Assume the following scenario:
Assume the following scenario:
Install-AdcsCertificationAuthority : Active Directory Certificate Services setup failed with the following error: A value for the attribute was not in the acceptable range of values. 0x80072082 (WIN32: 8322 ERROR_DS_RANGE_CONSTRAINT)Continue reading „Die Installation einer ins Active Directory integrierten Zertifizierungsstelle mittels Windows PowerShell schlägt fehl mit Fehlermeldung „A value for the attribute was not in the acceptable range of values. 0x80072082 (WIN32: 8322 ERROR_DS_RANGE_CONSTRAINT)““
The following is an overview of the events generated on domain controllers in the Windows Event Viewer that are relevant to the public key infrastructure.
Continue reading „Übersicht über die für die PKI relevanten Active Directory Ereignisse“By default, Windows systems, even if an online responder (OCSP) is configured, will be sent to a certain number of OCSP requests fall back to a (if available) brevocation list, because this is usually more efficient in such a case. However, this behavior is not always desired.
For example, if one uses smart card logins, one might want to know if Logins were executed with unauthorized issued certificates. In conjunction with the deterministic good of the online responder you can thus create an (almost) seamless Audit trail create for all smartcard logins.
Continue reading „Domänencontroller (oder andere Teilnehmer) zwingen, einen Onlineresponder (OCSP) zu verwenden“Even if an online responder is present in the network and the certification authorities have entered its address in the Authority Information Access (AIA) extension of the issued certificates, it is not always guaranteed that the online responder is actually used.
One variable here is the "Magic Number", which is present on every Windows operating system. It causes the system to fall back to blacklists (if present) if requests are made too often via OCSP for the same certificate authority.
Continue reading „Die „Magic Number“ für den Onlineresponder konfigurieren“The following is an overview of the audit events generated by the online responder in the Windows Event Viewer.
In contrast to operational events, which are often understood under the term "monitoring", auditing for the certification authority is the configuration of logging of security-relevant events.
Continue reading „Übersicht über die vom Onlineresponder (OCSP) generierten Audit-Ereignisse“In the default configuration, the online responder returns the status "Good" for requested certificates that do not appear on one of the configured revocation lists.
This can be problematic because the online responder has no knowledge of certificates issued by the certification authorities. If an attacker succeeds in issuing a certificate using the private key of the certification authority without their knowledge, this would not be detected by the online responder, and would also be reported in the Audit log show up as "Good".
Continue reading „Deterministisches „Good“ für den Onlineresponder (OCSP) konfigurieren“Assume the following scenario:
The device that is required by this cryptographic provider is not ready for use. 0x80090030 (-2146893776 NTE_DEVICE_NOT_READY)Continue reading „Der Zertifizierungsstellen-Dienst startet nicht und wirft die Fehlermeldung „The device that is required by this cryptographic provider is not ready for use. 0x80090030 (-2146893776 NTE_DEVICE_NOT_READY)““
| Event Source: | Microsoft Windows Security Auditing |
| Event ID: | 5127 (0x1407) |
| Event log: | Security |
| Event type: | Information |
| Event text (English): | The OCSP Revocation Provider successfully updated the revocation information. CA Configuration ID: %1 Base CRL Number: %2 Base CRL This Update: %3 Base CRL Hash: %4 Delta CRL Number: %5 Delta CRL Indicator: %6 Delta CRL This Update: %7 Delta CRL Hash: %8 |
| Event text (German): | The OCSP response service has successfully updated the revocation information. Certification authority configuration ID: %1 Base revocation list number: %2 Base revocation list, this update: %3 Base revocation list hash: %4 Delta revocation list number: %5 Delta revocation list display: %6 Delta revocation list, this update: %7 Delta revocation list hash: %8 |
| Event Source: | Microsoft Windows Security Auditing |
| Event ID: | 5126 (0x1406) |
| Event log: | Security |
| Event type: | Information |
| Event text (English): | Signing Certificate was automatically updated by the OCSP Responder Service. CA Configuration ID: %1 New Signing Certificate Hash: %2 |
| Event text (German): | The signing certificate was automatically updated by the OCSP response service. Certification authority configuration ID: %1 New signature certificate hash: %2 |
| Event Source: | Microsoft Windows Security Auditing |
| Event ID: | 5125 (0x1405) |
| Event log: | Security |
| Event type: | Information |
| Event text (English): | A request was submitted to OCSP Responder Service. |
| Event text (German): | A request is transmitted to the OCSP response service. |
| Event Source: | Microsoft Windows Security Auditing |
| Event ID: | 5124 (0x1404) |
| Event log: | Security |
| Event type: | Information |
| Event text (English): | A security setting was updated on OCSP Responder Service. New Value: %1 |
| Event text (German): | A security setting has been updated for the OCSP response service. New value: %1 |
| Event Source: | Microsoft Windows Security Auditing |
| Event ID: | 5123 (0x1403) |
| Event log: | Security |
| Event type: | Information |
| Event text (English): | A configuration entry changed in the OCSP Responder Service. Property Name: %1 New Value: %2 |
| Event text (German): | A configuration entry was changed in the OCSP response service. Property name: %1 New value: %2 |
| Event Source: | Microsoft Windows Security Auditing |
| Event ID: | 5122 (0x1402) |
| Event log: | Security |
| Event type: | Information |
| Event text (English): | A Configuration entry changed in the OCSP Responder Service. CA Configuration ID: %1 New Value: %2 |
| Event text (German): | A configuration entry was changed in the OCSP response service. Certification authority configuration ID: %1 New value: %2 |
| Event Source: | Microsoft Windows Security Auditing |
| Event ID: | 5121 (0x1401) |
| Event log: | Security |
| Event type: | Information |
| Event text (English): | OCSP Responder Service Stopped. |
| Event text (German): | The OCSP response service has been terminated. |
English 
Deutsch