The following is an explanation of how the serial numbers of issued certificates are formed and how the behavior of the certification authorities can be customized.
Continue reading "How is the serial number of a certificate formed?"
In the default configuration, the certification authority's certificate request interface is configured to negotiate dynamic ports for the incoming RPC/DCOM connections (for more details, see the article "Firewall rules required for Active Directory Certificate Services ").
| Network protocol | Destination port | Protocol |
|---|---|---|
| TCP | 135 | RPC Endpoint Mapper |
| TCP | 49152-65535 | RPC dynamic ports |
This configuration is not feasible in every enterprise environment. Often there are restrictive firewall rules that do not allow the use of dynamic network ports.
In such a case, the certification authority must be configured to a static port.
Continue reading "Configuring the certification authority to a static port (RPC endpoint)"
In the default configuration, the certification authority's certificate request interface is configured to negotiate dynamic ports for the incoming RPC/DCOM connections (for more details, see the article "Firewall rules required for Active Directory Certificate Services ").
However, it is also possible to configure the certification authority to a static port (see article "Configuring the certification authority to a static port (RPC endpoint) ").
The following describes how to check the current configuration of the certification authority.
Continue reading "Querying the configured RPC endpoints of a certification authority"
If, in addition to Active Directory Certificate Services, the administrative tiering model is also implemented for the Active Directory directory service, the question arises as to how the individual PKI components are to be assigned to this model in order to be able to perform targeted security hardening.
Continue reading "Classification of AD CS components in the Administrative Tiering Model"
If a certificate request exists, for example after manual generation, in the form of a text file (usually with the extension .CSR or .REQ), it can be sent to the certification authority using built-in tools.
Continue reading "Send a manually created certificate request to a certification authority"
When configuring the auditing settings of a certification authority, one is inclined to select the "Start and Stop Active Directory Certificate Services" option. However, this option may cause problems in some circumstances.
Nowadays rather a curiosity than really relevant in practice, but it does happen from time to time that you receive certificate requests that contain more than one common name in the subject. Even though it may seem surprising, this is quite possible and also RFC compliant.
Continue reading "More than one common name (CN) in the certificate"
Assume the following scenario:
The "Windows default" Exit Module "Initialize" method returned an error. Class not registered The returned status code is 0x80040154 (-2147221164). The Certification Authority was unable to initialize email messaging objects.Continue reading "The SMTP exit module does not work on Windows Server Core"
The Microsoft certification authority always signs certificates with the key belonging to the most recent certification authority certificate. According to RFC 6960 , however, the signing certificate for an OCSP response should be signed by the same key as the certificate to be checked:
The CA SHOULD use the same issuing key to issue a delegation certificate as that used to sign the certificate being checked for revocation.
However, if the certification authority certificate is renewed and a new key pair is used in the process, it is necessary for the Online Responder to continue to maintain valid signing certificates for the certificates issued with the previous certification authority certificate, since these are still valid after all and must be checked for revocation.
Continue reading "Allow requesting a specific signature key on a certification authority"
Assume the following scenario:
Error Parsing Request The system cannot find the file specified. 0x80070002 (WIN32: 2 ERROR_FILE_NOT_FOUND)Assume the following scenario:
Bad Data. 0x80090005 (-2146893819 NTE_BAD_DATA).
Denied by Policy Module.At the latest when the End of product support by the manufacturer (Microsoft) approaches, the question arises as to how and to which operating system a certification authority should be migrated.
Continue reading "Windows Server Migration Matrix for the Certification Authority"
Often a certification authority lives significantly longer than the server on which it was installed. Reasons for migrating the certification authority to a new server, i.e. while retaining the data, can be:
The procedure for migration is described in detail below.
Each Windows Server operating system has a defined end date after which there is no longer any product support from the manufacturer. Certification authorities are also bound to this date, and should therefore be migrated before this date expires.
Continue reading "End of product support by the manufacturer (Microsoft)"
Assume the following scenario:
Object was not found. 0x80090011 (-2146893807 NTE_NOT_FOUND)