Installing Active Directory Certificate Services in the default configuration automatically configures the environment so that smart card logons are accepted by the domain controllers.
Therefore, if the use of smart card logons is not desired, it makes sense to disable the functionality in order not to jeopardize Active Directory in the event the certification authority is compromised.
Root certification authorities (root CA) generate so-called cross-certification authority certificates (cross signing) when the certification authority certificate is renewed.
Sometimes problems may occur in this process, as described for example in the article "Requesting a certification authority certificate fails with error message "The certification authority's certificate contains invalid data. 0x80094005 (-2146877435 CERTSRV_E_INVALID_CA_CERTIFICATE)" ".
In such a case, one may want to stop the creation of the cross-certification authority certificates.
Internationalized Domain Names (IDNs) have been officially supported since Windows Server 2012 as part of the certification authority and its associated components.
However, if you want to use them in your certification authority certificates, there are some specifics to consider.
Continue reading "Umlauts in certification authority certificates"
Since the Certificate Services management tools in Windows Server 2012, you can select the desired compatibility for the certification authority and certificate recipient when configuring a certificate template.
In the following, this function is described in more detail, as well as possible effects in practice.
Continue reading "How are the compatibility settings for certificate templates technically mapped?"
Since the Certificate Services management tools in Windows Server 2012, you can select the desired compatibility for the certification authority and certificate recipients when configuring a certificate template.
The following is an overview of which options become available in each case when the compatibility settings for the certification authority and/or the certificate recipients are changed.
At the latest with the end of product support by the manufacturer (Microsoft) , the question arises whether to bring the certification authority to an up-to-date operating system by migrating it to another server , or to perform an in-place upgrade. The latter process is described below.
At the latest with the end of product support by the manufacturer (Microsoft) , the question arises whether to bring the certification authority to an up-to-date operating system by migrating it to another server , or to perform an in-place upgrade. The latter process is described below.
At the latest with the end of product support by the manufacturer (Microsoft) , the question arises whether to bring the certification authority to an up-to-date operating system by migrating it to another server , or to perform an in-place upgrade. The latter process is described below.
At the latest with the end of product support by the manufacturer (Microsoft) , the question arises whether to bring the certification authority to an up-to-date operating system by migrating it to another server , or to perform an in-place upgrade. The latter process is described below.
At the latest with the end of product support by the manufacturer (Microsoft) , the question arises whether to bring the certification authority to an up-to-date operating system by migrating it to another server , or to perform an in-place upgrade. The latter process is described below.
Assume the following scenario:
An authentication error has occurred.
The function requested is not supported.
Remote Computer: 192.168.1.149
This could be due to CredSSP encryption oracle remediation.
For more information, see https://go.microsoft.com/fwlink/?linkid=866660 In German:
Authentifizierungsfehler.
Die angeforderte Funktion wird nicht unterstützt.
Remotecomputer: 192.168.1.149
Ursache könnte eine CredSSP Encryption Oracle-Abwehr sein.
Weitere Informationen finden Sie unter https://go.microsoft.com/fwlink/?linkid=866660 Assume the following scenario
Error Parsing Request The request subject name is invalid or too long. 0x80094001 (-2146877439 CERTSRV_E_BAD_REQUESTSUBJECT)The following is an overview of the tokens for the CDP and AIA configuration of a certification authority.
Continue reading "Tokens for the CDP and AIA configuration of a certification authority"
The following is an overview of the audit events generated by the certification authority in the Windows Event Viewer.
In contrast to operational events, which are often understood under the term "monitoring", auditing for the certification authority is the configuration of logging of security-relevant events.
Continue reading "Overview of audit events generated by the certification authority"
The following is an overview of the events generated by the certification authority in the Windows Event Viewer.
Continue reading "Overview of Windows events generated by the certification authority"