An often asked question from early HVR deployments has been about the product’s certificate requirements. This post captures the pre-requisites for enabling replication using certificate based authentication.

HVR uses machine level mutual authentication, which requires you to install the certificates in the Personal certificate store of the local computer.

View/Import Certificates

To view or to import the certificates

   i.  Launch mmc from the command prompt.

   ii. Click File->Add/Remove Snap-in... and choose Certificates from the available list of snap-ins.

   iii. Choose 'Computer Account' in the Certificate snap-in pop up

     iv.   Open the Certificates store under the Personal store.

Primary Server Certificate Requirements

To setup a replication relationship, the certificate in the primary server must meet the following conditions:

• Enhanced Key Usage must support both Client and Server authentication

• Set the Subject field or the Subject Alternative Name using one of the following methods:
• Set the Subject field to the primary server name (e.g.: primary1.contoso.com).  If the primary server is part of a cluster, ensure that the subject field is set to the FQDN of the HVR Broker (install this certificate on all the nodes of the cluster).

(or)

• Subject field can contain a wildcard (e.g.: *.department.contoso.com).

 (or)

• For a SAN certificate, set the Subject Alternative Name’s DNS Name to the primary server name (e.g.: primary1.contoso.com). If the primary server is part of a cluster, the Subject Alternative Name of the certificate should contain the FQDN of the HVR Broker (install this certificate on all the nodes of the cluster).

• Ensure that the valid X.509v3 certificate is not revoked.
• Check if the root of this certificate is present in the “Trusted Root Certification Authorities” of the replica server certificate store.

Replica Server Certificate Requirements

To enable a server to receive replication traffic, the certificate in the replica server must meet the following conditions

• Enhanced Key Usage must support both Client and Server authentication
• Set the Subject field or the Subject Alternative Name using one of the following methods:
• For a SAN certificate, set the Subject Alternative Name’s DNS Name to the replica server name (e.g.: replica1.contoso.com). If the replica server is part of cluster, the Subject Alternative Name of the certificate must contain the replica server name *and* FQDN of the HVR Broker (install this certificate on all the nodes of the cluster.)

(or)

• Set the Subject field to the replica server name (e.g.: replica1.contoso.com). If the replica server is part of cluster, ensure that a certificate with the subject field set to the FQDN of the HVR Broker is installed on all the nodes of the cluster.

(or)

• Subject field can contain a wildcard (e.g.: *.department.contoso.com)

• Ensure that the valid X.509v3 certificate is not revoked.
• Check if the root of this certificate is present in the “Trusted Root Certification Authorities” of the replica server certificate store.

Validate using certutil

After the certificate is installed, run the following command from the command prompt on both the primary and replica server:

certutil –store my

At least one of the certificates in your output should resemble the following sample output such that the Encryption test (not just Signature) has passed.

==============================Certificate 1 =====================================================

For a sample HVR deployment scenario using makecert certificate, see Appendix C of the UTG which is available here.

In the next few weeks , we will be posting an end to end workflow for enabling replication using certificates.

- Hyper-V Replication Team