---
title: 'Tutorial: Configure External PKI with Microsoft Active Directory Certificate Services (AD CS)'
canonical: https://openvpn.net/as-docs/tutorials/tutorial--epki-with-microsoft-ad-cs/
product: Access Server Docs
description: How to set up the Access Server External PKI (Public Key Infrastructure) feature using Microsoft Active Directory Certificate Services.
---

# Tutorial: Configure External PKI with Microsoft Active Directory Certificate Services (AD CS)

## Overview

The Access Server external public key infrastructure (PKI) feature integrates Access Server with third-party tools for X509 PKI management instead of using the built-in certificate management capabilities.

When configured for external PKI usage, Access Server doesn't manage client certificates directly; instead, the customer's third-party PKI software generates and distributes client certificate/key pairs to client machines and a server certificate/key pair to the OpenVPN server.

This tutorial shows you how to set up external PKI using Microsoft Active Directory Certificate Services (AD CS).

At a high level, these are the steps for your configuration:

1. Create the server CA using Certificate Authority via AD CS.
2. Create certificate templates for the server and clients.
3. Generate the server certificate and key via **MMC** (Microsoft Management Console).
4. Generate the client certificate and key via **MMC** (Microsoft Management Console).
5. Create the **TLS\_auth** key.
6. Generate Diffie Hellman parameters.
7. Import the necessary certificate and key files from your Windows Server to Access Server.
8. Provide the VPN client certificate/key pairs in a P12/PFX File.
9. Generate and download a server-locked profile for the client.

## Prerequisites

- An installed Access Server.
- A Windows Server with **Active Directory Certificate Services**, **Active Directory Certificate Services**, **Certificate Authority**, and **Certificate Authority Web Enrollment** roles.
- Console access and the ability to get root access.
- An OpenVPN client that supports the macOS Keychain and Windows certificate store.

> **Note**
>
> We used Windows Server 2019 in this guide.

## Step 1: Set Access Server to external PKI mode.

1. Connect to the Access Server console and get root privileges.
2. Edit **as.conf** for external PKI usage:

   ```
   nano /usr/local/openvpn_as/etc/as.conf
   ```
3. Comment out **certs\_db**:

   ```
   # certificates database
   # certs_db=sqlite:///~/db/certs.db
   ```
4. Save and exit the file — Ctrl-X, Y, then Enter.
   - Access Server no longer uses the certificate database. Instead, an external system must handle this.

## Step 2: Complete the AD CS configuration and CA creation on your Windows Server

When setting up your **AD CS Configuration** on **Windows Server**, you're prompted to specify the setup type of the CA. Ensure you select **Enterprise CA** and follow these next steps:

1. For **Setup Type**, select **Enterprise CA**.
2. Under **CA Type**, select **Root CA**.
3. Under **Private Key**, select **Create a new private key**.
4. Under **Cryptography**, select:
   - Key length = 2048
   - Select the hash algorithm \> SHA256
5. Under **CA Name**, enter the common name of the CA.
6. Under **Validity Period**, select the validity of your CA.
7. Under **Confirmation**, select **Configure**.

## Step 3: Export the CA certificate

1. Open **Server Manager**.
2. Select **Tools** and select **Certificate Authority**.
3. Right-click on your CA, and select **Properties**.
4. On the **Details** tab, select **Copy to File...**
5. On the **Export File Format** tab, select **DER Encoded Binary X.509 (.CER)**.
6. On **File to export**, enter the CA certificate file name (for example, `ca.cer`).
7. Select **Finish**.

## Step 4: Create certificate templates for the server

1. Open **Server Manager**.
2. Select **Tools** and select **Certificate Authority**.
3. Expand your CA, right-click **Certificate Templates**, and select **Manage**.
4. Duplicate the **Computer** template:
   - Right-click **Computer**, then select **Duplicate Template**.
   - On the **General** tab, enter a name for the template (for example, `OpenVPN Server`).
   - On the **Request Handling** tab, set **Purpose** to **Signature and encryption**.
   - On the **Subject Name** tab, select **Supply in the request**.

     > **Important**
     >
     > Active Directory Certificate Services may display a warning indicating that supplying the subject name in the request is less secure. This tutorial addresses that risk by restricting enrollment permissions in the following steps.
   - On the **Extensions** tab, under **Application Policies**, ensure **Client Authentication** and **Server Authentication** are selected.
   - On the **Security** tab:
     - Grant the appropriate users or groups **Read** permission only.
     - Grant only the Windows AD administrators both **Read** and **Enroll** permissions.
     - Remove the default **Enroll** permissions from Domain Computers.
   - (Recommended) On the **Issuance Requirements** tab, select **CA certificate manager approval**.

     > **Tip**
     >
     > When **CA certificate manager approval** is enabled, every certificate request must be manually approved or denied before it's issued.
     >
     > To review pending requests:
     >
     > 1. Open the certificate authority snap-in (`certsrv.msc`).
     > 2. Expand your certificate authority.
     > 3. Select **Pending Requests**.
     > 4. Right-click the certificate request.
     > 5. Select **All tasks**.
     > 6. Select **Issue** (to approve) or **Deny** (to reject).
   - Select **Apply**, then **OK**.
5. **Publish** the new template:
   - Go back to **Certificate Authority**.
   - Right-click **Certificate Templates \> New \> Certificate Template to Issue**.
   - Select your newly created template.

## Step 5: Generate the server certificate and key via MMC (Microsoft Management Console)

1. Type **Windows + R** and type **mmc**.
2. Select **OK**.
3. Select **File** and select **Add/Remove Snap-in...**
4. Select **Certificates**.
5. Select **Add**.
6. Select **Computer account**, select **Finish**, and select **OK**.
7. Right-click **Personal → All Tasks → Request New Certificate**.
8. Select the `OpenVPN Server` template you created and select **Click here to configure settings:**
   - On the **Subject** tab, go to **Subject name**, change **Type** to **Common name**, set the name of your server certificate (e.g., `OpenVPN Server`, and select **Add**.
   - On the **Extensions** tab, select **Extended Key Usage** and ensure that **Server Authentication** and **Client Authentication** are selected under **Selected options**.
   - On the **Private Key** tab, select **Key options**, and ensure **Make private key exportable** is selected.
   - Select **Apply**, then **OK**, and **Enroll**.

After the certificate is issued, export it:

1. In MMC, right-click your certiicate in **Personal → Certificates→ All Tasks → Export**.
2. Choose **Yes, export the private key**.
3. On **Security**, select **Password**, and configure a password for the server PFX file.
4. On **File to export**, set the name of the server PFX file (e.g., `server.pfx`).
5. Select **Finish**.

## Step 6: Create certificate templates for the client(s)

1. Open **Server Manager**.
2. Select **Tools** and select **Certification Authority**.
3. Expand your CA, right-click **Certificate Templates**, and select **Manage**.
4. Duplicate the **Computer** template:
   - Right-click **Computer**, then select **Duplicate Template**.
   - On the **General** tab, enter a name for the template (for example, `OpenVPN Client`).
   - On the **Request Handling** tab, set **Purpose** to **Signature and encryption**.
   - On the **Subject Name** tab, select **Supply in the request**.

     > **Important**
     >
     > Active Directory Certificate Services may display a warning indicating that supplying the subject name in the request is less secure. This tutorial addresses that risk by restricting enrollment permissions in the following steps.
   - On the **Extensions** tab, under **Application Policies**, ensure **Client Authentication** and **Server Authentication** are selected.
   - On the **Security** tab:
     - Grant the appropriate users or groups **Read** permission only.
     - Grant only the Windows AD administrators both **Read** and **Enroll** permissions.
     - Remove the default **Enroll** permissions from Domain Computers.
   - (Recommended) On the **Issuance Requirements** tab, select **CA certificate manager approval**.

     > **Tip**
     >
     > When **CA certificate manager approval** is enabled, every certificate request must be manually approved or denied before it's issued.
     >
     > To review pending requests:
     >
     > 1. Open the certificate authority snap-in (`certsrv.msc`).
     > 2. Expand your certificate authority.
     > 3. Select **Pending Requests**.
     > 4. Right-click the certificate request.
     > 5. Select **All tasks**.
     > 6. Select **Issue** (to approve) or **Deny** (to reject).
   - Select **Apply**, then **OK**.
5. **Publish** the new template:
   - Go back to **Certificate Authority**.
   - Right-click **Certificate Templates \> New \> Certificate Template to Issue**.
   - Select your newly created template.

## Step 7: Generate the client certificate and key via MMC (Microsoft Management Console)

1. Type **Windows + R** and type **mmc**.
2. Select **OK**.
3. Select **File** and select **Add/Remove Snap-in...**
4. Select **Certificates**.
5. Select **Add**.
6. Select **Computer account**, select **Finish**, and select **OK**.
7. Right-click **Personal → All Tasks → Request New Certificate**.
8. Select the `OpenVPN Client` template you created and select **Click here to configure settings:**
   - On the **Subject** tab, go to **Subject name**, change **Type** to **Common name**, set the common name of your client certificate (e.g., `etest`, and select **Add**.
   - (Optional, for environments using auto-login profiles.) On the **Subject** tab, go to **Subject name**, change **Type** to **Organization unit**, type `autologinrole`, and select **Add**.
   - On the **Extensions** tab, select **Extended Key Usage** and ensure that **Server Authentication** and **Client Authentication** are selected under **Selected options**.
   - On the **Private Key** tab, select **Key options**, and ensure **Make private key exportable** is selected.
   - Select **Apply**, then **OK**, and **Enroll**.

After the certificate is issued, export it:

1. In MMC, right-click your certiicate in **Personal → Certificates→ All Tasks → Export**.
2. Choose **Yes, export the private key**.
3. On **Security**, select **Password**, and configure a password for the client PFX file.
4. On **File to export**, set the name of the server PFX file (e.g., `client.pfx`).
5. Select **Finish**.

At this point, we now have three files:

1. CA certificate (ca.cer)
2. Server PFX file (server.pfx)
3. Client PFX files (client.pfx)

Now, we need to transfer the CA certificate and server PFX files to the Access Server. You can do this via WinSCP or SCP.

The client PFX file (client.pfx) will be transferred to the client machine.

## Step 8: Configure the necessary files on Access Server

1. Connect to the Access Server console and get root privileges.
2. Create a directory:

   ```
   mkdir epki && cd epki
   ```
3. Place the CA certificate and server PFX file from the Windows Server via WinSCP or SCP in this new "epki" directory.
4. Extract the server cert and key from the server PFX file with the below commands, then decript the server key:

   ```
   openssl pkcs12 -in server.pfx -clcerts -nokeys -out server.crt
   openssl pkcs12 -in server.pfx -nocerts -out server_password.key
   openssl rsa -in server_password.key -out server.key
   ```

   > **Important**
   >
   > When running these commands, you'll be prompted for a password. Use the password configured for the server PFX file in step 5.
5. Convert CA.cer to PEM format:

   ```
   openssl x509 -inform der -in CA.cer -out CA.pem
   ```
6. Create a **tls\_auth** key for the OpenVPN server:

   ```
   /usr/local/openvpn_as/scripts/certool --tls_auth
   ```
7. Generate Diffie Hellman parameters for the OpenVPN server:

   ```
   openssl dhparam -out dh.pem 2048
   ```
8. For Access Server 2.7 and newer, you must also generate your auth token and add the generated file:

   ```
   /usr/local/openvpn_as/scripts/certool --auth_token
   ```
9. Configure X509 explicit/extended key usage based on RFC3280 TLS rules:

   ```
   /usr/local/openvpn_as/scripts/sacli --key "external_pki.remote_cert_usage" --value eku ConfigPut
   ```
10. Configure the use of the X509 “OU” attribute for the declaration of auto-login permission:

    ```
    /usr/local/openvpn_as/scripts/sacli --key "external_pki.autologin_x509_spec" --value "OU,,autologinrole" ConfigPut
    ```
11. Generate the tls-crypt-v2 key (for Access Server 2.9.0 and higher only):

    ```
    /usr/local/openvpn_as/scripts/certool --tls_crypt2_server
    ```
12. Load the newly generated files into the Access Server config database:

    ```
    /usr/local/openvpn_as/scripts/sacli --key "external_pki.ta_key" --value_file ta.key ConfigPut
    /usr/local/openvpn_as/scripts/sacli --key "external_pki.ca_crt" --value_file CA.pem ConfigPut
    /usr/local/openvpn_as/scripts/sacli --key "external_pki.server_crt" --value_file server.crt ConfigPut
    /usr/local/openvpn_as/scripts/sacli --key "external_pki.server_key" --value_file server.key ConfigPut
    /usr/local/openvpn_as/scripts/sacli --key "external_pki.dh_pem" --value_file dh.pem ConfigPut
    /usr/local/openvpn_as/scripts/sacli --key "external_pki.auth_token_key" --value_file auth_token.key ConfigPut
    /usr/local/openvpn_as/scripts/sacli --key "external_pki.tls_cryptv2_server" --value_file tls_crypt2.key ConfigPut
    ```
13. Start Access Server:

    ```
    systemctl restart openvpnas
    ```

## Step 9: Configure a test client

To test our example, we generate a test client, **etest**.

1. Sign in to the Admin Web UI.
2. Select **User Management → User Permissions**.
3. Create the new user, **etest**, and select **More Settings** to enter a password.
4. (Optional, for environments using auto-login profiles.) Check **Allow Auto-login** for the user.
5. Select **Save Settings** and **Update Running Server**.
6. Generate a server-locked profile. The profile will be stored in **etest.ovpn**:

   ```
   /usr/local/openvpn_as/scripts/sacli GetGeneric >etest.ovpn
   ```

   For generating an auto-login profile:

   ```
   /usr/local/openvpn_as/scripts/sacli --user etest GetAutologin >etest.ovpn
   ```
7. Copy these two files to the client machine:
   - Client PFX file (client.pfx)
   - Client profile (etest.ovpn)

## Step 10: Import the client profile and the client PFX file into OpenVPN Connect v3

1. Launch OpenVPN Connect v3.
2. Import the connection profile, **etest.ovpn**.
3. Select **Menu → Certificate & Tokens**.
4. Under **PKCS#12**, Select the **Add** icon.
5. Select your client P12 file (etest.p12).
6. Enter the password for this file that you previously configured, then select **OK**.
7. Go back to the **Home**.
8. Select **Menu → My Profiles**.
9. Select the **Edit** icon for the profile.
10. Under **Certificates**, use the **Select** button to add the external certificate to the profile.
11. Select the P12 file.
12. Select **Save Changes**.
13. Select **Connect** to start the profile's connection.

## Simplified ePKI client configuration (Access Server 2.14.2 and later)

With the release of Access Server 2.14.2, we've made configuring client connection profiles for ePKI easier. Previously, creating these profiles required using the command line, as noted in the tutorial. However, in version 2.14.2 and later, you can now create and manage ePKI client connection profiles directly from Access Server's Client Web UI.

There are two types of ePKI profiles available:

1. **Generic ePKI profile:**
   - This profile requires the user to authenticate with a password when connecting.
   - Ideal for environments where a password-based security layer is needed in addition to certificate-based authentication.
2. **Auto-login ePKI profile;**
   - This profile automatically uses the certificate for authentication without requiring a password.
   - Suitable for unattended devices or systems where automatic, certificate-based login is needed.

In addition, the **Import Profile from URL** functionality in **OpenVPN Connect** allows users to import these connection profiles directly, making the configuration process faster and more seamless.

This update simplifies the ePKI setup, providing more flexibility and reducing the reliance on the command line.

---

Prev: [Tutorial: Configure External PKI with OpenSSL](https://openvpn.net/as-docs/tutorials/tutorial--epki-with-openssl.md)
Next: [Tutorial: Configure External PKI with Easy-RSA](https://openvpn.net/as-docs/tutorials/tutorial--epki-with-easy-rsa.md)
Index: https://openvpn.net/as-docs/llms.txt