera Plus HSM.
Login under dual control.
Go to the Key Management page
Select Edit Key Storage.
Locate the board slot containing the CNG private key. The CNG provider logs this information during key pair generation.
Check the Immutable security checkbox.
Select [ Apply Changes ].
Use the following command to view the CA certificate store. The LDAP URI varies depending on your organizational Active Directory domain (for example, fx.futurex.com) and CA name (for example, fx-FXCA).
Between tests, you can choose to clear the certificate store by using a command similar to the following example:
The following steps demonstrate one way to test using the HSM to sign a certificate for the CA server.
Open the Certificate Manager on the CA server
Right-click Personal > All Tasks > Request New Certificate.
In the Certificate Enrollment window, select [ Next ].
On the Certificate Enrollment Policy page, choose a certificate enrollment service associated with the CA server, such as Active Directory Enrollment Policy for an Enterprise CA. Select [ Next ].
On the Request Certificates page, choose a certificate template and select [ Enroll ].
If the HSM connects, a success message displays.
If the HSM is offline, you get an error.
To locate the issued certificate, perform the following steps:
- Open the Active Directory Certificate Authority tool from the Server Manager.
- Expand the node associated with your CA common name.
- Select Issued Certificates.
A certificate matching your request should display on this page.