Making a CA for RAS and IAS for wifi on Server 2003 Standard

Question

I am working for a small nonprofit with a few servers running 2003 standard. Before you ask, there is no budget for server upgrades unless someone donates money for the task.

I am changing over the wifi to EAP, aka Enterprise WPA2. Everything is working great, but I am having issues with the CA. I can't generate a cert using "RAS and IAS Server" template on the standard version of Server 2003. I need the Enterprise version for that.

I made a self signed cert as a test using the .net sdk and it works, but I have to turn of certificate checking in the clients or they won't work, and that's a really hidden setting and would rather not do that if I have too.

I have no problems using my own CA and making a self signed cert. Installing the CA root into the client computers from a usb stick, is not an issue. I do this all the time when I am testing my own websites and for internal servers.

But I can't figure out how to do this, or if I even can in Server 2003 Standard. I deal more in openssl and the "Certificate Authority" and certificate website in Server 2003 is confusing to me.

Do I have any other options? Can I generate the CA and cert in openssl and insert them into Server 2003 and have it work?

Thanks for any suggestions.

Answer 1

I hate to say it but as you ask for any suggestions here goes.

If the finances are an issue, I suggest you implement a CA that gives you the flexibility you want for your price. EJBCA from http://ejbca.org/ might be an option. I haven't got any experience with it but it seems like it would meet all your organisation needs.

You can use the launch mmc.exe and add the certificates snap-in and choose local computer to view the certs currently installed and the trusted roots. You can then generate requests and submit them offline to your CA. You can then install them on the client using the same MMC interface.