This topic describes how to install and configure Microsoft Provisioning System (MPS) DNS provisioning

Tasks

  1. Install IIS and ASP.NET
  2. Install the MPS DNS Client
  3. Configure Server Certificates

Install IIS and ASP.NET on DNS01

Install Internet Information Services (IIS) with ASP.NET on DNS01.

Procedure W08-DWSPV.49: To install IIS and ASP.NET on DNS01

  1. Log on to DNS01 as the local Administrator and open the Server Manager console.

  2. Add the Web Server (IIS) role. Add the features required for Web Server (Windows Process Activation Service) when prompted.

  3. In addition to the default web server roles, select additional services according to the following table:

    Application Development

    Security

    Management Tools

    • ASP.NET
      Note:
      Add features required for ASP.NET when prompted.
    • Basic Authentication
    • Windows Authentication
    • Request Filtering
    • IP and Domain Restrictions
    • IIS 6 Management Compatibility

  4. Confirm your selections and start the installation.

Install the MPS DNS Client on DNS01

Procedure W08-DWSPV.50: To install the MPS DNS Client on DNS01

  1. On DNS01, run DNSClient.msi from the solution distribution media in the Service Provisioning\MPS\Providers\DNS directory.

  2. Accept the default values for Website Name and Virtual Directory Name.

  3. Perform a complete installation.

Configure Server Certificates

To enable secure communications between the DNS Provider Web application and the DNS Provider client components using Secure Sockets Layer (SSL), you must install the Certificate Chain and request a Certificate that will be used by the DNS Provider Web Application.

Add Hosts File Entry for the PKIRoot Server

Because the DNS01 server is not using AD01 for DNS name resolution, it must have a hosts file entry to locate pkiroot.fabrikam.com by name.

Procedure W08-DWSPV.51: To add hosts file entry for the PKIRoot server

  1. On DNS01, edit the C:\Windows\system32\drivers\etc\hosts file for PKIROOT.

  2. Add entries for both the Netbios name and the fully qualified domain name (FQDN). For example:

      Copy Code 
    10.0.3.12 pkiroot.fabrikam.com
10.0.3.12 pkiroot

Download and Install the Certificate Chain for Your CA onto DNS01

Procedure W08-DWSPV.52: To download and install the certificate chain for your CA onto DNS01

  1. On DNS01, browse to https://PKIRoot.fabrikam.com/certsrv. When prompted, log on as FABRIKAM\Administrator.

    Note:
    Internet Explorer may warn you that Intranet settings are currently disabled. You should enable Intranet settings before you can proceed.

  2. Follow the on-screen instructions to download CA certificate chain and save the file on the root of the C: drive on DNS01.

  3. Start Microsoft Management Console by running mmc.exe at a command prompt.

  4. On the File menu, select Add/Remove Snap-in.

  5. Add a certificate snap-in to manage certificate for the local computer (the computer this console is running on).

  6. In the console tree, expand Certificates (Local Computer), expand Trusted Root Certification Authorities.

  7. Right-click Certificates, point to All Tasks, and then select Import.

  8. Follow the Import Wizard to select and open the file where you saved the certificate in step 2.

  9. Leave the default value Place all certificates in the following store and ensure Trusted Root Certification Authorities appears under the Certificate store.

  10. Follow the on-screen instructions to complete the import.

Create a Certificate Request on DNS01

Procedure W08-DWSPV.53: To create a certificate request on DNS01

  1. On DNS01, open Internet Information Services (IIS) Manager and expand DNS01.

  2. Create a certificate request with the following information:

    • Common name: The IP address of DNS01. If DNS01 has more than one IP address, specify the IP that the MPS Provisioning Server will connect to when provisioning DNS records.
      Note:
      The Name field must contain the IP address of the DNS01 server for DNS provisioning to work properly over SSL.
    • Organization: fabrikam
    • Organizational Unit: Hosting

  3. Accept the default Cryptographic Service Provider Properties. Specify the filename C:\DNS01-Cert-Request.txt.

Request and Install the Web Server Certificate onto DNS01

Procedure W08-DWSPV.54: To request and install the Web server certificate onto DNS01

  1. On DNS01, browse to https://PKIRoot.fabrikam.com/certsrv. When prompted for credentials, log on as FABRIKAM\Administrator.

  2. Select Request a Certificate, and then select Advanced certificate request.

  3. Select Submit a certificate request by using a base-64-encoded CMC or PKCS #10 file, or submit a renewal request by using a base-64-encoded PKCS #7 file.

  4. Enter the contents of your saved certificate request (C:\DNS01-Cert-Request.txt) into the Saved Request field.

  5. Select Web Server template as the certificate template, and then submit the request.

  6. Select Base 64 encoded certificate; download the certificate and save the file as C:\Certnew.cer.

Install the Web Server Certificate into the Local Computer certificate store

Procedure W08-DWSPV.55: To install the Web server certificate into the local computer certificate store

  1. Open the Certificates (local computer) MMC snap-in and navigate to the Personal folder.

  2. Import the web server certificate file (C:\Certnew.cer) to the Personal folder.