The encrypted part of an e-mail message encrypted with Secure/Multipurpose Internet Mail Extensions (S/MIME) is always contained in a file called "smime.p7m" as an attachment to the mail.
Outlook does not display this attachment, but it can be analyzed using the free Microsoft MFCMAPI extracted from the e-mail.
Continue reading „Microsoft Outlook: Extrahieren einer verschlüsselten S/MIME Nachricht aus einer E-Mail“Assume the following scenario:
The requested certificate template is not supported by this CA. 0x80094800 (-2146875392 CERTSRV_E_UNSUPPORTED_CERT_TYPE).Continue reading „Die Beantragung eines Zertifikats schlägt fehl mit Fehlermeldung „The requested certificate template is not supported by this CA. 0x80094800 (-2146875392 CERTSRV_E_UNSUPPORTED_CERT_TYPE).““
Assume the following scenario:
Sorry, we're having trouble opening this item. This could be temporary, but if you see it again you might want to restart Outlook. Your digital ID name cannot be found by the underlying security system.Continue reading „Microsoft Outlook: Mit S/MIME verschlüsselte E-Mails können nicht geöffnet werden. Es erscheint die Fehlermeldung „Your digital ID name cannot be found by the underlying security system.““
Assume the following scenario:
The following is a description of the Enroll on Behalf Of function and how it differs from other methods of applying for certificates.
Continue reading „Grundlagen: Enroll on Behalf of (EOBO)“The operation is denied. It can only be performed by a certificate manager that is allowed to manage certificates for the current requester.Continue reading „Die Beantragung eines Zertifikats über Enroll on Behalf of (EOBO) schlägt fehl mit der Fehlermeldung „The operation is denied. It can only be performed by a certificate manager that is allowed to manage certificates for the current requester.““
A certification chain processed correctly, but one of the CA certificates is not trusted by the policy provider. 0x800b0112 (-2146762478 CERT_E_UNTRUSTEDCA)Continue reading „Die Beantragung eines Zertifikats über Enroll on Behalf of (EOBO) schlägt fehl mit der Fehlermeldung „A certification chain processed correctly, but one of the CA certificates is not trusted by the policy provider. 0x800b0112 (-2146762478 CERT_E_UNTRUSTEDCA)““
Since Windows 8 it is possible, that private keys for certificates are protected with a - if available - Trusted Platform Module (TPM). This makes the key non-exportable - even with tools like mimikatz.
However, it is not obvious at first glance that it cannot be guaranteed that a TPM is really used. Although no application via Microsoft Management Console or AutoEnrollment possible if the computer does not have a TPM.
However, the configuration in the certificate template is only a default setting for the client. The certification authority will, when requesting do not explicitly check whether a Trusted Platform Module was really used.
To ensure that the private key of a certificate request has really been protected with a Trusted Platform Module, only the TPM Key Attestation remains.
Continue reading „Konfigurieren der Trusted Platform Module (TPM) Key Attestation“There are cases in which you cannot or do not want to obtain web server certificates directly from a certification authority in your own Active Directory forest via the Microsoft Management Console, for example if the system in question is not a domain member.
In this case, the use of certificate templates is not possible, and one must manually create a Certificate Signing Request (CSR).
Continue reading „Manuelle Beantragung eines Webserver-Zertifikats“| Event Source: | Microsoft-Windows-CertificateServicesClient-CertEnroll |
| Event ID: | 4 (0x425A0004) |
| Event log: | Application |
| Event type: | Information |
| Event text (English): | Certificate enrollment for %1 could not access local resources or retrieve %2 certificate template information (%3). Enrollment was not performed. |
| Event text (German): | Certificate enrollment for %1 could not access local resources or retrieve certificate template information for %2 (%3). No registration is performed. |
| Event Source: | Microsoft-Windows-CertificateServicesClient-CertEnroll |
| Event ID: | 13 (0xC25A000D) |
| Event log: | Application |
| Event type: | Error |
| Event text (English): | Certificate enrollment for %1 failed to enroll for a %2 certificate with request ID %4 from %3 (%5). |
| Event text (German): | The certificate enrollment for %1 failed to enroll for a certificate %2 with request ID %4 of %3 (%5). |
| Event Source: | Microsoft-Windows-CertificateServicesClient-CertEnroll |
| Event ID: | 57 (0x825A0039) |
| Event log: | Application |
| Event type: | Information, Warning and Error |
| Event text (English): | The "%2" provider was not loaded because initialization failed. |
| Event text (German): | The "%2" provider was not loaded due to an initialization error. |
| Event Source: | Microsoft-Windows-CertificateServicesClient-CertEnroll |
| Event ID: | 82 (0x825A0052) |
| Event log: | Application |
| Event type: | Warning |
| Event text (English): | Certificate enrollment for %1 failed in authentication to all urls for enrollment server associated with policy id: %2 (%4). Failed to enroll for template: %3 |
| Event text (German): | Certificate registration error for %1 when authenticating for all URLs for the registration server associated with the following policy ID: %2 (%4). Error registering for template: %3 |
Assume the following scenario:
A certificate issued by the certification authority cannot be installed. Contact your administrator. Cannot find object or property. 0x80092004 (-2146885628 CRYPT_E_NOT_FOUND)Continue reading „Die Beantragung eines Zertifikats schlägt fehl mit Fehlermeldung „A certificate issued by the certification authority cannot be installed. Cannot find object or property. 0x80092004 (-2146885628 CRYPT_E_NOT_FOUND)““
Since Windows 8 it is possible, that private keys for certificates are protected with a - if available - Trusted Platform Module (TPM). This makes the key non-exportable - even with tools like mimikatz.
However, it is not obvious at first glance that it cannot be guaranteed that a TPM is really used. Although no application via Microsoft Management Console or AutoEnrollment possible if the computer does not have a TPM.
However, the configuration in the certificate template is merely a default setting for the client. The certification authority will not explicitly check whether a trusted platform module has actually been used when a request is made.
Thus - if the certificate request is done away from the MMC - arbitrary parameters can be used for the private key.
Continue reading „Beantragen eines durch ein Trusted Platform Modul (TPM) geschütztes Zertifikat – ohne ein TPM zu besitzen“
English 
Deutsch