Question on CAPolicy.inf file and post-installation script

Question

I'm preparing a small PKI implementation with a single Enterprise Root CA on Windows 2008 R2 Enterprise.
The primary role of this CA is to provide certificates for about 20 laptops that will use the certificates for authentication to a wireless network.
I have prepared a CAPolicy.inf file and a post installation script (below).
Renewal period for the root cert should be 10 years, CRL publication every 2 days with Delta publication every 12 hours (details in scripts below).
I want to make sure the AIA and CRL url commands are correct.
Does this look correct?
AIA
1:%WINDIR%\System32\CertSrv\CertEnroll\%%1_%%3%%4.crt
This should publish the CA certificate to the local file system "certenroll".
2:ldap:///CN=%%7,CN=AIA,CN=Public Key Services,CN=Services,%%6%%11
This places the LDAP url in the AIA extension of issued certs.
I am not planning to use HTTP, hence its absence.
CRL
1:%WINDIR%\System32\CertSrv\CertEnroll\%%3%%8%%9.crl
This publishes the CRL to the local file system ("certenroll" subfolder).
10:ldap:///CN=%%7%%8,CN=%%2,CN=CDP,CN=Public Key Services,CN=Services,%%6%%10
Indicates CDP in AD DS and includes CDP url in issued certificates.
Complete scripts
1. CAPolicy.inf - %windir%
[Version]
Signature= "$Windows NT$"
[certsrv_server]
renewalkeylength=2048
RenewalValidityPeriodUnits=10
RenewalValidityPeriod=years
CRLPeriod = days
CRLPeriodUnits = 2
CRLDeltaPeriod = hours
CRLDeltaPeriodUnits = 12
LoadDefaultTemplates=0
2. Install Role
Follow steps in GUI here
3. Run post-install script
certutil -setreg CA\DSConfigDN CN=Configuration,DC=mydomain,DC=local
certutil -setreg CA\CRLPeriodUnits 2
certutil -setreg CA\CRLPeriod "days"
certutil -setreg CA\CRLDeltaPeriodUnits 12
certutil -setreg CA\CRLDeltaPeriod "hours"
certutil -setreg CA\ValidityPeriodUnits 10
certutil -setreg CA\ValidityPeriod "Years"
certutil –setreg CA\CACertPublicationURLs "1:%WINDIR%\System32\CertSrv\CertEnroll\%%1_%%3%%4.crt\n2:ldap:///CN=%%7,CN=AIA,CN=Public Key Services,CN=Services,%%6%%11"
certutil –setreg CA\CRLPublicationURLs "1:%WINDIR%\System32\CertSrv\CertEnroll\%%3%%8%%9.crl\n10:ldap:///CN=%%7%%8,CN=%%2,CN=CDP,CN=Public Key Services,CN=Services,%%6%%10"
certutil -setreg CA\csp\DiscreteSignatureAlgorithm 1
certutil -setreg CA\AuditFilter 127
net stop certsvc & net start certsvc
certutil -crl
Please mark as helpful if you find my contribution useful or as an answer if it does answer your question. That will encourage me - and others - to take time out to help you.

Answer 1

A couple of things (just a quick glance)
1) CAPolicy.inf
Everything looks fine in this file. You will have a 2 day base crl and 12 hour delta CRLs. No default templates are loaded, so you must manually designate all published certificates
2) Post install Script
a. Best practices are to use HTTP only, not to use LDAP, so your whole design does not follow best practices. Furthermore, if you issue a certificate to a single, non-domain joined machine, they will be unable to evaluate your certificates. If you decide
to do VPN (or use an internal SSL cert on an externally accessible Web server), revocation checking will fail because you do not publish AD to the external world
b. Will you be issuing 10 year certificates from the CA. These lines:
certutil -setreg CA\ValidityPeriodUnits 10
certutil -setreg CA\ValidityPeriod "Years"
define the maximum validity period of certs issued *by* the CA. For example, if a certificate template states 4 years, then a four year will be issued (less than 10 years). If a template state 12 years, then the max age will be 10 years. Think of it as a
governor.
c.CACertPublicationURLs . This should include an HTTP URL, and if you want to still include LDAP, HTTP should be prior to the LDAP URL.
d. CRLPublicationURLs. This should include an HTTP URL. If you want to still include LDAP, HTTP should be prior to the LDAP URL. Your checkbox value for the LDAP URL is incorrect as well. For a CA that issues both base and delta CRLs, you must have a value
of 79 (all check boxes enabled). Your current configuration would fail for revocation checking because you do not publish the base or delta CRL to AD. There is another check box missing (I believe the one to include the URL in the base CRL's freshest CRL extension
(how to find the delta CRL).
e. Do not include the DiscreteSignatureAlgorithm line in the script. If you have any Windows XP clients, they will not be able to use the certs (BTW, this should have been AlternateSignatureAlgorithm in my book - where you sourced your scripts). This would
only be used on a CA where you used something like Elliptical Curve as the assymetric algorithm and SHA384 as the signature algorithm).
f. The restart line should be net stop certsvc && net start certsvc. The double && ensures that the service comes to a complete stop before the start command is executed.
HTH,
Brian