In contrast to operational events, which are often understood under the term "monitoring", auditing for the certification authority is the configuration of logging of security-relevant events.
After installing a certification authority, after migrating to a new server, or after more extensive maintenance work, an extensive functional test should be performed to ensure that all components of the certification authority are working as desired.
Continue reading "Performing a functional test for a certification authority"
Sometimes it is necessary for a certificate issued by a certification authority to be withdrawn from circulation even before its expiration date. To make this possible, a certification authority maintains a certificate revocation list. This is a signed file with a relatively short expiration date, which is used in combination with the certificate to check its validity.
In some cases (for example, with an offline certification authority, or if non-standard LDAP CRL distribution points have been configured), the certificate revocation list must be manually published to Active Directory.
Sometimes it is necessary for a certificate issued by a certification authority to be taken out of service even before its expiration date. To make this possible, a certification authority maintains a certificate revocation list (CRL). This is a signed file with a relatively short expiration date, which is used in combination with the certificate to check its validity.
After a certificate has been revoked, a new CRL must be created and published so that entities that check the revocation status are informed of the revocation. Since the CRL has a relatively short expiration date, it must be reissued at regular intervals even if the content is not changed.
Continue reading "Create and publish a certificate revocation list"
Sometimes it is necessary for a certificate issued by a certification authority to be withdrawn from circulation even before its expiration date. To make this possible, a certification authority maintains a certificate revocation list (CRL). This is a signed file with a relatively short expiration date, which is used in combination with the certificate to check its validity.
When a certificate is revoked, its serial number is placed on the CRL. Entities that check the revocation of a certificate then consider it to be no longer valid.
Assume the following scenario:
The certification authority's certificate contains invalid data. 0x80094005 (-2146877435 CERTSRV_E_INVALID_CA_CERTIFICATE)
Denied by Policy ModuleFor stronger control over the certificates that can be issued by a certification authority, a path length constraint can be set up so that certification authorities from a defined hierarchy level onward are no longer able to issue subordinate certification authority certificates
For an explanation of how the path length constraint works, see the article "Basics: Path Length Constraint" .
Assume the following scenario:
The following describes how to restore a certification authority from backup. In addition to the disaster case, this procedure is also part of the migration of a certification authority to a new server .
Continue reading "Restoring a certification authority from backup"
The following describes how to restore a CA certificate with a software key.
Restoring the certification authority certificate may be necessary for the following reasons:
The following describes how to restore a CA certificate with a software key.
Restoring the certification authority certificate may be necessary for the following reasons:
Continue reading "Restoration of a certification authority certificate with software key"
Certification authority certificates have a defined start and end date, so it is inevitable during the lifecycle of a certification authority that certification authority certificates will expire.
The following describes the impact of an expiring certification authority certificate on the certification authority.
Assume the following scenario:
Assume the following scenario:
The data is invalid. 0xd (WIN32: 13 ERROR_INVALID_DATA)During the lifetime of a certification authority, certification authority certificates are renewed according to the planning for their life cycle. A new key pair can optionally be used here. The previous certification authority certificates expire or are revoked.
Expired certification authority certificates can become a problem under certain circumstances if, for example, the associated private keys are stored on old hardware security modules (HSM) and these can only be migrated to new hardware with great difficulty.
In such a case, it may be useful to remove old certification authority certificates from the certification authority configuration.