Professional operation of a certification authority also includes the regular creation of backups.
The following describes which components need to be backed up and the associated procedure.
Continue reading "Create a backup of a certification authority"
A backup of a certification authority also includes the backup of the private key material. Its backup is deliberately described separately, since it should be done separately and its backups should also be stored separately from those of the certification authority.
Continue reading "Create a backup of the private key of a certification authority"
The most important component of a PKI in terms of availability is not the certification authority, as is often assumed, but the CRL distribution points. If a certification authority is unavailable, initially no new certificates can be issued, but the certificates already issued can continue to be used without hindrance as long as their revocation status can be verified. In addition to the pure availability of the CRL distribution points, the revocation information must of course also be valid in terms of its signature. Certificate revocation lists (CRLs) have a defined expiration date after which they can no longer be used. If a certification authority has now failed, it can also no longer publish new CRLs. The process of emergency signing of CRLs is provided for this case.
Continue reading "Perform emergency signing of certificate revocation lists"
Unfortunately, in practice it happens from time to time that the certificate revocation list (CRL) of a higher-level certification authority expires and a renewal does not take place. This can also happen as planned, for example when an old hierarchy is decommissioned.
The following describes the effects on certification authority operation when a root certificate that issued one of the certification authority certificates of a certification authority is imported into the Untrusted Certificates store on the certification authority.
This case may occur as planned, for example, when a previous certification authority hierarchy is to be decommissioned.
Assume the following scenario:
CertUtil: -view command FAILED: 0x80070005 (WIN32: 5 ERROR_ACCESS_DENIED)If private key archival has been enabled, it may be necessary to export these keys from the certification authority database and convert them to another format (PKCS#12, PFX), for example for long-term archiving.
Below is a description of the procedure for exporting individual or all archived keys and obtaining the necessary meta-information.
Continue reading "Export archived private keys from the certification authority database"
Assume the following scenario:
A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider. 0x800b0109 (-2146762487 CERT_E_UNTRUSTEDROOT)If you want to perform maintenance work such as a migration to another server or perform more extensive configuration changes requiring a functional test on a certification authority, you want to ensure that the certification authority service is running, but at the same time prevent certificates from being automatically requested from and issued by the certification authority during this phase.
The following describes the impact on certification authority operations when one of the certification authority certificates of a certification authority is revoked.
This case may also occur as planned, for example, when a previous certification authority hierarchy is to be decommissioned.
The following describes the effects on certification authority operation if the revocation information for one of the certification authority's certificates cannot be retrieved.
This case may also occur as planned, for example, when a previous certification authority hierarchy is to be decommissioned.
The following describes the impact on certification authority operations if one of the root certification authority certificates from which one of the certification authority certificates is derived has its trust status removed, or never had it.
This case may also occur as planned, for example, when a previous certification authority hierarchy is to be decommissioned.
Assume the following scenario:
The certificate is revoked. 0x80092010 (-2146885616 CRYPT_E_REVOKED)Assume the following scenario:
A certificate chain could not be built to a trusted root authority. 0x800b010a (-2146762486 CERT_E_CHAINING)Assume the following scenario:
The revocation function was unable to check revocation because the revocation server was offline. 0x80092013 (-2146885613 CRYPT_E_REVOCATION_OFFLINE)