Setting Up a Simple Windows CA for CapyDaemon

Overview

For a development/homelab environment, Windows Server's Active Directory Certificate Services (AD CS) provides a straightforward way to manage certificates for mTLS authentication between CapyDaemon and the backend server.

Option 1: Active Directory Certificate Services (AD CS) - Recommended for Domain Environments

Prerequisites:

• Windows Server (any recent version: 2016, 2019, 2022)
• Domain environment (if you want auto-enrollment features)
• Local Administrator access

Installation Steps:

1. Install AD CS Role:

   Install-WindowsFeature AD-CS-Cert-Authority -IncludeManagementTools

2. Configure CA (Enterprise CA if domain-joined, Standalone otherwise):

   • Run: Install-AdcsCertificationAuthority -CAType EnterpriseRootCA -CACommonName "CapyDaemon-RootCA"
   • For non-domain: Use StandaloneRootCA instead
   • Follow the post-installation wizard to configure basics

3. Create Certificate Template for CapyDaemon Hosts:

   • Open Certification Authority management console (certsrv.msc)
   • Right-click Certificate Templates → Manage
   • Duplicate the "Computer" or "Workstation Authentication" template
   • Name it "CapyDaemon-Client"
   • Under Extensions tab → Application Policies: Ensure "Client Authentication" is present
   • Under Subject Name tab: Configure how subject names are built (typically "Supply in request" for flexibility)
   • Adjust validity period as needed (default is often 1-2 years)
   • Publish the template back to the CA

4. Create Certificate Template for Backend Server:

   • Duplicate the "Web Server" template
   • Name it "CapyDaemon-Server"
   • Ensure "Server Authentication" is in Application Policies
   • Publish the template

5. Issue Certificates:

   For the Backend Server:

   # Create certificate request
   $cert = New-SelfSignedCertificate -DnsName "backend.yourdomain.local" `
       -CertStoreLocation "Cert:\LocalMachine\My" `
       -NotAfter (Get-Date).AddYears(2)
   
   # Or submit a request to your CA
   certreq -new request.inf backend.req
   certreq -submit -config "CA-SERVER\CapyDaemon-RootCA" backend.req backend.cer
   certreq -accept backend.cer

For Each CapyDaemon Host:

   # Generate request for each host
   certreq -new request.inf capydaemon-host01.req
   certreq -submit -config "CA-SERVER\CapyDaemon-RootCA" capydaemon-host01.req capydaemon-host01.cer
   certreq -accept capydaemon-host01.cer

6. Export Root CA Certificate:

   # Export the root CA cert (public only) for distribution to all hosts
   certutil -ca.cert ca_cert.cer

• Distribute this to all CapyDaemon hosts so they can validate the backend server's certificate

7. Export Certificates for CapyDaemon:
   • Export each host certificate with private key (PFX format)
   • Secure the PFX files with passwords
   • Deploy to respective hosts

Option 2: Standalone OpenSSL-based CA on Windows (Simpler for Non-Domain)

If you don't have or want to use Active Directory, you can run OpenSSL on Windows:

Prerequisites:

• Install OpenSSL for Windows (from https://slproweb.com/products/Win32OpenSSL.html or via Chocolatey: choco install openssl)

Setup Steps:

1. Create Root CA:

   # Generate CA private key
   openssl genrsa -aes256 -out ca-key.pem 4096
   
   # Generate CA certificate
   openssl req -new -x509 -days 3650 -key ca-key.pem -sha256 -out ca-cert.pem -subj "/C=US/ST=State/L=City/O=YourOrg/CN=CapyDaemon-RootCA"

2. Create Backend Server Certificate:

   # Generate server private key
   openssl genrsa -out backend-key.pem 4096
   
   # Create certificate signing request
   openssl req -new -key backend-key.pem -out backend.csr -subj "/C=US/ST=State/L=City/O=YourOrg/CN=backend.yourdomain.local"
   
   # Sign with CA
   openssl x509 -req -in backend.csr -CA ca-cert.pem -CAkey ca-key.pem -CAcreateserial -out backend-cert.pem -days 730 -sha256 -extfile <(echo "subjectAltName=DNS:backend.yourdomain.local,IP:192.168.1.100")

3. Create CapyDaemon Client Certificates:

   # For each host (repeat with different names)
   openssl genrsa -out capydaemon-host01-key.pem 4096
   openssl req -new -key capydaemon-host01-key.pem -out capydaemon-host01.csr -subj "/C=US/ST=State/L=City/O=YourOrg/CN=capydaemon-host01"
   openssl x509 -req -in capydaemon-host01.csr -CA ca-cert.pem -CAkey ca-key.pem -CAcreateserial -out capydaemon-host01-cert.pem -days 730 -sha256

4. Distribution:
   • ca-cert.pem: Distribute to ALL hosts (backend + all CapyDaemon instances)
   • backend-cert.pem + backend-key.pem: Deploy to backend server
   • capydaemon-hostXX-cert.pem + capydaemon-hostXX-key.pem: Deploy to respective hosts

Additional Resources:

• Windows CA Setup Notes