Archiving the CA key
You can verify that the configurations that are possible with the Thales ProtectServer 3 HSM can be used and do not interfere with the CA key archival functionality.
To complete archiving the CA-Key you must complete the steps described in this section.
Note
If you wish to secure the key on a Thales HSM that is used to encrypt the archived keys, then you need to select the SafeNet Key Storage Provider (KSP) for generating the keys for a Key Recovery Agent (KRA) certificate.
To archive the CA key
-
Install the Enterprise Certificate Server using the SafeNet KSP.
-
Verify the CA is installed correctly.
-
Add a KRA template to CA for issuing.
-
Open the command prompt and run the certsrv.msc command.
-
Right-click the Certificate Templates node and select New > Certificate Template to Issue.
-
Select the Key Recovery Agent template and OK.
To Issue the KRA Certificate
-
Request the KRA certificate. Open the command prompt and run the certmgr.msc command.
-
Right-click Personal node and select All Tasks > Request new certificate…
-
Select Next.
-
Select Active Directory Enrollment Policy and Next.
-
Select the Key Recovery Agent check box template and Enroll.
-
Verify the enrollment is pending and select Finish.
To issue the KRA certificate from the CA snap-in
-
Open the command prompt and run the certsrv.msc command.
-
Select the Pending Requests node, right-click the latest request for the KRA template, and select All Tasks and Issue.
-
Select Issued Certificates and verify that the new certificate is issued.
To retrieve the issued certificate from CA
-
Open the command prompt and run certmgr.msc command.
-
Right-click Certificates – Current User
-
Select All Tasks and Automatically enroll and retrieve certificates….
-
Select Next.
-
Select the KRA certificate you just issued and enroll it.
To configure the CA to support key archival
-
Open the command prompt and run the certsrv.msc command.
-
Right-click CA Name and select Properties.
-
Select the Recovery Agent tab.
-
Select the Archive the key radio button.
-
Select Add... and then select the KRA certificate you just issued.
-
Select OK.
-
Verify that the CA service must be restarted and select Yes.
To create a template with key archival enabled
-
Open the command prompt and run the certtmpl.msc command.
-
Right-click the User template and select Duplicate Template.
-
Select Windows Server 2008 for both Certification Authority and Certificate recipient under Compatibility Settings, and OK.
-
On the Resulting Changes menu, select OK.
-
Go to the General tab and enter a name for the template (UserKeyArchival).
-
Go to the Request Handling tab and enable the Archive subject’s encryption private key check box.
-
Select the Subject Name tab.
-
Uncheck the Include e-mail name in subject name check box.
-
Uncheck the E-mail name check box.
-
Select Apply and OK.
To add a new template to CA for issuing
-
Open the command prompt and run the certsrv.msc command.
-
Right-click the Certificate Templates node.
-
Select New > Certificate Template to Issue.
-
Select new template for key archival and OK.
To issue a user template with key archival enabled
-
Open the command prompt and run the certmgr.msc command.
-
Right-click Personal node.
-
Select All Tasks > Request New Certificate.
-
Select Next
-
Select Next.
-
Select the new template for key archival check box and Enroll.
-
The Enrollment Wizard UI displays. Verify the enrollment is successful.
-
Select Finish.
