Jump to content


  • 0
anyweb

How can I configure PKI in a lab on Windows Server 2016 - Part 5

Question

This series is comprised of different parts, listed below.

In part 1 of this series, you configured your LAB for a 2 tier PKI hierarchy running on Windows Server 2016. You used PowerShell to create some virtual machines, and then installed Windows Server 2016,  Windows 10 Enterprise version 1803 and optionally Smoothwall 3.1 before configuring the IP address scheme and Computer Names on the virtual machines. Finally you configured ADDS on DC01 so that you have a working Domain Controller for the rest of this LAB. In part 2 you installed and did the initial configuration on the Standalone Offline Root CA. In part 3 you prepared the HTTP Web Server for CDP and AIA Publication and you created a DNS record for the publicly available web server.

In part 4 you performed post configuration on the Standalone Offline Root CA to set certificate revocation list (CRL) period registry settings using CertUtil, and then enabled object access Auditing and finally, you configured three locations for the Authority Information Access (AIA) and four locations for the Certificate revocation list Distribution Point (CDP), again using CertUtil. In this part you will install and do initial configuration on the Enterprise Issuing CA. This is a long blog post so make sure you've got lots of coffee or beer handy (depending on your preference).

Step 1. Add EntAdmin user to groups

We'll be using a special user called EntAdmin (an Enterprise Admin and a member of Cert Publishers) for some tasks on the IssuingCA computer, but before doing so, we need to add that user as a member of the Enterprise Admins group and the Cert Publishers on the domain controller. You could do so simply by issuing the following in Windows PowerShell ISE on DC01.

Import-Module ActiveDirectory
Add-ADGroupMember -Identity "Enterprise Admins" -Members "EntAdmin"
Add-ADGroupMember -Identity "Cert Publishers" -Members "EntAdmin"

Alternatively you can run this script in Windows PowerShell ISE as windowsnoob\Administrator on DC01.

Create Users Usergroups and OUs in AD.ps1

adding entadmin.png

Step 2. join IssuingCA to the domain

When you installed the Issuing CA virtual machine (#11_IssuingCA) in part 1, it was workgroup joined. To join the domain do as follows. Logon to the web server virtual machine as Administrator. In Windows File Explorer, right click on This PC and choose Properties. Click on Change Settings beside Computer name, domain and workgroup settings. You can follow the instructions in Part 3, Step 1 for how to join a domain manually or use the JoinDomain.ps1 PowerShell script here.

JoinDomain.ps1

1. Copy the script to C:\Scripts on the IssuingCA server.

2. Edit the variables (lines 16-18) as desired before running.

3. Start Windows PowerShell ISE as Administrator and run the script by clicking on the green triangle.

Note: After running the script, the computer will restart automatically.

Step 3. Add EntAdmin as a local admin on IssuingCA

Next, logon to the IssuingCA domain joined computer as windowsnoob\administrator. Once logged in, start compmgmt.msc and add EntAdmin as to the Local Administrators group by expanding System Tools, Local Users or Groups, Administrators, Members tab and clicking Add, Enter EntAdmin as the user.

Alternatively use this PowerShell command to do it for you on the IssuingCA computer while logged in as windowsnoob\administrator.

Add-LocalGroupMember -Group Administrators -Member windowsnoob\EntAdmin

Press Enter. The output of the above command is shown below.

adding entadmin as local admin on issuingca.png

The user is now listed as a member of Local Administrators group on IssuingCA.

local admin.png

After doing the above, logoff (Sign out) from IssuingCA.

Step 4. Create an OID

Before creating the CAPolicy.inf file in the next step, we should use our own OID rather than the default Microsoft one (OID= 1.2.3.4.1455.67.89.5). I'm using a PowerShell script found here for that purpose (1).

You can download that script below:

createOID.ps1

Step 5. Create a CAPolicy.inf file for the Enterprise Issuing CA.

Before installing the Issuing CA, you should create a CAPolicy.inf to define 'default' settings for CA templates, some of these settings cannot be changed later and you want them in place before creating any certificates on the Issuing CA.

On the #11_IssuingCA virtual machine (IssuingCA), login as windowsnoob\Entadmin using the password specified.

Open an administrative command prompt and type the following:

notepad C:\Windows\CAPolicy.inf

and press ENTER, when prompted to create new file, click Yes. Paste in the following text into the new CAPolicy.inf file.
  

[Version]
Signature="$Windows NT$"

[PolicyStatementExtension]
Policies=InternalPolicy

[InternalPolicy]
OID=1.2.3.4.1455.67.89.5
URL=http://pki.windows-noob.com/cps.txt

[Certsrv_Server]
RenewalKeyLength=2048
RenewalValidityPeriod=Years
RenewalValidityPeriodUnits=10
LoadDefaultTemplates=0
AlternateSignatureAlgorithm=0 

Once done, paste in the OID created in Step 4 and then save the file as C:\Windows\CAPolicy.inf.

Note: The OID in the CAPolicy.inf pasted above uses Microsoft's own OID, you should use the one generated in Step 4 or obtain one from here (2).

Step 6. Publish the Root CA Certificate and CRL

In this step, you will copy CER and CRT files from the Standalone Offline Root CA virtual machine to the IssuingCA virtual machine before publishing the Root CA Certificate and CRL. I'm showing you a few methods how to copy the files (PowerShell or manually) but you are doing so using a 1GB VHDX disk. The reason for this is you should not connect the StandAlone Offline Root CA to the network.

On your Hyper-V host (the computer that you use to host this LAB), run the following PowerShell script (after adjusting the variables as necessary) to create a 1GB VHDX disk which we will use to copy CER and CRL files between the StandAlone Offline Root CA (RootCA) to the IssuingCA virtual machines.

Note: The first time your run this script it will automatically attach the VHDX to the #11_RootCA virtual machine. You may need to open disk administrator on that virtual machine and change the disk to Online before use.

Download the PowerShell script - create_PKI_vhdx.ps1

Note: Before taking any new snapshots (checkpoints) of your virtual machines, please ensure that you have first offlined the PKI disk and then removed it from the respective vm's.

create_pki_vhdx.png

Logon to the StandAlone Offline Root CA (RootCA) as Administrator, and if necessary, change the just attached vhdx disk to Online using Disk Management.

online disk.png

Using a command prompt, copy the StandAlone Offline Root CA Certificate (ROOTCA_windows noob Root CA.crt) and Root CA CRL (windows noob Root CA.crl) files from the C:\Windows\System32\CertSrv\CertEnroll directory on RootCA server to the VHDX removable media (probably E:\).

copy C:\Windows\System32\CertSrv\CertEnroll\*.cr* E:\

copying files.png

Now, using Disk Management, set the PKI disk to Offline

set offline.png

Using the virtual machine settings GUI for #11_RootCA (RootCA), remove the previously attached PKI disk.

remove PKI disk.png

or alternatively, use the following PowerShell (on the Hyper-v host), where $TargetVM="#11_RootCA"

Remove-VMHardDiskDrive -VMName $TargetVM -ControllerType SCSI -ControllerNumber 1 -ControllerLocation 1

On the #11_IssuingCA virtual machine, use the Virtual Machine GUI settings to attach the PKI disk, or use Powershell where $TargetVM="#11_IssuingCA" and $path=the path to the VHDX file

Add-VMHardDiskDrive -VMName $TargetVM -ControllerType SCSI -ControllerNumber 1 -ControllerLocation 1 -Path $path

On the #11_IssuingCA virtual machine, login as windowsnoob\EntAdmin and using Disk Management, change the PKI disk to Online.

Issue the following command as windowsnoob\EntAdmin where E:\somefile.crt is the path to the CRT file.

Note: Pay close attention when doing this step, getting it wrong will cause problems with PKIview and other areas. RootCA in this case is not the host name here, but the DS Trusted Root store store name, see this comment for more details.

certutil -f -dspublish "E:\ROOTCA_windows noob Root CA.crt" RootCA 

Press Enter. The output of the above command is shown below. You should see "Certificate added to DS store".

certificate added to the store.png

Next, issue the following command as windowsnoob\EntAdmin where E:\somefile.crl is the path to the CRL file and where RootCA is the HOSTNAME of your Standalone Offline Root CA server.

certutil -f -dspublish "E:\windows noob Root CA.crl" RootCA 

Press Enter. The output of the above command is shown below. You should see "Base CRL added to DS store".

Base CRL added to DS store.png

Using Windows File Explorer on IssuingCA as windowsnoob\Entadmin, copy the CR* files on E:\ (or whatever drive letter the PKI disk is mounted as) to \\webserver.windowsnoob.lab.local\CertEnroll

copy cr files to webserver.png

On the IssuingCA, to add the windows noob Root CA Certificate and CRL to the IssuingCA local store, run the following command from an administrative command prompt as windowsnoob\EntAdmin. Ensure that you substitute the correct drive letter of your removable media (for E:) in the command below:

certutil -addstore -f root "E:\ROOTCA_windows noob Root CA.crt"

Press Enter. The output of the above command is shown below. You should see "CertUtil: -addstore command completed successfully".

certutil local store.png

Next, run the following command from an administrative command prompt as windowsnoob\EntAdmin. Ensure that you substitute the correct drive letter of your removable media (for E:) in the command below:

certutil -addstore -f root "E:\windows noob Root CA.crl"

Press Enter. The output of the above command is shown below. You should see "CertUtil: -addstore command completed successfully".

certutil crl addstore.png

Step 7. Install the Subordinate Issuing CA

Now that you've created the CAPolicy.inf file and published the CRT and CRL files (from the StandAlone Offline Root CA) to Active Directory, copied them to the Webserver CertEnroll folder and to the local store on the Issuing CA, you are ready to install Active Directory Certificate Services (on the Issuing CA).

To do so, open Server Manager and select Add Roles and Features, on the Before You Begin page select Next. On the Select Server Roles page select Active Directory Certificate Services and then click Next, if prompted to Add features that are required for Active Directory Certificate Services, click Add features.

On the Introduction to Active Directory Certificate Services page, click Next. On the Select Role Services page (shown below), select Certification Authority and Certification Authority Web Enrollment. If you see the Add Roles Wizard, click Add Required Role Services. Click Next.

adding adcs to issuingCA.png

Continue through the wizard and click on Install. Leave the wizard open until the feature installation completes successfully, then click Close.

Install.png

In Server Manager, click on Configure Active Directory Certificate Services (yellow exclamation mark).

configure active directory certificate services.png

Ensure that your credentials are windowsnoob\EntAdmin click Next.

credentials.png

On the Select roles to configure, ensure that both Certification Authority and Certification Authority Web Enrollment are selected. On the Specify the setup type of the CA page, ensure that Enterprise is selected, and then click Next.

Note: The Enterprise option will be greyed out if you are not logged on as Enterprise Admin (windowsnoob\EntAdmin) or do not have local administrator permission.

enterprise ca.png

On the Specify the type of CA page, select Subordinate CA, and then click Next.

subordinate ca selected.png

On the Set Up Private Key page, ensure that Create a new private key is selected, and then click Next. Ensure that Sha256 is selected  on the Specify the cryptographic options page, then click Next.

specify the cryptographic options.png

Note: When installing in a production environment, the CSP, Hash Algorithm and Key length selected must support application compatibility requirements of your organization.

On the Specify the name of the CA page, clear the existing entry for Common name for this CA box, and enter windows noob Issuing CA, then click Next.

windows noob issuing ca.png

On the Request certificate from a parent CA page, select Save a certificate request to file and manually send it later to a parent CA option then click Next

save a certificate request to file.png

Continue through the wizard and finally click on Configure in the Confirm Installation Selections page, finally, click on Close at the Configuration Succeeded screen. Take note of the warning,  it is expected.

configuration succeeded.png

Step 8. Copy the certificate request file to the StandAlone Offline Root CA

Run the following command from an administrative command prompt as windowsnoob\EntAdmin on the IssuingCA computer. Ensure that you substitute the correct drive letter of your removable media (for E:) in the command below:

copy c:\IssuingCA.windowsnoob.lab.local_windowsnoob-ISSUINGCA-CA.req E:\

1 files copied.png

Next, take the PKI disk offline in Disk Management on the IssuingCA

set offline.png

Next, Remove the PKI disk from the IssuingCA virtual machine using the GUI settings or use the PowerShell commands shown earlier to do it.

remove from issuingca.png

And insert the PKI disk into the StandAlone Offline Root CA virtual machine, then make if Online in Disk Management (on RootCA).

Step 9. Submit the Request and Issue windows noob Issuing CA Certificate

On the StandAlone Offline Root CA, login as Administrator and use the following command in an Administrative command prompt where E:\ is the PKI disk

certreq -submit E:\IssuingCA.windowsnoob.lab.local_windowsnoob-ISSUINGCA-CA.req

When prompted which CA to use, select the windows noob Root CA and click OK.

windows noob root ca.png

Take note of the certificate requestID

certificate requestID.png

On the StandAlone Offline Root CA, start CertSrv.msc and click on Pending requests, right click the matching RequestID, choose All Tasks then select Issue.

issue.png

Return to the administrative command prompt to accept the issued certificate by running the following command. Make sure you are using the correct drive letter for your removable media for E: as well as the correct RequestID for 2:

Note: Notice the .crt in the command line below, you must make sure it's typed correctly.

certreq -retrieve 2 E:\IssuingCA.windowsnoob.lab.local_windowsnoob-ISSUINGCA-CA.crt

When prompted which CA to use, select the windows noob Root CA and click OK. If everything went ok you'll see output like the below.

certificate retrieved (issued) Issued resubmitted by rootca administrator.png

If you now do a DIR on the PKI disk you'll see new files have been generated.

files received.png

Next, take the PKI disk offline in Disk Management on the StandAlone Offline Root CA

set offline.png

Finally, Remove the PKI disk from the StandAlone Offline Root CA virtual machine using the GUI settings or use the PowerShell commands shown earlier to do it.

remove PKI disk.png

Step 10. Install the windows noob Issuing CA Certificate on IssuingCA

Once again, add the PKI disk to the IssuingCA virtual machine, and take it Online in Disk Management.

Ensure you are logged on to IssuingCA as windowsnoob\EntAdmin. Next, open the Certification Authority console (CertSrv.msc) and in the Certification Authority console tree, right-click windows noob Issuing CA, and then click Install CA Certificate.

certsrv on issuingca.png

In the Select file to complete CA installation, navigate to your removable media (PKI disk). Ensure that you are displaying All Files (*.*) and click the IssuingCA.windowsnoob.lab.local_windowsnoob-ISSUINGCA-CA.rsp, (response file), click Open.

The CertSrv console will reload itself. Next, In the console tree, right-click windows noob  Issuing CA, click All Tasks, and then click Start Service.

start service.png

In the console tree, expand windows noob Issuing CA and then click Certificate Templates. Notice there are no certificates shown in the details pane. This is because the CAPolicy.inf specified not to install the default templates in the line LoadDefaultTemplates=0.

certificate templates blank.png

Next, take the PKI disk offline in Disk Management on the IssuingCA

set offline.png

and finally, Remove the PKI disk from the IssuingCA virtual machine using the GUI settings or use the PowerShell commands shown earlier to do it.

 

That's all for this Part, phew...

Please join me in Part 6 when you will perform post installation tasks on the Subordinate Issuing CA.

Recommended reading

(1) - https://gallery.technet.microsoft.com/scriptcenter/56b78004-40d0-41cf-b95e-6e795b2e8a06#content

(2) - http://msdn.microsoft.com/library/windows/desktop/ms677621.aspx

 

Share this post


Link to post
Share on other sites

Recommended Posts

  • 0

Hello again,

  I do have one more question that I was never really sure about when I followed your guide.

certutil -f -dspublish "E:\dc2k16EntCA_DC2K16ENTCAROOT.crt" RootCA     ( ROOTCA ; Were we supposed to change that to the server name : dc2k16entCA (if so should it be FQDN) or leave it as ROOTCA  

certutil -f -dspublish "E:\DC2K16ENTCAROOT.crl" RootCA     ( ROOTCA ; same here:  Were we supposed to change that to the server name : dc2k16entSUBCA (if so should it be FQDN) or leave it as ROOTCA

your input would be most appreciated!!!!

Share this post


Link to post
Share on other sites

  • 0
2 hours ago, BryanC said:

Please disregard my previous post.. BUT in chapter 8 you show the way to verify all is well .  I am having no issues with auto enrollment..

but when I do the certutil -url c:\windows.cer, the OCSP shows verified, when I do the retrieve certs from AIA and CDP .. I get no urls… I cant seem to find anything to correct this that isn't very confusing??

Also maybe I am doing something wrong when request a cert thru the web browser.. https://dc2k16entsubca/certsrv  and fill out the form.. I go thru the steps and finally it tells me to install cert.. I do..

but when I look at mmc w/cert I don't see the cert .. but it is in the Cert Auth on the issuing Server.. Am I doing something wrong, or should I be doing something else.. (this server is not in autoenrollment) ..

I did this 8 part series several times in separate labs to be 100% sure of the result and it always worked, so i know it works. You might have done something incorrectly or missed a step, as regards requesting a certificate via a webbrowser, i didn't cover this in my guide but if you try it you'll see the following text, i've bolded the interesting bit...

Quote

Use this Web site to request a certificate for your Web browser, e-mail client, or other program. By using a certificate, you can verify your identity to people you communicate with over the Web, sign and encrypt messages, and, depending upon the type of certificate you request, perform other security tasks.

does that explain things ?

Share this post


Link to post
Share on other sites

  • 0

I understand how to request the cert and why.. my question was after requesting it.. it was there in cert auth under issued certificates but it wasn't installed on the server I requested from.

I know I can install cert manually.. I was just wondering why it says it installed but it really didn't..

BY THE WAY>>>>

Can you tell me HOW TO CHANGE THE DELTACRL LOCATION #2

from http://dc2k16entsubca.egmc.org/CertEnroll/DC2K16ENTSUBCA-CA+.crl

to http://pki.egmc.org/certentroll/DC2K16ENTSUBCA-CA+.crl

like yours... I have been trying for hours to change...\

all my other issues I have worked out … this is the only one I just cant find or figure out.. I have gone back over your pub's and nothing...……...HELP

 

Share this post


Link to post
Share on other sites

  • 0

Thank you for the lab (up to part 6 its all working fine)

Just a short question: how can I add templates? My PaloAlto FW needs the Subordinate Certification Authority template for inspecting network traffic. It is only with "new - certificate template to issue"? (This sounds too easy ? )

 

And what is the reason for using the template = 0 in the CAPolicy.inf file?

Best from Singapore

Lutz

Edited by Lutz Rahe

Share this post


Link to post
Share on other sites

  • 0
Thank you for the lab (up to part 6 its all working fine) 

Great to hear it !

Just a short question: how can I add templates? My PaloAlto FW needs the Subordinate Certification Authority template for inspecting network traffic. It is only with "new - certificate template to issue"? (This sounds too easy ? ) 

in Certsrv.msc on the IssuingCA right click on Certificate Templates, and choose Manage, you can then select a known Certificate Template (for example Workstation Authentication) that matches what is required for your FW, check the documentation of the FW to see exactly what type of certificate it requires and duplicate it by chgoosing Duplicate Template

then rename it to your needs and adjust it to suit the FW requirements

and as for your other question, see this answer from Technet.

According to https://docs.microsoft.com/en-us/windows-server/networking/core-network-guide/cncg/server-certs/prepare-the-capolicy-inf-file the LoadDefaultTemplate flag only applies to an enterprise CA.

My assumption is that if you set up a standalone, the templates will be loaded nevertheless.

LoadDefaultTemplates only applies during the install of an Enterprise CA. This setting, either True or False (or 1 or 0), dictates if the CA is configured with any of the default templates.

  • Thanks 1

Share this post


Link to post
Share on other sites

  • 0

Thanks for your guidance, it is a very helpful!


I did all the steps on my test infrastructure, though I had a reduced set of virtual machines.
It seems to me that there is an error in section 5 (maybe my comment will help other people)


You suggest to execute the command:
certutil -f -dspublish "E: \ ROOTCA_windows noob Root CA.crt" RootCA
Where RootCA , as you write, is the host name of offline Root CA, however certutil helps us:

CertUtil [Options] -dsPublish CertFile [NTAuthCA | RootCA | SubCA | CrossCA | KRA | User | Machine]
...
    CertFile - certificate file to publish
    NTAuthCA - Publish cert to DS Enterprise store
    RootCA - Publish cert to DS Trusted Root store
    SubCA - Publish CA cert to DS CA object
    CrossCA - Publish cross cert to DS CA object
...

So RootCA in this case is not the host name here, but the store name.

Your host name matches the store name, and your command has been executed.
My Root CA name was different, and when I will have tried to execute the command
certutil -f -dspublish "C:\from_RCA\RCA01_My-CA.crt" RCA01
i got an error
CertUtil: -dsPublish command FAILED: 0x80070057 (WIN32: 87 ERROR_INVALID_PARAMETER)
CertUtil: The parameter is incorrect.

however command
certutil -f -dspublish "C:\from_RCA\RCA01_My-CA.crt" RootCA
performed correctly.

Next command in your manual
certutil -f -dspublish "E: \ windows noob Root CA.crl" RootCA
is correct, because to publish CRL you must specify the host name:

  CertUtil [Options] -dsPublish CRLFile [DSCDPContainer [DSCDPCN]]
  ....
    CRLFile - CRL file to publish
    DSCDPContainer - DS CDP container CN, usually the CA machine name

  • Like 1
  • Thanks 2

Share this post


Link to post
Share on other sites

  • 0

EDIT - I found the root cause. After adding the AIA and CDP paths to the RootCA, I had forgotten to restart the certsvc and then requested the SubCA certificates. These did not include the proper AIA and CDP paths because the RootCA simply didn't know them yet. PKIView reads the SubCA certificates issued by the RootCA to get the proper AIA and CDP paths for the RootCA, hence the wrong paths and a bad status. To remediate the issue, I renewed the SubCA certificates, which this time included the proper AIA and CDP paths as I had restarted the service in the meantime. I then revoked the old SubCA certificates and any certificate issued by the SubCAs, requested and issued new certificates and published and distributed the RootCA and SubCA CRLs. Now PKIView is showing all paths as ok and the overall status is good. All services are working as intended.

Hi Niall,

you mention that the RootCA part of the command "certutil -f -dspublish myRootCACert.crt RootCA" needs to be changed to the hostname of my offline RootCa. However, when I do this on Server 2019, I get the following error:

certutil -f -dspublish myRootCACert.crt RootCAHostName
CertUtil: -dsPublish command FAILED: 0x80070057 (WIN32: 87 ERROR_INVALID_PARAMETER)
CertUtil: The parameter is incorrect.

The command is successful if I leave it at "RootCA". However, despite having added the http AIA and CDP locations as described in your series, the pkiview for the root only shows a file path like "file:////RootCAHostName/CertEnroll/myRootCACert.crt" and "file:////RootCAHostName/CertEnroll/myRootCACRL.crl" and both show the status "unable to download". There is no http AIA and CDP entry for the root CA in pkiview. I've checked the root CA itself and the properties clearly show AIA and CDP http location entries and the correct boxes ticked as per your guide (see screenshots).

Running "certutil -f -dspublish myRootCACRL.crl RootCAHostName" works, but does not change anything in the pkiview for the root CA, even after restarting the service.

Certificate Services themselves are working fine, both issuing CAs, the OCSP (as an array) and the http crl locations work fine. Certificates issued by both CAs are valid and the certificate chain checks out as ok. SO everything seems fine, except for pkiview ?

Any idea what could have gone wrong and what I could further try to remediate?

Thanks,

Fred

PKIViewError001.png.40b97df5b9c8ac855f7ab84322f00ae8.png

PKIViewError002.png.6daf510dfa048427d451597c49b2fc2d.png PKIViewError003.png.a84c176ebdd983c138fe27a708c33c83.png

 

Edited by BaronVonSuff

Share this post


Link to post
Share on other sites

  • 0

Hi there, 

Firstly thanks for your turtorial.

Im in step 9 of Part 5. When i issue the req in RootCA svr , the request has failed:

Request status code: The Certificate has invalid Policy. 0x800b0113 (-2146762477 CERT-E-INVALID-POLICY)

Request disposition Message: Error constructing or Publish Certificate Invalid Issuance policies: 1.3.6.1.4.1.52765.1.2 Resubmitted by RootCA\Administrator

Could you help me to fix it please

Hopefully.
 

fail when issue SubCA.png

Edited by phuongtd91@gmail.com

Share this post


Link to post
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Answer this question...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

Loading...


×
×
  • Create New...

Important Information

We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.