I often hear that PKI operators would like to see a new certificate revocation list issued immediately for revoked certificates.
Below, I would like to share some thoughts on why this approach is not ideal and propose a more elegant solution.
If you want to request or renew certificates on a Windows client using the Microsoft Management Console (MMC), you have several options—all of which achieve the same result but behave differently. Below, we’ll discuss the differences.
Dirk-jan Mollema recently presented an attack that can be used to obtain a certificate for highly privileged accounts via Intune . This can then be used to compromise the entire Active Directory environment.
The attack is similar in its basic features to what I have already described in the article "From Zero to Enterprise Administrator through Network Device Enrollment Service (NDES) - and What to Do About It " and in the article "Attack vector on Active Directory directory service via smart card logon mechanism " (generally also known as ESC1 ).
What is new, however, is to utilize the Mobile Device Management (MDM) system - in this case Microsoft Intune - accordingly.
What is not new, however, is what can be done with the TameMyCerts Policy Module for Active Directory Certificate Services to drastically reduce the attack surface...
With existing public key infrastructures, you may find that the validity period of the root certification authority certificate has not proven itself. For example, it could be that it was chosen too short (the default setting of Microsoft AD CS is only five years), or even too long, which may not be optimal from a security perspective.
If you renew the certification authority certificate, you may want to achieve a different validity period.
During penetration tests and also for attackers searching the network for potential targets, insights into the configuration of the certification authority are highly interesting.
In addition to possible misconfigurations, attackers can obtain information about the policy module used on the certification authority.
Since the recently released version 1.7, the TameMyCerts Policy Module for Microsoft Active Directory Certificate Services supports Personal Identity Verification (PIV) attestation for YubiKeys.
A YubiKey is a compact security token that can be used, among other things, like a smart card for the secure storage and use of certificates and can therefore also be used for passwordless logon to Active Directory environments.
This cool function was developed by Oscar Virot and integrated into TameMyCerts. This makes it possible to provide cryptographic proof when issuing certificates and thus ensure that a key pair is actually generated with a YubiKey and secured by it and cannot be exported.
This can be particularly helpful in complying with the NIS2 directive if companies decide to use certificates as a second factor for logon with security-critical accounts in Active Directory.
Someone recently approached me with an interesting problem.
A certification authority has been installed. Linux is used as the basis, i.e. (presumably) OpenSSL. The revocation lists work on Linux clients, but are not accepted by Windows systems. The following error message always appears when checking the revocation lists.
0x80092013 (-2146885613 CRYPT_E_REVOCATION_OFFLINE) -- 2148081683 (-2146885613)
Text der Fehlermeldung: Die Sperrfunktion konnte die Sperrung nicht überprüfen, da der Sperrserver offline war.The error message reads as follows:
0x80092013 (-2146885613 CRYPT_E_REVOCATION_OFFLINE) -- 2148081683 (-2146885613)
The revocation function was unable to check revocation because the revocation server was offline.Nowadays, it is essential to protect the authentication of devices on the company network and administrative interfaces. As a rule, digital certificates are used for this purpose.
Printers therefore also generally require digital certificates in order to be operated securely. From a certain number of devices, there is no getting around automatic certificate distribution.
Some printer manufacturers offer centralized management solutions for certificate distribution.
Unfortunately, it has been shown time and again that the secure handling of digital certificates requires a great deal of knowledge, experience and care, which is often not the case.
The purposes for which a digital certificate may be used are controlled via the "Key Usage" and "Extended Key Usage" certificate extensions. The "Extended Key Usage" certificate extension contains the extended key usages for which the certificate may be used.
However, certificates issued by a Microsoft certification authority contain another certificate extension called "Application Policies", which also contains a list very similar to the Extended Key Usages extension.
Justin Bollinger from TrustedSec has found out that with offline certificate requests against schema version 1 certificate templates it is possible (similar to the Security Identifier extension ) to include arbitrary Application Policies in the certificate request, which are transferred unchanged to the issued certificate and can then be used to attack the Active Directory forest. The attack was named ESC15.
Starting with version 58, Google has decided to remove support for the Subject Distinguished Name of web server certificates in the Chrome browser and instead only accept certificates with Subject Alternative Name.
Since then, web server certificates without a Subject Alternative Name in the form of a dNSName have been rejected by Google Chrome and other Chromium -based browsers (i.e. also Microsoft Edge ). Other browser manufacturers quickly adopted this approach, so that this problem now affects all popular browsers.
Attacks on Microsoft certification authorities can be aimed at exploiting permissions on certificate templates. In many cases, certificate templates must be configured to grant the enrollee the right to request arbitrary identities. This can lead to the attacker taking over the identities of Active Directory accounts and subsequently to privilege escalation. Attacks of this type are known in the security scene as "ESC1 ".
Companies use Mobile Device Management (MDM) products for managing, configuring and updating mobile devices such as smartphones, tablet computers or desktop systems via the Internet (over-the-air, OTA).
Common mobile device management products are:
Nowadays, many companies want to rely on paperless processes to speed up internal approval and signature processes. In times when most employees are working from home, this has become even more important.
Although the Microsoft certification authority is able to implement automatic certificate issuance processes, its ability to influence the content of the certificate is severely limited .
The TameMyCerts Policy Module for Microsoft Active Directory Certificate Services (AD CS) allows the definition of extended rules for the Subject Distinguished Name and also the Subject Alternative Name of issued certificates.
With the supposedly good intention of making it possible to issue such certificate requests with a SAN, unfortunately far too many guides advise enabling the EDITF_ATTRIBUTESUBJECTALTNAME2 flag on the certification authority.
If this flag is enabled, a very large attack surface is offered, as any enrollee can now instruct the certification authority to issue certificates with any content. This type of attack is known in the security scene as ESC6 and ESC7 .
With the Chromium project and products based on it such as Google Chrome and Microsoft Edge, Google has moved to enforce RFC 2818 , adopted in 2000, and to no longer trust certificates that no longer fulfill this requirement.
For us, the following sentence is of great significance:
If a subjectAltName extension of type dNSName is present, that MUST be used as the identity. Otherwise, the (most specific) Common Name field in the Subject field of the certificate MUST be used. Although the use of the Common Name is existing practice, it is deprecated and Certification Authorities are encouraged to use the dNSName instead