Category: Certification Authority

On the internet, there are unfortunately far too many instructions (the big players are not excluded from this , not even Microsoft itself or the grandmaster Komar ), which fatally recommend that the flag EDITF_ATTRIBUTESUBJECTALTNAME2 should be set on the certification authority - supposedly to be able to issue certificates with Subject Alternative Name (SAN) extension for manually submitted certificate requests.

Unfortunately, this procedure is not only unnecessary, it also has some unpleasant side effects, which in the worst case can help an attacker to take over the entire Active Directory forest .

Continue reading "Change the Subject Alternative Name (SAN) of a certificate before it is issued - but do it securely!"

Certificate revocation lists (CRLs) are used to remove issued certificates from circulation before the end of their validity period.

A CRL is a signed list of the serial numbers of certificates that have been revoked by the certification authority. The CRL has an expiration date (usually only a few days ahead) and is reissued and signed by the associated certification authority at regular intervals.

Certificate revocation lists can reach a considerable size if the volume of revoked certificates is high (as a rule of thumb, you can expect about 5 megabytes per 100,000 entries). The regular download of large certificate revocation lists by subscribers can generate a large network load. To address this problem, there is the concept of delta CRLs.

Continue reading "Basics: Delta CRLs"

There are many instructions for setting up and commissioning IT services. However, the associated instructions for decommissioning are usually forgotten.

The following describes how to correctly decommission a certification authority integrated into Active Directory (Enterprise Certification Authority).

Continue reading "Decommissioning of an Active Directory integrated certification authority (Enterprise CA)"

For the encryption of email messages, companies typically use the Secure / Multipurpose Internet Message Extensions (S/MIME) standard and provide their users with appropriate certificates for this purpose.

An important aspect here is that the users' private keys should be secured centrally - in contrast to the signing certificates that are otherwise mostly used. Incoming messages are encrypted for a specific private key and can only be decrypted again by this key . Thus a backup of these keys must absolutely be available - this is also indispensable for synchronization to mobile devices . For this purpose, the Microsoft Active Directory Certificate Services offer the private key archival function.

But what if private key archival has not been set up and users have already requested corresponding certificates?

Continue reading "Subsequent archiving of private keys"

In the article "Signing certificates bypassing the certification authority " I described how an attacker with administrative rights on the certification authority can generate a logon certificate for administrative accounts of the domain by bypassing the certification authority software, i.e. by directly using the private key of the certification authority.

In the previous article I used the PSCertificateEnrollment Powershell Module to demonstrate the procedure. However, with certreq and certutil Microsoft already ships perfectly suitable pentesting tools directly with the operating system ex works.

Continue reading "Signing certificates bypassing the certification authority - solely using built-in tools"

Assume the following scenario:

• A new certification authority certificate is requested for a subordinate certification authority and issued by the parent certification authority.
• The Subject Distinguished Name (Subject DN) is identical to that of the previous certification authority certificate.
• However, the installation of the certification authority certificate fails with the following error message:

An error was detected while configuring Active Directory Certificate Services.
The Active Directory Certificate Services Setup Wizard will need to be rerun to complete the configuration.
The new certificate subject name does not exactly match the active CA name.
Renew with a new key to allow minor subject name changes: The parameter is incorrect. 0x80070057 (WIN32: 87 ERROR_INVALID_PARAMETER).

Continue reading "Installation of a new certification authority certificate fails with error code "ERROR_INVALID_PARAMETER""

Usually, the encoding of characters and strings in certificates is not a topic of great interest to the users of a PKI. However, there are cases where the default settings of the certification authority do not provide the desired results.

Continue reading "Character encoding in the Subject Distinguished Name of certificate requests and issued certificates"

As the operator of a certification authority, you are (among other things) responsible for the identification of the enrollees and the confirmation of the requested identities . The fact that this task is carried out conscientiously and without error is the central pillar of the trust placed in the certification authority. Well-known companies have already failed at this task , even had to file for insolvency as a result of misissuances and/or were severely punished by the big players in the market.

In many cases, we as (Microsoft) PKI operators in companies (regardless of the associated quality) are able to delegate our task of uniquely identifying an enrollee to the Active Directory. In many cases, however, we unfortunately also have to instruct our certification authority(ies) to simply issue everything that is requested.

Continue reading "A policy module to tame them all: Introducing the TameMyCerts Policy Module for Microsoft Active Directory Certificate Services"

Assume the following scenario:

• A certification authority uses a hardware security module (HSM) .
• The partition of the hardware security module fills up with more and more keys over the lifetime of the certification authority.
• With SafeNet hardware security modules, this can even cause the partition to run full. As a result, the events 86 and 88 are logged by the certification authority.

Continue reading "The partition of the hardware security module (HSM) fills up"

With the May 10, 2022 patch, Microsoft is attempting to close a vulnerability in Active Directory that affects certificate-based logon (commonly known as PKINIT or also smart card logon ).

The update changes both the behavior of the certification authority as well as the behavior of Active Directory when processing certificate-based logons.

Continue reading "Changes to Certificate Issuance and Certificate-Based Logon to Active Directory with the May 10, 2022 Patch for Windows Server (KB5014754)"

Name constraints are part of the X.509 standard and are described in RFC 5280 . They are a tool that can be used as part of qualified subordination to control the scope of a certification authority certificate in a fine-grained manner.

Continue reading "Basics: Name Constraints"

At the turn of the year, a note to all operators of a Microsoft certification authority and connected services:

The end of Microsoft product support for Windows Server 2012 and 2012 R2 is slowly approaching: it is October 10, 2023.

Thus, it is time to prepare for the move to a new operating system.

Continue reading "It's time: Migrating the PKI components from Windows Server 2012 to a new operating system"

With Windows Vista and Windows Server 2008, the Cryptography API: Next Generation (CNG) was introduced into the Windows systems.

This term refers to a collection of modern cryptographic functions. Among other things, the CNG enables the use of certificates that use keys based on elliptic curves (also called Elliptic Curve Cryptography, ECC) with the Microsoft Certification Authority and the Windows operating system.

Continue reading "Basics: Elliptic curves with regard to their use in the public key infrastructure"

If a certification authority is installed, the "Windows Default" exit module is automatically activated. This enables e-mail messages to be sent when certain events occur at the certification authority. However, most companies do not use this feature at all.

However, even if the exit module is not used at all, it causes sessions on the certification authority database (see Event no. 46 ). On certification authorities with high load this can be problematic .

If the functions it offers are not used at all (the "Windows Default" exit module never works on Windows Server Core ), it can also be disabled completely.

Continue reading "Operating the Certification Authority without an exit module"

If you want to formulate queries against the certification authority database , you must first know what you want to look for.

There is a possibility to output the database schema of the certification authority database.

Continue reading "The database schema of the certification authority database"