Might be a silly question, but I don't wanna risk messing up a working system.

We have two separate Active Directories, let's say "example.local" and "example.com". There's a trust between the two, so these domains are actually connected.

We'll set up a new software within a couple of days and it requires a secure LDAP connection to both domains (LDAP over SSL). Currently there's no CA available.

According to Microsoft we have to set up a CA, create a new server authentication certificate and distribute that one to all DCs.

I'm wondering whether I have to distribute the very same certificate to the other domain's DCs as well? Or do I have to set up two separate CAs (one for each domain) and distribute each certificate just to their corresponding DCs? I'm a little bit confused, sorry in advance!

  • Are the domains in the same forest? Also, what name will the application be connecting to? Individual domain controller names? The domain names? An application name/alias?
    – Greg Askew
    Feb 27 '18 at 13:00
  • @GregAskew Sadly not, they're entirely on their own within their own forests. It's just the domain trust which connects the two. Also, the application will be connecting to the domain name, e.g. "test.local" and "test.com"
    – Makorus
    Feb 27 '18 at 13:05
  • Technically it is possible to do cross-forest enrollment, but it's probably simpler to have two CA's for your purpose.
    – Greg Askew
    Feb 27 '18 at 13:12
  • @GregAskew sounds good so far. Did you ever do a cross-forest enrollment? Do you have any personal experience in that regard or are you just assuming it should work? There's no way I could set up a test environment to verify this, that's why I gotta ask you, sorry for that.
    – Makorus
    Feb 27 '18 at 13:43
  • I have not done cross-forest. Setting up a new CA in each forest for only LDAP/SSL isn't that difficult though.
    – Greg Askew
    Feb 27 '18 at 13:47

Thanks to @GregAskew I was able to find an official Microsoft guidance.

Source: https://social.technet.microsoft.com/Forums/windowsserver/en-US/2e56e765-566c-401b-8d1e-ee034ad8316a/does-certificate-work-in-cross-domain-environment?forum=winserversecurity

Basically the entire procedure can be divided into four steps:

  1. Create a two way trust between the resource forest (forest where ADCS is deployed) and the account forest.
  2. Configure the CA in the resource forest to support cross forest enrollment.
  3. Copy certificate templates.
  4. Copy PKI objects to account forest.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.