How to get the Domain Controller certificate from MS 2k3 Cert Svcs


Caveat:
This is not a guide to installing Windows Certificate Services. For a guide to doing that go to: http://msdn.microsoft.com/library/default.asp?url=/library/en-us/wcedsn40/html/cghowinstallingcertificateservicesiisiasonwindowsserver2003.asp
This document assumes familiarity with windows systems admin tools, such as the Microsoft Management Console (MMC).

With the advent of Windows Server 2003 Service Pack 1, the cert services root cert is no longer need to get this to work. Instead, you must obtain a copy of the Domain Controller certificate and refer to that on your *nix box instead.

Click on all images to enlarge them.

To obtain a copy of this server certificate and the private key you must open the Certificates MMC Snap-in on a DC in your windomain that holds the global catalog, choose 'computer account', and 'local computer'







Choose the self-signed certificate with the same FQDN (in CN/Common Name) as your domain controller, this is the DC certificate. Choose export here.



This will activate a wizard -> just follow the steps through the wizard: export the private key, and uncheck the 'strong' protection...







Choose a password for sealing the safebag:


Choose a path to export the pkcs12 file:


Now you can see your DC's p12 file in the directory. Get this however you can (securely; floppy/ssh/sftp,etc) to your freebsd (or whatever) box.

Now, using openssl's pkcs12 tool, convert this file into PEM format: you will need the password you created in the wizard earlier. Then you will be asked to create a new password for access to the newly exported PEM file. For this example we have changed the name of the original file to testserver.pfx. Remember this pkcs12 file contains both the private key and the certificate, so we can use this for our OpenLDAP install to communicate via SSL, the only way to change account passwords (unicodePwd attribute) in AD.



You should see your cert and private key in PEM format by executing:
cat (whateveryourcertnameis).pem
You can put this file in whatever directory you wish and call on it with ldap.conf.