I want to save on OS license, simplify CRL renewals and have more than one certificate instance on a given server.
For me, this makes sense from a security perspective because I have:
One CA that acts as the root, that needs to publish & renew CRLs for policy servers (next bullet point)
There are many, many Policy servers (2nd tier) that are constrained by Name Constraints or EKU usages. Likewise these too need to publish many CRLs and AIA records.
We currently estimate a need of 10,000 to 50,000 policy servers. Each policy server will have a CRL stored in Azure blob storage, with a dedicated container for each server for IO scalability.
Based on the output of certutil -ping (namely the config parameter) it appears that I can have more than one configuration per ADCS instance.
In addition, several other parameters of Certutil (and the corresponding API) allow me to specify which "instance" I want to connect to.
/// --- NOTE: The ability to specify an individual config seems to indicate multiple PKIs are possible per box:
PS C:\Windows\system32\CertSrv\en-US> certutil -ping -config "a.Issue01.bitclear.us\Secure Issuer 01a-001"
Connecting to a.Issue01.bitclear.us\Secure Issuer 01a-001 ...
Server "Secure Issuer 01a-001" ICertRequest2 interface is alive (0ms)
CertUtil: -ping command completed successfully.
/// --- NOTE "Entry 0" implies that more entries are possible
PS C:\Windows\system32\CertSrv\en-US> certutil -v
Entry 0: (Local)
Name: `Secure Issuer 01a-001'
Organizational Unit: `Email Privacy'
Organization: `Bitclear LLC'
Locality: `'
State: `'
Country/region: `us'
Config: `a.Issue01.bitclear.us\Secure Issuer 01a-001'
Exchange Certificate: `'
Signature Certificate: `a.Issue01.bitclear.us_Secure Issuer 01a-001.crt'
Description: `'
Server: `a.Issue01.bitclear.us'
Authority: `Secure Issuer 01a-001'
Sanitized Name: `Secure Issuer 01a-001'
Short Name: `Secure Issuer 01a-001'
Sanitized Short Name: `Secure Issuer 01a-001'
Flags: `13'
Web Enrollment Servers:
1
4
0
https://a.issue01.bitclear.us/Secure%20Issuer%2001a-001_CES_UsernamePassword/service.svc/CES
0
CertUtil: -dump command completed successfully.
Is it possible to host more than one PKI per ADCS host? How would this be done?
Aside: I remember there being discussion this might be possible in the past, but I'm not sure if it was implemented.
Todo:
I will test this theory with a custom CertFile and a New name when I run the command:
certutil -installcert [-f] [-gmt] [-seconds] [-v] [-config CAMachineName\CAName] [CACertFile]
It's possible that this is also somehow related to "PolicyServers" and "EnrollmentServers" that can be connected with this command. The ability to separate these from the core ADCS instance is very interesting, and note really documented.