TLS

AD CS

Certificate issuance under Microsoft's manual PKI hellscape

Add CA cert to Ubuntu trust store

# Copy the Root CA to ... MUST have extension: *.crt
sudo lime-DC1-CA.cer /usr/local/share/ca-certificates/lime-DC1-CA.crt
# Update the OS trust store
sudo update-ca-certificates
# Verify : flag --ca-native to use host's native trust store
curl --ca-native  https://e2e.kube.lime.lan/foo/hostname

By default, the AD CS role of Windows Server 2019 provides only RSA type TLS certificates.

We successfully obtained a TLS certificate for web server usage from AD CS web form of its Certificate Server lime-DC1-CA at https://dc1.lime.lan/certsrv/

The server responds with two (end-entity and full-chain) certificates, both in PKCS#7 format (.p7b), and so must be converted to PEM for use in most servers. Their odd format is useful only at Microsoft IIS and other legacy or non-standard servers such as Apache Tomcat.

CSR

AD CS requires CSR in PKCS#10/#7 (New/Renew) format. OpenSSL generates the request (*.csr) in that format by default.

Regarding Windows Server 2019 and prior, AD CS offers only RSA-based certificates unless that role is configured otherwise, which is a non-trivial task that nearly no organization performs.

domain=lime.lan
cn=kube.$domain
TLS_CN=$cn
TLS_O="K8s on $domain"
TLS_OU=$domain
## Create the configuration file (CNF) : See man config
## See: man openssl-req : CONFIGURATION FILE FORMAT section
## https://www.openssl.org/docs/man1.0.2/man1/openssl-req.html
cat <<EOH |tee $cn.cnf
[ req ]
prompt              = no        # Disable interactive prompts.
default_bits        = 2048      # Key size for RSA keys. Ignored for Ed25519.
default_md          = sha256    # Hashing algorithm.
distinguished_name  = req_distinguished_name 
req_extensions      = v3_req    # Extensions to include in the request.
[ req_distinguished_name ] 
CN              = ${TLS_CN:-p.gotham.gov}   # Common Name
O               = ${TLS_O:-Penguin Inc}     # Organization name
OU              = ${TLS_OU:-gotham.gov}     # Organizational Unit name
#L               = ${TLS_L:-Gotham}          # Locality name
#ST              = ${TLS_ST:-NY}             # State or Province
C               = ${TLS_C:-US}              # Country
emailAddress    = admin@$root
[ v3_req ]
subjectAltName      = @alt_names
keyUsage            = critical, digitalSignature
extendedKeyUsage    = serverAuth
[ alt_names ]
DNS.1 = $cn
DNS.2 = *.$cn   # Wildcard. CA must allow, else declare each subdomain.
EOH

# RSA (Use only this if the certificate server is AD CS)
openssl req -new -noenc -config $cn.cnf -extensions v3_req -newkey rsa:2048 -keyout $cn.key -out $cn.csr 
# ED25519
openssl req -new -noenc -config $cn.cnf -extensions v3_req -newkey ed25519 -keyout $cn.key -out $cn.csr
# ECDSA (NIST P-256 curve)
openssl req -new -noenc -config $cn.cnf -extensions v3_req -newkey ec:<(openssl ecparam -name prime256v1 -genkey) -keyout $cn.key -out $cn.csr

Automated TLS Management (Enterprise Grade)

Recommendations

Per environment:

ACME

Automated Certificate Management Environment (ACME)

An ACME server is a trusted CA endpoint that issues certs after validating the client requestor has domain control.