How to manage third-party issued certificates in a Windows environment with Active Directory Certificate Services

Question

I have a wildcard SSL certificate (*.ourdomain.com) + chain of trust that was issued from a public third-party CA that I have deployed on to all of our Windows servers in the domain. But our environment has outgrown our deployment script and I need a better way to manage and audit certificates in the domain (list of certificates on each server, when certificates will expire, install certificates on newly deployed servers).

My initial research pointed me to Active Directory Certificate Services (ADCS) as a solution. This seems like it would work fine acting as its own CA where the certificates were generated on the ADCS machine, but it is not clear to me how one would use ADCS with third-party certificates. Is is even possible or recommended?

Answer 1

You do not use Active Directory certificate services to manage third-party certificates. AD CS is not an asset tracking or inventory system. (Your "assets" in this case being your collection of SSL certificates.)

From an organizational standpoint, I would say that you need a CMDB/asset tracking system, with the ability to track SSL certificates as CIs (Configuration Items... sorry, a little ITIL speak there.)

But as for what product you should use I cannot say, since product recommendations are off topic for Serverfault.

Answer 2

Any particular reason you're not using a GPO to deploy certificates, if they need to be deployed domain wide? You can add / remove certificates to a GPO and the GPO will manage deploying / removing them.

Secondly, not sure exactly how you outgrow a script, a well defined script should easily work for 1,000's of systems. Perhaps its the way you're executing the script? For example, are you tasking a central system with job to go out and poll / deploy the certs? Or... are you having your clients all run a script that has them upload results to a given directory? The latter has much better scaling capability, but may require a little more effort to absorb/ingest the data. You could pretty easily have a script launched by the client (use GPP to create scheduled task) that uploads the results of a given computer to a file share, and then loop through the data files and add it to a DB or even a simple CSV.