All documentation

Utilizing root domain for LDAPS calls with SSL Certs

Published October 21, 2024 Guide

In this article, we’ll discuss the benefits of using the Kerberos Authentication certificate template exclusively for domain controllers (DCs) and explain how this helps streamline certificate management. This approach not only simplifies LDAP over SSL (LDAPS) configuration but also resolves common conflicts caused by older certificate templates, such as Domain Controller Authentication or Directory Email Replication. We will also explain how blocking older templates improves consistency when working with root domains (e.g., domain.com).

Why Use the Kerberos Authentication Certificate Template?

The Kerberos Authentication template includes several advantages:

  1. SAN (Subject Alternative Name) Inclusion:
  • The Kerberos Authentication certificate template automatically includes the root domain name (e.g., domain.com) in its SAN field. This is critical for services like LDAPS since clients expect the root domain in the certificate when connecting over LDAP.
  • Older templates (such as Domain Controller and Domain Controller Authentication) may only include the NetBIOS name or server FQDN, causing mismatches during LDAPS binding.
  1. Improved Certificate Management:
  • By consolidating your certificates to the Kerberos Authentication template, you eliminate the need to manage multiple templates like Domain Controller Authentication or Directory Email Replication. This also reduces the risk of misconfiguration and ensures that all DCs use the same, secure template.
  1. Conflict-Free LDAPS Configuration:
  • If your environment spans root domains and subdomains (e.g., domain.com and sub.domain.com), conflicts can arise if certificates do not properly reflect the required SAN entries. Using only the Kerberos Authentication template ensures the correct names are present, preventing issues with LDAPS authentication.

How to Block Old Certificate Templates from Domain Controllers

To avoid conflicts and enforce the use of the Kerberos Authentication template, you can block older templates (like Domain Controller Authentication, Domain Controller, and Directory Email Replication) using the following steps:

  1. Open the CA Management Console:
  • Run certsrv.msc on the CA server.
  1. Navigate to Certificate Templates:
  • Right-click the Certificate Templates folder and select Manage.
  1. Modify Template Permissions:
  • Right-click each template you wish to block (e.g., Domain Controller Authentication).
  • Go to the Security tab and remove Enroll/Auto-Enroll permissions for the Domain Controllers group.
  1. Apply the Changes:
  • After modifying the templates, restart the CA service to apply the changes.

Configuring Domain Controllers to Use Kerberos Authentication

Once the Kerberos Authentication template is configured and issued:

  1. Ensure Auto-Enrollment is Enabled:
  • Use Group Policy to allow auto-enrollment for the Kerberos Authentication certificate.
  • Path:
    Computer Configuration > Policies > Windows Settings > Security Settings > Public Key Policies > Autoenrollment Settings
  1. Verify the Certificate Installation:
  • Use the following command to confirm that the correct Kerberos Authentication certificate is installed on your DC:
    powershell Get-ChildItem Cert:\LocalMachine\My | Where-Object { $_.Subject -like '*domain.com*' }
  1. Test LDAPS Binding:
  • Use LDP.exe or an LDAP client to verify that the root domain is correctly presented during an LDAPS bind:
    Connect to: ldaps://domain.com:636

The Client-Side Perspective: What Certificates Do Clients Need?

  • Clients do not need the old Domain Controller certificates. All they need is the root CA certificate installed in the Trusted Root Certification Authorities store.
  • This ensures that the client trusts the DC’s Kerberos Authentication certificate during the authentication process over LDAPS or Kerberos.

Conclusion: Best Practices and Security Benefits

Switching to the Kerberos Authentication template for domain controllers aligns with modern security best practices. This approach:

  • Simplifies certificate management.
  • Reduces the risk of LDAPS name mismatches.
  • Improves the consistency and security of domain authentication.

By blocking old templates like Domain Controller Authentication and ensuring that all DCs use the Kerberos Authentication certificate, you future-proof your Active Directory deployment and ensure a smoother experience for both administrators and end-users.