Overview

Microsoft's ADCS on Windows provides customizable services for creating and managing public key certificates used in software security systems employing public key infrastructure. Organizations use certificates to enhance security by binding the identity of a person, device or service to a corresponding private key.

A server configured as a certification authority (CA) provides the management features needed to regulate certificate distribution and use. ADCS is the Windows Server service that provides the core functionality for Windows Server CAs. ADCS provides customizable services for managing certificates for a particular CA and for the enterprise.

The root of trust in a public key infrastructure is the CA. Fundamental to this trust is the CA’s root cryptographic signing key, which is used to sign the public keys of certificate holders and more importantly its own public key. Microsoft ADCS integrates with a ProtectServer 3 HSM to secure the root encryption key.

Using Thales HSMs to secure the Microsoft ADCS root key provides the following benefits:

• Secure generation, storage and protection of the Identity signing private key on FIPS-validated hardware.

• Full life-cycle management of the keys.

  

  Note

  ProtectServer 3 integrations with ADCS/IIS is only supported in FIPS mode with the following versions:

  PTK Version	Security Flags
  7.3.1	Default Security Flags*
  7.3.0	FIPS 140-3
  7.2.4	FIPS 140-3

  • The following outlines the workaround scenarios for version 7.3.1:

  Customers with existing ADCS/IIS (older FW, with FIPS mode enabled) integrations wishing to upgrade to FW 7.03.01 and above.

  Due to the setting of the security mode flag “Tamper Before Upgrade”, direct upgrade to FW 7.03.01 is not permitted. The following steps will workaround that issue.

  • Backup the existing keys.
  • Tamper the HSM.
  • Re-initialize the HSM without FIPS mode set.
  • Upgrade to FW 7.03.01 or above.
  • Restore the key backup.
  • Enable FIPS mode.

  New customers or new integrations with FW 7.03.01 and above (no FIPS mode).

  • Initialize the HSM without FIPS mode set.
  • Upgrade to FW 7.03.01 or above.
  • Perform the integration of ADCS or IIS.
  • Enable FIPS mode.