［精講 1］Windows Server 2012 CA

標籤：windows   server   工作群組   target   blank   

 1 環境準備

一台DC，一個client (工作群組環境)

現在DC8 上安裝DNS和IIS服務,讓它成為一個web server

650) this.width=650;" height="369" title="clip_image002" style="margin:0px;border:0px;padding-top:0px;padding-right:0px;padding-left:0px;background-image:none;" alt="clip_image002" src="http://s3.51cto.com/wyfs02/M02/6C/6A/wKioL1VJcPaDfrzTAADLZFQIcJA221.jpg" border="0" />

建立default page ,check http://localhost

650) this.width=650;" height="223" title="clip_image004" style="margin:0px;border:0px;padding-top:0px;padding-right:0px;padding-left:0px;background-image:none;" alt="clip_image004" src="http://s3.51cto.com/wyfs02/M02/6C/6E/wKiom1VJb4bjmIB-AAENqQmxH44677.jpg" border="0" />

DNS 添加一個host記錄

650) this.width=650;" height="145" title="clip_image006" style="margin:0px;border:0px;padding-top:0px;padding-right:0px;padding-left:0px;background-image:none;" alt="clip_image006" src="http://s3.51cto.com/wyfs02/M00/6C/6E/wKiom1VJb4jQjvs6AACy_dVzDZI838.jpg" border="0" />

在client端指向dns server (dc8) ,同時訪問http://web.labca.com

650) this.width=650;" height="131" title="clip_image008" style="margin:0px;border:0px;padding-top:0px;padding-right:0px;padding-left:0px;background-image:none;" alt="clip_image008" src="http://s3.51cto.com/wyfs02/M01/6C/6E/wKiom1VJb4iTGCmfAACgO8BCAQk198.jpg" border="0" />

2安裝ＣＡ

鉤選active directory 認證服務 (不要以為認證服務就一定跟AD 掛鈎)

650) this.width=650;" height="208" title="clip_image010" style="margin:0px;border:0px;padding-top:0px;padding-right:0px;padding-left:0px;background-image:none;" alt="clip_image010" src="http://s3.51cto.com/wyfs02/M02/6C/6E/wKiom1VJb4nTQmrMAADcYfLonZE178.jpg" border="0" />

溝選憑證授權單位web註冊

650) this.width=650;" height="138" title="clip_image012" style="margin:0px;border:0px;padding-top:0px;padding-right:0px;padding-left:0px;background-image:none;" alt="clip_image012" src="http://s3.51cto.com/wyfs02/M00/6C/6E/wKiom1VJb4rAMhnVAABw5rT3k6A798.jpg" border="0" />

工作群組環境

650) this.width=650;" height="262" title="clip_image014" style="margin:0px;border:0px;padding-top:0px;padding-right:0px;padding-left:0px;background-image:none;" alt="clip_image014" src="http://s3.51cto.com/wyfs02/M01/6C/6E/wKiom1VJb4uzkSNuAADodmbsERM023.jpg" border="0" />

650) this.width=650;" height="218" title="clip_image016" style="margin:0px;border:0px;padding-top:0px;padding-right:0px;padding-left:0px;background-image:none;" alt="clip_image016" src="http://s3.51cto.com/wyfs02/M02/6C/6E/wKiom1VJb4yBM1ooAAB1u9JL3NY627.jpg" border="0" />

３ 給website配置認證3.1 在IIS 上申請認證

650) this.width=650;" height="262" title="clip_image018" style="margin:0px;border:0px;padding-top:0px;padding-right:0px;padding-left:0px;background-image:none;" alt="clip_image018" src="http://s3.51cto.com/wyfs02/M00/6C/6E/wKiom1VJb43i5WNhAAEZst8L8lU259.jpg" border="0" />

650) this.width=650;" height="246" title="clip_image020" style="margin:0px;border:0px;padding-top:0px;padding-right:0px;padding-left:0px;background-image:none;" alt="clip_image020" src="http://s3.51cto.com/wyfs02/M01/6C/6E/wKiom1VJb42Dke3CAAEJz1sVctY355.jpg" border="0" />

650) this.width=650;" height="424" title="clip_image022" style="margin:0px;border:0px;padding-top:0px;padding-right:0px;padding-left:0px;background-image:none;" alt="clip_image022" src="http://s3.51cto.com/wyfs02/M02/6C/6E/wKiom1VJb47T1c3PAADzGzDYz6U871.jpg" border="0" />

650) this.width=650;" height="131" title="clip_image024" style="margin:0px;border:0px;padding-top:0px;padding-right:0px;padding-left:0px;background-image:none;" alt="clip_image024" src="http://s3.51cto.com/wyfs02/M00/6C/6A/wKioL1VJcQCxkegLAACFGuddJ38983.jpg" border="0" />

匯出申請認證的資訊

3.2 訪問ＣＡ頒髮網頁

選擇“申請認證”

650) this.width=650;" height="283" title="clip_image026" style="margin:0px;border:0px;padding-top:0px;padding-right:0px;padding-left:0px;background-image:none;" alt="clip_image026" src="http://s3.51cto.com/wyfs02/M01/6C/6A/wKioL1VJcQGhpWN5AAFhaktxePE084.jpg" border="0" />

提交進階認證申請

650) this.width=650;" height="169" title="clip_image028" style="margin:0px;border:0px;padding-top:0px;padding-right:0px;padding-left:0px;background-image:none;" alt="clip_image028" src="http://s3.51cto.com/wyfs02/M01/6C/6E/wKiom1VJb5HjXKZ5AACTd7Xasv8844.jpg" border="0" />

650) this.width=650;" height="202" title="clip_image030" style="margin:0px;border:0px;padding-top:0px;padding-right:0px;padding-left:0px;background-image:none;" alt="clip_image030" src="http://s3.51cto.com/wyfs02/M02/6C/6E/wKiom1VJb5KyAP86AAEci_DKwfU594.jpg" border="0" />

把剛產生base64的編碼的資訊複製進去

650) this.width=650;" height="333" title="clip_image032" style="margin:0px;border:0px;padding-top:0px;padding-right:0px;padding-left:0px;background-image:none;" alt="clip_image032" src="http://s3.51cto.com/wyfs02/M00/6C/6E/wKiom1VJb5OimXVTAAEHpuvghW0292.jpg" border="0" />

在工作群組環境下：由於相互都不信任，所以需要管理員來手動頒發認證

650) this.width=650;" height="188" title="clip_image034" style="margin:0px;border:0px;padding-top:0px;padding-right:0px;padding-left:0px;background-image:none;" alt="clip_image034" src="http://s3.51cto.com/wyfs02/M01/6C/6A/wKioL1VJcQWhpJysAAC2Kzt6SCU826.jpg" border="0" />

650) this.width=650;" height="120" title="clip_image036" style="margin:0px;border:0px;padding-top:0px;padding-right:0px;padding-left:0px;background-image:none;" alt="clip_image036" src="http://s3.51cto.com/wyfs02/M02/6C/6A/wKioL1VJcQbiCr5wAACaN86y2BM522.jpg" border="0" />

當然管理員也可以吊銷認證

650) this.width=650;" height="105" title="clip_image038" style="margin:0px;border:0px;padding-top:0px;padding-right:0px;padding-left:0px;background-image:none;" alt="clip_image038" src="http://s3.51cto.com/wyfs02/M00/6C/6A/wKioL1VJcQfSJXXWAAB7manmOgM251.jpg" border="0" />

3.3 下載和察看認證

我們再回到首頁

-點”察看掛起的認證申請的狀態”

650) this.width=650;" height="261" title="clip_image040" style="margin:0px;border:0px;padding-top:0px;padding-right:0px;padding-left:0px;background-image:none;" alt="clip_image040" src="http://s3.51cto.com/wyfs02/M01/6C/6A/wKioL1VJcQegUsVzAAFEh-ortr4825.jpg" border="0" />

650) this.width=650;" height="339" title="clip_image042" style="margin:0px;border:0px;padding-top:0px;padding-right:0px;padding-left:0px;background-image:none;" alt="clip_image042" src="http://s3.51cto.com/wyfs02/M01/6C/6A/wKioL1VJcQiBdrz6AADD071mPA4588.jpg" border="0" />

下載好認證，認證可以理解為一個工具，需要繼續跟application /website 作邦定.

3.4邦定認證

回到iis控制台 選擇 完成認證申請

650) this.width=650;" height="311" title="clip_image044" style="margin:0px;border:0px;padding-top:0px;padding-right:0px;padding-left:0px;background-image:none;" alt="clip_image044" src="http://s3.51cto.com/wyfs02/M02/6C/6A/wKioL1VJcQnCoiGKAADHZ82ayqI533.jpg" border="0" />

650) this.width=650;" height="397" title="clip_image046" style="margin:0px;border:0px;padding-top:0px;padding-right:0px;padding-left:0px;background-image:none;" alt="clip_image046" src="http://s3.51cto.com/wyfs02/M00/6C/6A/wKioL1VJcQqgkIXdAAC-JTacdLM507.jpg" border="0" />

650) this.width=650;" height="189" title="clip_image048" style="margin:0px;border:0px;padding-top:0px;padding-right:0px;padding-left:0px;background-image:none;" alt="clip_image048" src="http://s3.51cto.com/wyfs02/M01/6C/6F/wKiom1VJb5njyzuKAABf5pNQ78M990.jpg" border="0" />

發現有錯誤，原因是在工作群組環境下 ,我們首先要先信任這個頒發機構

650) this.width=650;" height="287" title="clip_image050" style="margin:0px;border:0px;padding-top:0px;padding-right:0px;padding-left:0px;background-image:none;" alt="clip_image050" src="http://s3.51cto.com/wyfs02/M01/6C/6A/wKioL1VJcQzBpt4ZAAFscDyU-5M411.jpg" border="0" />

下載憑證鏈結，這張認證是用來建立信任的

650) this.width=650;" height="349" title="clip_image052" style="margin:0px;border:0px;padding-top:0px;padding-right:0px;padding-left:0px;background-image:none;" alt="clip_image052" src="http://s3.51cto.com/wyfs02/M02/6C/6A/wKioL1VJcQ3zm8KZAADmIaEBtW8253.jpg" border="0" />

在本地添加信任認證

650) this.width=650;" height="390" title="clip_image054" style="margin:0px;border:0px;padding-top:0px;padding-right:0px;padding-left:0px;background-image:none;" alt="clip_image054" src="http://s3.51cto.com/wyfs02/M00/6C/6A/wKioL1VJcQ3S2va1AAEygv4LNgE282.jpg" border="0" />

650) this.width=650;" height="404" title="clip_image056" style="margin:0px;border:0px;padding-top:0px;padding-right:0px;padding-left:0px;background-image:none;" alt="clip_image056" src="http://s3.51cto.com/wyfs02/M01/6C/6A/wKioL1VJcQ7xdmbpAAIDArH-sB4048.jpg" border="0" />

匯入*.P7B格式的認證

650) this.width=650;" height="372" title="clip_image058" style="margin:0px;border:0px;padding-top:0px;padding-right:0px;padding-left:0px;background-image:none;" alt="clip_image058" src="http://s3.51cto.com/wyfs02/M02/6C/6A/wKioL1VJcQ_DgV5nAAD1a0iQkgo082.jpg" border="0" />

再來邦定一次-選擇 “完成認證申請”

650) this.width=650;" height="233" title="clip_image060" style="margin:0px;border:0px;padding-top:0px;padding-right:0px;padding-left:0px;background-image:none;" alt="clip_image060" src="http://s3.51cto.com/wyfs02/M00/6C/6A/wKioL1VJcRDh227uAADRuzuE9xo707.jpg" border="0" />

察看下認證狀態

650) this.width=650;" height="287" title="clip_image062" style="margin:0px;border:0px;padding-top:0px;padding-right:0px;padding-left:0px;background-image:none;" alt="clip_image062" src="http://s3.51cto.com/wyfs02/M02/6C/6F/wKiom1VJb5_yuLJnAABCIqgHSjo271.jpg" border="0" />

給網站添加認證

650) this.width=650;" height="364" title="clip_image064" style="margin:0px;border:0px;padding-top:0px;padding-right:0px;padding-left:0px;background-image:none;" alt="clip_image064" src="http://s3.51cto.com/wyfs02/M01/6C/6F/wKiom1VJb6DDSTRDAAE9VXH157I212.jpg" border="0" />

在win7用戶端看下，https:\\web.labca.com

650) this.width=650;" height="208" title="clip_image066" style="margin:0px;border:0px;padding-top:0px;padding-right:0px;padding-left:0px;background-image:none;" alt="clip_image066" src="http://s3.51cto.com/wyfs02/M02/6C/6A/wKioL1VJcRKiUlBHAABgZADyyEQ720.jpg" border="0" />

為什麼會出現這樣的error 說明win7client也不信任這個頒發機構

那麼我做下設定也讓win7 client也信任這個DC8-CA頒發機構

650) this.width=650;" height="302" title="clip_image068" style="margin:0px;border:0px;padding-top:0px;padding-right:0px;padding-left:0px;background-image:none;" alt="clip_image068" src="http://s3.51cto.com/wyfs02/M01/6C/6A/wKioL1VJcRPSo-3MAAC-FP5xZF4411.jpg" border="0" />

如果在win7 client下載慢的話，可以關閉smart screen filter

650) this.width=650;" height="187" title="clip_image070" style="margin:0px;border:0px;padding-top:0px;padding-right:0px;padding-left:0px;background-image:none;" alt="clip_image070" src="http://s3.51cto.com/wyfs02/M00/6C/6A/wKioL1VJcRfgnkRrAACHymAqnK4377.jpg" border="0" />

650) this.width=650;" height="181" title="clip_image072" style="margin:0px;border:0px;padding-top:0px;padding-right:0px;padding-left:0px;background-image:none;" alt="clip_image072" src="http://s3.51cto.com/wyfs02/M01/6C/6A/wKioL1VJcRfBtBZoAAEoDx25ZJs001.jpg" border="0" />

開啟後不報錯了

650) this.width=650;" height="75" title="clip_image074" style="border:0px;padding-top:0px;padding-right:0px;padding-left:0px;background-image:none;" alt="clip_image074" src="http://s3.51cto.com/wyfs02/M02/6C/6A/wKioL1VJcRiyiAm8AAAoWfF40DE262.jpg" border="0" />

本文出自 “Erick WAY” 部落格，謝絕轉載！

［精講 1］Windows Server 2012 CA