windows server 2012 certificates & private keys

Forums › Microsoft Windows › windows server 2012 certificates & private keys

fran1942

82 posts

Master Geek

Trusted

#166330 9-Mar-2015 20:04

Hello, just trying to understand how this works.
So you have a Windows server with Certificate Services installed. You create a certificate.
i) does this certificate automatically include an embedded private key or is it a separate file that you have to store somewhere?
ii) if you distribute this certificate via group policy to clients, does this version automatically include a public key ?

thanks for any help.

gbwelly

1243 posts

Uber Geek

#1254435 10-Mar-2015 07:49

A private key should be just that, private. You should only move a private/public key pair in very specific circumstances. I think you are asking if the CA's public key will be placed in the trusted root CA store on the client computers? If you have created an Enterprise CA then all the domain joined client computers should automatically trust certificates signed by that CA. Don't muck around with the private key for a CA, if anyone gets hold of it they can generate and sign certificates and those certificates will be trusted by the clients.

wasabi2k

2096 posts

Uber Geek

#1254492 10-Mar-2015 09:31

Certificates have a public key and a private key.

The Public key is distributed wherever it is needed - when you visit https://www.securesite.com you view the public key of that certificate. Traffic sent there is encrypted using that public key.

The people that control the certificate also have the private key. This is secured and should never leave your control. This key is used to decrypt traffic encrypted with the public key.

When you establish a new CA, you generate a new CA certificate, which contains both public and private keys. You then distribute the public key for that root CA to all your clients as a trusted root certificate, so they now trust all the certificates your CA issues.

When a client is issued a certificate (user/computer or other) they receive both a private and public key.

For quick reference:

A .pfx usually contains private and public keys and can contain an entire certificate chain
A .cer or .crt is the public key only and is used to add root certificates or intermediate authorities