I've read several articles and I've built out an automation using PoSH-ACME that works for normal SSL services.
However, there are some limitations that are causing issues with LDAP/Domain Controller/Domain Services.
Secure LDAP in Entra Domain Services requires a wildcard certificate.
Domain controllers require the FQDN of the server in either the subject or SAN.
A wildcard cert from LetsEncrypt can't include the FQDN of any domain controller because LetsEncrypt considers this "redundant." This is technically true, but is a bit strict.
I've got a powershell script that could theoretically do all of the steps for automating certificate requests and installations on all domain controllers, as well as updating the cert at Entra Domain Services.
For Entra Domain Services Secure LDAP to work, I need to be able to request a wildcard certificate with all of the domain controllers FQDNs as SANs. Maybe I'm missing something?
The secure LDAP tutorial seems to indicate that the wildcard certificate is used so that Domain Controller FQDNs don't have to be in the certificate
In particular
Subject name - The subject name on the certificate must be your managed domain. For example, if your domain is named aaddscontoso.com, the certificate's subject name must be *.aaddscontoso.com.
The DNS name or subject alternate name of the certificate must be a wildcard certificate to ensure the secure LDAP works properly with Domain Services. Domain Controllers use random names and can be removed or added to ensure the service remains available.
If there's an issue with not including redundant FQDNs covered by a wildcard, we might be able to help.
Yeah, I'm very confused. Are you saying that you have to work around some client that sees a certificate for *.example.com when trying to connect to some-host.example.com but doesn't think that the wildcard certificate matches? That's been a standard for a very long time now and I'd be surprised if any current client could handle Let's Encrypt's root but couldn't understand wildcards.
Even if you need to deal with some sort of broken system like that, couldn't you use one certificate for the specific hostname, and a separate wildcard certificate for your other systems?
That's true for Entra Domain Services, but our local domain controllers require the FQDN in the subject or SAN for LDAP:
Subject or Subject Alternative Name: Must contain the domain controller's Active Directory FQDN (for example, dc01.contoso.com) in either the Common Name (CN) field or as a DNS entry in the Subject Alternative Name extension
However, I think I was not thinking through properly! I was thinking the certificate had to be the same in Entra as our local DCs because we've been purchasing wildcard certs and since they became extremely expensive we just put all of the DCs and other hostnames in the SAN so we can reuse that cert in multiple places. I think we can just get the wildcard cert for Entra Domain Services, and then named certs for the DCs and call it a day.
Yeah. We usually just get a wildcard cert for the domain with all the other hostnames as SANs. There was no reason to do that other than to keep costs down. We've just done it for so long that I didn't think about doing it any other way.
Those are all from the same domain name [example.com].
I meant using FQDNs from domain ONE and a wildcard from domain TWO.
[because LE is perfectly capable of combining those two in one cert]