Uwe Gradenegger - Page 14 - Uwe Gradenegger

Microsoft Outlook: "This message cannot be encrypted or signed by Microsoft Outlook because there are no certificates for sending messages from the email address [...]."

Assume the following scenario:

A user wants to send a signed e-mail
The operation fails with the following error message:

Diese Nachricht kann von Microsoft Outlook weder verschlüsselt noch signiert werden, da keine Zertifikate für das Senden von Nachrichten von der E-Mail Adresse "rudi.ratlos@adcslabor.de" vorhanden sind. Fordern Sie entweder eine neue digitale ID für dieses Konto an, oder verwenden Sie die Schaltfläche "Konten", um die Nachricht mithilfe eines Kontos zu senden, für das Sie Zertifikate besitzen.

The Certificate Authority service fails to start and throws the error message "Provider DLL failed to initialize correctly. 0x8009001d (-2146893795 NTE_PROVIDER_DLL_FAIL)."

Assume the following scenario:

A certification authority is implemented in the network.
The certification authority service does not start.
When trying to start the Certification Authority service, you get the following error message:

Provider DLL failed to initialize correctly. 0x8009001d (-2146893795 NTE_PROVIDER_DLL_FAIL).

The "Application Policies" certificate extension

The purposes for which a digital certificate may be used are controlled via the certificate extensions "Key Usage" and "Extended Key Usage".

In the "Extended Key Usage" certificate extension, the extended key uses for which the certificate may be used.

However, there is another certificate extension called "Application Policies" for certificates issued by a Microsoft Certification Authority, which also contains a list very similar to the Extended Key Usages extension.

New certificates are regularly requested via Autoenrollment

Assume the following scenario:

A certificate template is configured for automatic request and issuance (AutoEnrollment).
Users or computers apply for new certificates at regular intervals and long before the defined renewal period.

The key algorithm of certificate requests is not checked by the certification authority's policy module

Assume the following scenario:

A certificate template is configured to use elliptic curve based keys (e.g. ECDSA_P256).
As a result, a minimum key length of 256 bits is configured.
Nevertheless, certificate requests that use other ECC curves or RSA-based keys are also signed.

SignTool installation without Windows Software Development Kit (SDK) installation

One way to perform code signatures is to use the SignTool command line tool. This is part of the Windows 10 Software Development Kit (SDK).

If you want to use the tool on a system without having to install Visual Studio or the Windows SDK, you can proceed as follows.

Code signature for PowerShell script files

Below is a description of the options available for executing PowerShell script files, and what is possible by signing them.

Certificate request fails with error message "The request is not supported. 0x80070032 (WIN32: 50 ERROR_NOT_SUPPORTED)".

Assume the following scenario:

A certificate is requested from an Active Directory integrated certification authority (Enterprise Certification Authority).
The request fails with the following error message:

An error occurred while enrolling for a certificate.
The certificate request could not be submitted to the certification authority.
Url: CA02.intra.adcslabor.de\ADCS Labor Issuing CA 1
Error: The request is not supported. 0x80070032 (WIN32: 50 ERROR_NOT_SUPPORTED)

The role configuration for the Certificate Enrollment Web Service (CES) fails with error message "Access is denied. 0x80070005 (WIN32: 5 ERROR_ACCESS_DENIED)".

Assume the following scenario:

A role configuration for the Certificate Enrollment Web Service (CES) is performed.
The role configuration fails with the following error message:

CCertificateEnrollmenServerSetup::InitializeInstallDefaults: Access is denied. 0x80070005 (WIN32: 5 ERROR_ACCESS_DENIED)

The role configuration for the Certificate Enrollment Web Service (CES) fails with error message "The RPC server is unavailable. 0x800706ba (WIN32: 1722 RPC_S_SERVER_UNAVAILABLE".

Assume the following scenario:

A role configuration for the Certificate Enrollment Web Service (CES) is performed.
The role configuration fails with the following error message:

The Certificate Enrollment Web Service Setup failed because the CA "CA02.intra.adcslabor.de\ADCS Labor Issuing CA 1" cannot  be contacted. Check the name, and confirm that the CA is properly configured and available. The RPC server is unavailable. 0x800706ba (WIN32: 1722 RPC_S_SERVER_UNAVAILABLE)

Automatic renewal of manually requested certificates without intervention of a certificate manager

Assuming a use case is implemented for certificates where users specify the identity contained in the certificate in the certificate request, and this requires manual intervention by the certificate managers, the question arises as to how to proceed when the certificates expire or the certificate template is moved to another certification authority in order to minimize tickets at the help desk and thus the resulting work for the certificate managers.

Microsoft Outlook: Emails encrypted with S/MIME cannot be opened. The error message "Internal error." appears.

Assume the following scenario:

A user receives an e-mail message encrypted with Secure/Multipurpose Internet Mail Extensions (S/MIME).
The message cannot be opened.
When opening the message, the following error message is displayed:

Leider besteht ein Problem beim Öffnen dieses Elements. Dies kann vorübergehend sein. Wenn dieser Fehler erneut auftritt, sollten Sie Outlook neu starten. Fehler im zugrunde liegenden Sicherheitssystem. Interner Fehler.

S/MIME with the Outlook app for Apple IOS and Android only possible with devices managed via Intune

If you want to make S/MIME certificates available to your users on the smartphone as well, you may be surprised to discover that this is not possible with the Outlook app unless you also use Microsoft Intune as a management solution for the devices.

Microsoft has published in an article "Sensitivity labeling and protection in Outlook for iOS and Android" now clarified that this is due to the respective system architecture.

From Zero to Enterprise Administrator through Network Device Enrollment Service (NDES) - and What to Do About It

In the following, I would like to present a highly dangerous PKI configuration, perhaps not necessarily known to the general public, which can probably be encountered quite frequently in this way in corporate networks.

I show how, by exploiting various unfortunate circumstances in the Windows PKI, it is possible to elevate privileges from mere network access to complete Active Directory takeover.

The initial point of attack in this example is the Network Device Enrollment Service (NDES).

What does the "Enable Certificate Privacy" option mean when exporting certificates?

With Windows Server 2016 and Windows 10, a new "Enable Certificate Privacy" option has been implemented for exporting private key certificates via the Microsoft Management Console (MMC).

When exporting private key certificates, the certificate is exported to a PKCS#12 (.PFX) file.