Is it possible to provide certificates to industrial equipment that doesn’t have any enrollment capabilities?
That´s the challenge one of our customers gave us a couple of weeks ago. The certificates should be used for network access on an 802.1x network and authentication to a database. Me and my fantastic colleague Tomas accepted the challenge and went to work.
So we had to create a completely automatic enrollment process with as little user interaction as possible. Our goal was to provide the manufacturer with password protected pfx-files in a bulk with a password file, mapping the pfx-files to a randomly generated password for each pfx. First we started by doing a manual enrollment process.
Enrollment process – step by step
- The first step was to create an inf-file (request.inf) as input to the request file.
[Version]
Signature=”`$Windows NT$
[NewRequest]
Subject = CN=Test123.trustmyroot.com
Exportable = True
KeyLength = 4096
KeySpec = 1 ; AT_KEYEXCHANGE
KeyUsage = 0xA0 ; Digital Signature, Key Encipherment
MachineKeySet = True ; The key belongs to the local computer account
ProviderName = “Microsoft RSA SChannel Cryptographic Provider”
ProviderType = 12
SMIME = False
- After that we used the inf-file together with certreq.exe to create a certificate request file.
Certreq.exe -new d:\request.inf d:\enroll\req\Test123.req
- The next step was to submit the request file to the CA and issue a certificate with certreq.exe.
Certreq.exe -submit -config “SRV001.trustmyroot.com\CA01” d:\enroll\req\Test123.req d:\enroll\cer\Test123.cer
- After that we imported the certificate to the certificate store on the local machine with certutil.exe
Certutil.exe -addstore -f MY d:\enroll\cer\Test123.cer
- Then we had to match the certificate to the private key so we would be able to export the pfx-file.
Certutil.exe -repairstore MY Test123.trustmyroot.com
- Next step was to export the pfx from the certificate store and set a password for the private key.
Certutil.exe -password 1q2w3e4r -exportPFX Test123.trustmyroot.com d:\enroll\pfx\Test123.pfx
- Then we deleted the certificate and private key from the local certificate store
certutil –privatekey –delstore MY Test123
After testing this process we gave it all to our brilliant colleague Simon, which created a powershell script with some parameters, a password generator and some other nice stuff.
After testing and handover to the customer they were extremely happy with the solution and it works perfect!