Delgating ADCS PKI management to non domain admin

There is Microsoft official documentation on how to do delegate Active Directory Certificate Service (Public Key Infrastructure) management to non domain admin, I used this procedure to delegate CA management on windows server 2019 so it's still relevant

https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/dn786430(v=ws.11)

That's what I followed but what it doesn't tell you is what happen if after the delegation has been done the delegated users are unable to publish  new certificate template to issue. Well the answer is that the problem doesn't come from the delegation, it comes from the GUI, so you just need to use the Certutil command line tool to publish the new template. 

Built-in certutil.exe tool can be used to manage certificate templates on CA server locally or remotely:

1. Log on to CA server or computer with Remote Server Administration Tools installed with CA Administrator permissions;
2. Open elevated Command Prompt;
3. If you are logged on CA server, type:

   certutil -SetCaTemplates +<TemplateCommonName>

   Replace <TemplateCommonName> with actual template’s common name. 

 certutil -setcatemplates +WebServerwithClientAuth
0: WebServerwithClientAuth: Adding
CertUtil: -SetCATemplates command completed successfully.

 I found the solution came on Greig Sheridan blog 

https://greiginsydney.com/

The specific topic is here: 

https://greiginsydney.com/server-2016-unable-to-set-certificate-to-issue/?unapproved=34677&moderation-hash=f8f7e9758fa7c079b382568dcb0aee87

strong private key protection for code signing certificate

When working with powershell script it is a good idea to sign your script if you plan on using them in your production environment. You can easily get a code signing script from your enterprise ca (active directory certificate service) or generate a self sign. There are multiple place explaining that and I got my basic stuff from here:

https://www.darkoperator.com/blog/2013/3/5/powershell-basics-execution-policy-part-1.html

What is not mentioned is that you should protect your code signing certificate with "strong private key protection". To do that you have to export your current code signing certificate in PFX with the private key and then import it back (it can be done on the same computer) using the "strong private key protection" check box in the import option as shown in the picture below. At the end of the import process you will have an additionnal prompt to enter the password used to protect your private key. Obviously if you plan on protecting your private key with a password it's a good idea to NOT mark it as exportable...

Here is the password prompt for the private key protection.

 

Now each time you will try to use this certificate you will be prompted to enter this password.

My first Powershell funciton... Sign-Script

I'm starting to play more with powershell and for some need that we have I had to start signing script. I found many place on the internet  that explain how to get the code signing certificate from our corporate CA and then sign the script using timestamp so that script still works when the certificate expire as the timestamp certify that the certificate was valid at the time it was signed. This generates a pretty long command so I wrote my first powershell function... Sign-Script to leverage this, you can place this in your powershell profile (profile.ps1) to have it available each time you run powershell
profile.ps1

Powershell profile ref: https://technet.microsoft.com/en-us/library/2008.10.windowspowershell.aspx 

Code signing ref: https://www.darkoperator.com/blog/2013/3/5/powershell-basics-execution-policy-part-1.html

So without further delay here it comes...

#Begin copy after this line
#----------------------------------------------------------------------------------------------------

 <#
.Synopsis
   Sign the specified script with the first code signing certificate of the current user
   and with a default TimeStamping URL.

.DESCRIPTION
   This function allow you so sign a script with a timestamp so that your script will be
   valid even when the signing certificate expire. It also allow you to not have to type
   the full path to the signing certificate since it will use the first
   "Code Signing Certificate" available in the local User certificate store. This funciton
   also use a default "time stamping URL" so that you don't need to

.PARAMETER scriptname
    The script name including the full path that you want to sign

.PARAMETER cert
    A path to a code signing certificate.  The default is the first code signing script of
    the local user.
   
.PARAMETER TimeStampingServer
    URL to a time stamping server. The default is "http://timestamp.comodoca.com/authenticode".
   
.EXAMPLE
   Sign-cert c:\script\test.ps1

.EXAMPLE
   Sign-cert -scriptname c:\script\test.ps1 -cert gci cert:\CurrentUser\My -codesigning | where -Filter {$_.FriendlyName -eq "Thawte Code Signing"} -IncludeChain All -TimeStampServer "http://timestamp.verisign.com/scripts/timstamp.dll"
#>
function Sign-Script
{
    [CmdletBinding()]
    [Alias("Sign")]
    Param
    (
       # Description d’aide param1
       [Parameter(Mandatory=$true,
                   ValueFromPipeline=$true,
                   ValueFromPipelineByPropertyName=$true,
                   ValueFromRemainingArguments=$false,
                   Position=0,
                   ParameterSetName='Script name')]
        [ValidateNotNull()]
        [ValidateNotNullOrEmpty()]
        [Alias()]
        $scriptname,

        # Description d’aide param2
        $cert=(GCI cert:currentuser\my\ -CodeSigningCert)[0],
       
        # Description d’aide param3
        $TimeStampingServer="http://timestamp.comodoca.com/authenticode"
    )

    Process
    {
    Set-AuthenticodeSignature $scriptname $cert -TimestampServer $TimeStampingServer
    }
 }

#---------------------------------------------------------------------------------
#End copy above this line