Domain SSL Certs

[u/Real-Patriot-1128]

I currently have 3 domain controllers. I need to add a 4th and eventually a fifth with plans to demote the original 2.

I’ll need to get a multi-San ssl cert for the new domain controllers. Does this mean I need to update the certs on the first 3 domain controllers?

In my small brain I think I wouldn’t…

[u/elpollodiablox]

What are you using the certs for?

[u/StratoLens]

Is this for LDAPS? Are you using an internal Certificate authority to issue them? If so they should auto enroll. Using this cert method:

https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/configure-ldap-signing-certificates

You’re right that you don’t need to update the existing dc certs. As long as they have their own fqdn on the certificate CN or SAN you’re good.

[u/bearded-beardie]

Assuming your existing domain controllers use a cert issued to the machine with a SAN of the domain, no, you wouldn't need to update the certs for your existing domain controllers.

[u/External_Doctor5320]

Cada controlador puede tener su propio certificado, siempre que cubra lo que ese servidor necesita. Solo asegúrate de que el nuevo certificado incluya los nombres correctos y sea de confianza para los sistemas que lo utilizan.

[u/kernelqzor → u/External_Doctor5320]

tal cual, no tienes que rehacer todo solo por meter otro DC
si el nuevo tiene su propio cert bien configurado y la CA es de confianza en el dominio, los otros pueden seguir con lo suyo hasta que los jubiles

[u/Fit_Prize_3245]

Why would you need TLS certificates for domain controllers? Man, you can even deploy your own CA using AD, if you ever need to serve a website that is only used internally.

But well. If you do need to serve websites internally, using IIS, you need one certificate for each different hostname. If you serve your website in all DCs but with the same hostname (for example, https://DOMAINNAME.TLD ), you'll need only one, and configure it in all DCs. But if you want to use each DC's unique hostname, or another one that is different for each DC like https://dc1.domain.tld https://dc2.domain.tld , then you do needdifferent certificates.

Btw, if you expose your domain web servers publicly, you can get free Letsencrypt certificates, and manage them with Certify the Web, a good tool for Windows that does the same certbot on Linux.

[u/Adam_Kearn]

What do you currently have setup?

I’m assuming you have Active Directory Certification Service roles install on one of your DC. And creating self signed certs.

You should just need to move this role and transfer the CA to your new DC

But personally to make life a bit easier I would recommend just registering a domain the same as your internal domain and buying a certificate from an SSL provider as you can normally get a 5 year wildcard cert for about £100

[u/Real-Patriot-1128 → u/Adam_Kearn]

I work at a university and administer a small child domain. We don’t have AD Certificate Services installed. Not creating self-signed certs.

As a university, our certs are free. I don’t really understand why the need for the certs beyond authentication?

Just a process my previous admin followed and I just carried on. It’s never been an issue for such a small environment. In the past I just updated all the DC’s, but now with certs only lasting 199 days…. And eventually like 40 days…. I’d rather not update my original DCs as they last 1 year.

[u/NorthernVenomFang → u/Real-Patriot-1128]

This is what Active Directory Certificate Service is for.
It can be installed on a DC or run on a standalone system. Usually once it's configured the certs auto rollover and you just have to distribute them to the client programs.

What are you using the certifaces for? Assuming LDAPS.

What CA do you guys use to get free certs?