Category: Certification Authority Web Enrollment (CAWE)

List of certificate use cases for which compatibility with elliptic curve (ECC)-based keys is known

As computing power becomes increasingly available, the need to use stronger cryptographic keys also increases. In this course, there is often a need (for example, because the keys have to be protected by a Trusted Platform Module) to use keys based on elliptic curves (ECC) . For their use, it is essential that compatibility with the intended use cases is ensured.

Below is a list of use cases for which I know the compatibility.

Continue reading "List of certificate use cases for which compatibility with elliptic curve (ECC)-based keys is known"

Limits of Microsoft Active Directory Certificate Services

Active Directory Certificate Services have existed (albeit under a different name) in their basic form since Windows NT 4.0. The Active Directory-based architecture used today was introduced with Windows 2000 Server. AD CS is very well integrated into the Windows ecosystem and continues to enjoy great popularity worldwide in companies and government agencies of all sizes.

People like to point out the many possibilities offered by Active Directory Certificate Services. Rarely, however, is it pointed out what is not possible with them. In fact, the product has by now reached its limits in many places.

What these are will be explained in more detail below in order to better decide whether AD CS can be the right solution for planned projects.

Continue reading "Limits of Microsoft Active Directory Certificate Services"

Installation or uninstallation of a Windows feature fails with error message "The service is configured to not accept any remote shell requests."

Assume the following scenario:

  • A Windows role related to Active Directory Certificate Services (Certification Authority, Network Device Enrollment Service (NDES), Certification Authority Web Enrollment (CAWE), Certificate Enrollment Web Services (CEP, CES), or Online Responder (OCSP)) is to be installed or uninstalled.
  • The installation or uninstallation fails with the following error message:
The status of the role services on the target machine cannot be determined. Please retry. The error is The WS-Management service cannot process the request. The service is configured to not accept any remote shell requests.

Continue reading "Installation or uninstallation of a Windows feature fails with error message "The service is configured to not accept any remote shell requests.""

Classification of AD CS components in the Administrative Tiering Model

If, in addition to Active Directory Certificate Services, the administrative tiering model is also implemented for the Active Directory directory service, the question arises as to how the individual PKI components are to be assigned to this model in order to be able to perform targeted security hardening.

Continue reading "Classification of AD CS components in the Administrative Tiering Model"

Requesting a certificate via Certification Authority Web Enrollment (CAWE) fails with HTTP error code 401 "Unauthorized: Access is denied due to invalid credentials."

Assume the following scenario:

  • A Certification Authority Web Enrollment (CAWE) server is installed on the network.
  • The role is installed on a separate server, not on the certification authority directly.
  • A user attempts to request a certificate via Certification Authority Web Enrollment or submit an existing certificate request to the certification authority.
  • The user's logon to CAWE fails with HTTP code 401 "Unauthorized: Access is denied due to invalid credentials.":
You do not have permission to view this directory or page using the credentials that you supplied.

Continue reading "Requesting a certificate via Certification Authority Web Enrollment (CAWE) fails with HTTP error code 401 "Unauthorized: Access is denied due to invalid credentials.""

Requesting a certificate via Certification Authority Web Enrollment (CAWE) fails with HTTP error code 403 "Forbidden: Access is denied."

Assume the following scenario:

  • A Certification Authority Web Enrollment (CAWE) server is installed on the network.
  • The role is installed on a separate server, not on the certification authority directly.
  • A user attempts to request a certificate via Certification Authority Web Enrollment or submit an existing certificate request to the certification authority.
  • The user's logon to CAWE fails with HTTP code 403 "Forbidden: Access is denied.":
You do not have permission to view this directory or page using the credentials that you supplied.

Continue reading "Requesting a certificate via Certification Authority Web Enrollment (CAWE) fails with HTTP error code 403 "Forbidden: Access is denied.""

Requesting a certificate via Certification Authority Web Enrollment (CAWE) fails with error message "No certificate templates could be found.", or the desired certificate template is not displayed

Assume the following scenario:

  • A Certification Authority Web Enrollment (CAWE) server is installed on the network.
  • The role is installed on a separate server, not on the certification authority directly.
  • A user attempts to submit an existing certificate request to the certification authority via Certification Authority Web Enrollment.
  • The desired certificate template is missing from the list of selectable certificate templates, or the list is completely empty.
  • If the list is empty, the following error message is also issued:
No certificate templates could be found. You do not have permission to request a certificate from this CA, or an error occurred while accessing the Active Directory.

Continue reading "Requesting a certificate via Certification Authority Web Enrollment (CAWE) fails with error message "No certificate templates could be found.", or the desired certificate template is not displayed"

Performing a functional test for Certification Authority Web Enrollment (CAWE)

After installing and configuring Certification Authority Web Enrollment (CAWE), it is essential to test the component extensively before releasing it to users. Below are instructions for a detailed functional test.

Continue reading "Performing a functional test for Certification Authority Web Enrollment (CAWE)"

Requesting a certificate via Certification Authority Web Enrollment (CAWE) fails with HTTP error code 500 "Internal Server error"

Assume the following scenario:

  • A Certification Authority Web Enrollment (CAWE) server is installed on the network.
  • The role is installed on a separate server, not on the certification authority directly.
  • A user attempts to request a certificate via Certification Authority Web Enrollment or submit an existing certificate request to the certification authority.
  • The request takes a very long time and finally fails with HTTP code 500 "Internal server error":
There is a problem with the resource you are looking for, and it cannot be displayed.

Continue reading "Requesting a certificate via Certification Authority Web Enrollment (CAWE) fails with HTTP error code 500 "Internal Server error""

Requesting a certificate via Certification Authority Web Enrollment (CAWE) fails with error code "ERROR_ACCESS_DENIED"

Assume the following scenario:

  • A Certification Authority Web Enrollment (CAWE) server is installed on the network.
  • The role is installed on a separate server, not on the certification authority directly.
  • A user attempts to request a certificate via Certification Authority Web Enrollment or submit an existing certificate request to the certification authority.
  • The request fails with the following error message:
Your request failed. An error occurred while the server was processing your request. Contact your administrator for further assistance.

In the details of the error message you will find the following note:

CCertRequest::Submit: Access is denied. 0x80070005 (WIN32: 5 ERROR_ACCESS_DENIED)

Continue reading "Requesting a certificate via Certification Authority Web Enrollment (CAWE) fails with error code "ERROR_ACCESS_DENIED""

Configure Certification Authority Web Enrollment (CAWE) for use with a Group Managed Service Account (gMSA)

For security reasons, it may make sense to operate the CAWE with a Group Managed Service Account (gMSA) instead of a normal domain account. This option offers the charming advantage that the password of the account is changed automatically, and thus this step does not have to be done manually, which is unfortunately forgotten far too often.

Continue reading "Configure Certification Authority Web Enrollment (CAWE) for use with a Group Managed Service Account (gMSA)"

Windows security permissions required for Certification Authority Web Enrollment (CAWE)

Assuming one implements Microsoft's Active Directory Administrative Tiering Model, or applies similar hardening measures to one's servers, this will impact Certification Authority Web Enrollment (CAWE).

Continue reading "Windows security permissions required for Certification Authority Web Enrollment (CAWE)"

Enabling Secure Sockets Layer (SSL) for Certification Authority Web Enrollment (CAWE)

In the default configuration, Certification Authority Web Enrollment (CAWE) accepts only unencrypted connections via HTTP. It is recommended that the CAWE be configured for HTTP over TLS (HTTPS) to make capturing the network traffic more difficult. Instructions are provided below.

Continue reading "Enabling Secure Sockets Layer (SSL) for Certification Authority Web Enrollment (CAWE)"