Administration

9 On the Credentials page, click Next and complete the AD CS Conguration wizard pages as described
in the following table.
Option Action
Role Services
Select  Authority, and click Next (rather than ).
Setup Type
Select Enterprise CA.
CA Type
Select Root CA or Subordinate CA. Some enterprises prefer two-tier PKI
deployment. For more information, see
hp://social.technet.microsoft.com/wiki/contents/articles/15037.ad-cs-step-
by-step-guide-two-tier-pki-hierarchy-deployment.aspx.
Private Key
Select Create a new private key.
Cryptography for CA
For hash algorithm, you can select SHA1, SHA256, SHA384, or SHA512.
For key length, you can select 1024, 2048, 3072, or 4096.
VMware recommends a minimum of SHA256 and a 2048 key.
CA Name
Accept the default or change the name.
Validity Period
Accept the default of 5 years.
Certificate Database
Accept the defaults.
10 On the Conrmation page, click , and when the wizard reports a successful conguration,
close the wizard.
11 Open a command prompt and enter the following command to congure the CA for non-persistent
certicate processing:
certutil -setreg DBFlags +DBFLAGS_ENABLEVOLATILEREQUESTS
12 Enter the following command to ignore oine CRL (certicate revocation list) errors on the CA:
certutil -setreg ca\CRLFlags +CRLF_REVCHECK_IGNORE_OFFLINE
This ag is required because the root certicate that True SSO uses will usually be oine, and thus
revocation checking will fail, which is expected.
13 Enter the following commands to restart the service:
sc stop certsvc
sc start certsvc
What to do next
Create a certicate template. See “Create Certicate Templates Used with True SSO,” on page 71.
Create Certificate Templates Used with True SSO
You must create a certicate template that can be used for issuing short-lived certicates, and you must
specify which computers in the domain can request this type of certicate.
You can create more than one certicate template, but you can congure only one template to be used at any
one time.
Prerequisites
n
Verify that you have an enterprise CA to use for creating the template described in this procedure. See
“Set Up an Enterprise Certicate Authority,” on page 70.
n
Create a security group in the domain and forest for the enrollment servers, and add the computer
accounts of the enrollment servers to that group.
Chapter 5 Authenticating Users Without Requiring Credentials
VMware, Inc. 71