Uwe Gradenegger - Passionate about PKI

Requesting Certificates with ML-DSA-Based Keys Through the Network Device Enrollment Service (NDES)

With the May 2026 security update, Microsoft has added support for the ML-DSA algorithm in Active Directory Certificate Services.

In her documentary They do say that NDES is not compatible with ML-DSA,:

You can enroll ML-DSA certificates using the Certificates Microsoft Management Console (MMC) snap-in and certreq.exe. Enrollment through the Network Device Enrollment Service (NDES) is not currently available.

But that's not entirely true…

Configuring an SSL certificate binding for Microsoft Internet Information Server (IIS) fails with an error message when using ML-DSA-based keys

Assume the following scenario:

A web server certificate was generated using an ML-DSA-based key pair.
We would like to integrate this with Internet Information Services (IIS).
The configuration fails with the following error message:

There was an error while performing this operation.

Details: 

A specified logon session does not exist. It may already have been terminated. (Exception from HRESULT: 0x80070520)

Requests for certificates using ML-DSA-based keys fail with the error message „The parameter is incorrect. 0x80070057 (WIN32: 87 ERROR_INVALID_PARAMETER)“

Assume the following scenario:

People are trying to apply for certificates using the ML-DSA algorithm.
The request fails with the following error message:

The parameter is incorrect. 0x80070057 (WIN32: 87 ERROR_INVALID_PARAMETER)

Cryptographic Hardening of SCEP Transactions for the Network Device Enrollment Service (NDES)

The Simple Certificate Enrollment Protocol (SCEP) is an ancient protocol from the early 2000s. It does not use Transport Layer Security (TLS). Therefore, the protocol messages are encrypted at the transport layer.

When sending the certificate request to the NDES server, the client will sign the certificate request with the NDES server's CEP encryption certificate (which was previously communicated to it via the GetCACert message).

Upon receiving the issued certificate, the NDES server will encrypt the response using a self-signed certificate temporarily generated by the SCEP client.

In both cases, a symmetric encryption algorithm is used.

Automatic Publication of Certificate Revocation Lists Following a Certificate Revocation

I often hear that PKI operators would like to see a new certificate revocation list issued immediately for revoked certificates.

Below, I would like to share some thoughts on why this approach is not ideal and propose a more elegant solution.

What is the difference between „requesting“ and „renewing“ a certificate in the Windows ecosystem?

If you want to request or renew certificates on a Windows client using the Microsoft Management Console (MMC), you have several options—all of which achieve the same result but behave differently. Below, we’ll discuss the differences.

Attack on the Active Directory via Microsoft Intune - and how it can be contained with TameMyCerts

Dirk-jan Mollema recently presented an attack that can be used to obtain a certificate for highly privileged accounts via Intune. This can then be used to compromise the entire Active Directory environment.

The attack is similar in its basic features to what I have already described in the article "From Zero to Enterprise Administrator through Network Device Enrollment Service (NDES) - and What to Do About It" and in the article "Attack vector on Active Directory directory service via smartcard logon mechanism" (generally also known as ESC1).

What is new, however, is to utilize the Mobile Device Management (MDM) system - in this case Microsoft Intune - accordingly.

What is not new, however, is what can be done with the TameMyCerts Policy Module for Active Directory Certificate Services to drastically reduce the attack surface...

Automatically add the Security Identifier (SID) certificate extension to certificates requested via Mobile Device Management (MDM) - with the TameMyCerts Policy Module for Microsoft Active Directory Certificate Services (ADCS)

After several postponements, Microsoft finally decided that the Changes to Certificate Issuance and Certificate-Based Logon to Active Directory with the May 10, 2022 Patch for Windows Server (KB5014754) should now finally come into force.

Domain controllers will therefore automatically switch to full enforcement mode on February 25, 2025, unless configured otherwise. As of September 2025, it has been announced that deviating settings will no longer apply and there will therefore no longer be an alternative to full enforcement.

The consequence of this is that logins via PKInit can only be used for a login if they have the new Security Identifier (SID) certificate extension introduced with the patch.

What at first sounds as if this is not a major problem may well become one when you consider that fewer and fewer certificate-based use cases are using classic autoenrollment these days.

How the TameMyCerts Policy Module for the Active Directory Certificate Services can help with this problem is explained in more detail in the following article.

Extending or shortening the validity period of root certification authority certificates

With existing public key infrastructures, you may find that the validity of the root certification authority certificate has not proven itself. For example, it could be that it was chosen too short (the default setting of the Microsoft ADCS is only five years), or even too long, which may not be optimal from a security perspective.

If you renew the certification authority certificate, you may want to achieve a different validity period.

Prevent unprivileged accounts from reading the configuration of the certification authority

During penetration tests and also for attackers searching the network for potential targets, insights into the configuration of the certification authority are highly interesting.

In addition to possible misconfigurations, attackers can obtain information about the policy module used on the certification authority.

YubiKey Personal Identity Verification (PIV) Attestation - with the TameMyCerts Policy Module for Microsoft Active Directory Certificate Services (ADCS)

Since the recently released version 1.7, the TameMyCerts Policy Module for Microsoft Active Directory Certificate Services Personal Identity Verification (PIV) attestation for YubiKeys.

A YubiKey is a compact security token that can be used like a smartcard for the secure storage and use of certificates and can therefore also be used for passwordless logon to Active Directory environments.

This cool function was developed by Oscar Virot and integrated into TameMyCerts. This makes it possible to provide cryptographic proof when issuing certificates and thus ensure that a key pair is actually generated with a YubiKey and secured by it and cannot be exported.

This can be particularly helpful in complying with the NIS2 directive if companies decide to use certificates as a second factor for logging in with security-critical accounts in the Active Directory.

Revocation lists are not recognized as valid (only) on Windows (CRYPT_E_REVOCATION_OFFLINE)

Someone recently approached me with an interesting problem.

A certification authority has been installed. Linux is used as the basis, i.e. (presumably) OpenSSL. The revocation lists work on Linux clients, but are not accepted by Windows systems. The following error message always appears when checking the revocation lists.

0x80092013 (-2146885613 CRYPT_E_REVOCATION_OFFLINE) -- 2148081683 (-2146885613)
Text der Fehlermeldung: Die Sperrfunktion konnte die Sperrung nicht überprüfen, da der Sperrserver offline war.

The error message reads as follows:

0x80092013 (-2146885613 CRYPT_E_REVOCATION_OFFLINE) -- 2148081683 (-2146885613)
The revocation function was unable to check revocation because the revocation server was offline.

Smartcard login fails with error message "A certification chain processed correctly, but one of the CA certificates is not trusted by the policy provider. 0x800b0112 (-2146762478 CERT_E_UNTRUSTEDCA)"

Assume the following scenario:

The company would like to use smartcard logon.
The domain controllers are with certificates that can be used for smartcard logon equipped.
The users are equipped with certificates that can be used for smartcard logon.
The login to the domain via smartcard fails with the following error message:

A certification chain processed correctly, but one of the CA certificates is not trusted by the policy provider. 0x800b0112 (-2146762478 CERT_E_UNTRUSTEDCA)

How many Subject Alternative Names (SAN) do the Active Directory Certificate Services support?

Like any software Microsoft Active Directory Certificate Services are also subject to certain limitsimposed by their design.

What is not so obvious is the question of how many Subject Alternative Name (SAN) can be issued with the Microsoft certification authority.

The IETF RFC 5280 describes the structure for Subject Alternative Names as follows:

SubjectAltName ::= GeneralNames

How securing printers can turn into a security disaster - and how the TameMyCerts Policy Module for Active Directory Certificate Services (ADCS) can prevent it

Nowadays, it is essential to protect the authentication of devices on the company network and administrative interfaces. As a rule, digital certificates are used for this purpose.

Printers therefore also generally require digital certificates in order to be operated securely. From a certain number of devices, there is no getting around automatic certificate distribution.

Some printer manufacturers offer centralized management solutions for certificate distribution.

Unfortunately, it has been shown time and again that the secure handling of digital certificates requires a great deal of knowledge, experience and care, which is often not the case.