Uwe Gradenegger - Page 5 - Uwe Gradenegger

Reconnecting to the private key fails with error message "Cannot find object or property. 0x80092004 (-2146885628 CRYPT_E_NOT_FOUND)"

Assume the following scenario:

A Certification Authority will migrated to another server or restored from backup.
A hardware security module (HSM) is used to protect the private key of the certification authority certificate.
The certification authority certificate should now be installed on the target system. be restored and linked to the private key.
The operation fails with the following error message:

Cannot find the certificate and private key for decryption.
CertUtil: -repairstore command FAILED: 0x80092004 (-2146885628 CRYPT_E_NOT_FOUND)
CertUtil: Cannot find object or property.

Installation of the default certificate templates fails with error message "This security ID may not be assigned as the owner of this object."

Assume the following scenario:

For the first time, a certification authority (Enterprise Certification Authority) integrated into Active Directory is to be installed in the network.
The rights to install the certificate authority have been delegated to a separate security group or account for security reasons, so no Enterprise Administrator login is required. Put another way: The user used is not a member of the Enterprise Administrators group in the Active Directory forest.
Since this is the first certification authority in the network, no Standard certificate templates installed in the Active Directory. When opening the certificate template management console (certtmpl.msc), one is prompted to install it.
The installation fails with the following error message:

Windows could not install the new certificate templates. This security ID may not be assigned as the owner of this object.

Code signatures of Appx packages via SignTool.exe fail with error code 0x8007000b (ERROR_BAD_FORMAT)

Assume the following scenario:

An Appx package is to be signed.
For this purpose the SignTool.exe used.
The code signing certificate used was recently renewed.
The signing process with the new code signing certificate fails with the following error message:

"Error: SignerSign() failed." (-2147024885/0x8007000b)

Issue certificates with shortened validity period

Sometimes it is necessary to issue certificates with a shorter validity period than configured in the certificate template. Therefore, you may not want to reconfigure the certificate template right away or create another certificate template.

Root certificates are imported on domain members into the certificate store for intermediate certificate authorities

Some will have noticed that the certificate store for intermediate CAs usually also contains certificates for root CAs.

As a rule, this behavior is not critical. In certain cases however, this can also cause problems with applications.

Basics: The Key Usage Certificate Extension

Certificate extensions were introduced with version 3 of the X.509 standard. The Key Usage extension is an optional certificate extension that can be used in the RFC 5280 is defined and is used to limit the allowed uses for a key.

Establish a mapping from a user certificate to the associated computer

Assume the following scenario:

A user's computer is stolen or infected with malware.
The integrity of certificates located on the computer can no longer be guaranteed.
The certificates of the user(s) that were requested on this computer must be revoked.
However, one would like to avoid revoking all certificates of a user.
Thus, a connection must be established between the user's certificates and the computer on which they were requested.

If the certificates were issued by Autoenrollment requested, we can take advantage of the fact that a corresponding attribute was part of the original certificate request, and that the certificate request is stored in the certificate authority database along with the certificate.

No remote desktop logon possible from outside the Active Directory forest

Assume the following scenario:

You want to establish a remote desktop connection.
The client computer from which the connection is made is not a member of the same Active Directory forest as the target computer.
The connection fails with the following error message:

A user account restriction (for example, a time-of-day restriction) is preventing you from logging on. For assistance, contact your system administrator or technical support.

Login to the Network Device Enrollment Service (NDES) administration web page fails with HTTP error code 401 "Unauthorized: Access is denied due to invalid credentials."

Assume the following scenario:

An NDES server is configured on the network.
When calling the NDES administration web page (certsrv/mscep_admin) is not possible.
After several unsuccessful login attempts, the following HTTP error message is returned:

401 - Unauthorized: Access is denied due to invalid credentials.
You do not have permission to view this directory or page using the credentials that you supplied.

Electronic data exchange with the German Pension Insurance

Recently, together with the B-I-T GmbH Information and processes from Hanover worked on implementing the electronic data exchange with the statutory health insurance funds and the pension insurance from one application.

Here, a combination of authenticated data transmission of both signed and encrypted messages is used. PKI technologies are used in all these cases.

The message format used is here documented.

Restoring certificates from the SMTP Exit Module data

If you restore a certification authority from a backup after a disaster has occurred, you will probably find that certificates were issued in the period between the last backup and the system failure with corresponding data loss.

These certificates are now not stored in the restored certificate authority database, so they cannot be restored if needed.

If you are using the SMTP Exit Module, you can at least determine the serial numbers of the certificates from the sent e-mails and revoke them.

Overview of Remote Desktop Session Host Events Relevant for PKI

The following is an overview of the events in the Windows Event Viewer generated by the Remote Desktop session host that are relevant to the public key infrastructure.

Details of the event with ID 1073 of the source Microsoft-Windows-TerminalServices-RemoteConnectionManager

Event Source:	Microsoft-Windows-TerminalServices-RemoteConnectionManager
Event ID:	1073 (0xC0000431)
Event log:	System
Event type:
Event text (English):	The msPKI-Cert-Template-OID column for the template-based certificate %1 returned an unknown data type %2.
Event text (German):	The msPKI-Cert-Template-OID column for template-based certificate %1 returned unknown data type %2.

Details of the event with ID 1072 of the source Microsoft-Windows-TerminalServices-RemoteConnectionManager

Event Source:	Microsoft-Windows-TerminalServices-RemoteConnectionManager
Event ID:	1072 (0xC0000430)
Event log:	System
Event type:
Event text (English):	The cn column for the template-based certificate %1 returned an unknown data type %2.
Event text (German):	The column "cn" for the template-based certificate %1 has returned the unknown data type %2.

Details of the event with ID 1065 of the source Microsoft-Windows-TerminalServices-RemoteConnectionManager

Event Source:	Microsoft-Windows-TerminalServices-RemoteConnectionManager
Event ID:	1065 (0xC0000429)
Event log:	System
Event type:	Error
Event text (English):	The template-based certificate that is being used by the RD Session Host server for Transport Layer Security (TLS) 1.0\Secure Sockets Layer (SSL) authentication and encryption has expired and cannot be replaced by the RD Session Host server. The following error occurred: %1.
Event text (German):	The template-based certificate used by the Remote Desktop session host server for authentication and encryption using Transport Layer Security (TLS) 1.0\Secure Sockets Layer (SSL) has expired and cannot be replaced by the Remote Desktop session host server. Error: %1.