Category: Certification Authority

Active Directory Certificate Services have existed (albeit under a different name) in their basic form since Windows NT 4.0. The Active Directory-based architecture used today was introduced with Windows 2000 Server. AD CS is very well integrated into the Windows ecosystem and continues to enjoy great popularity worldwide in companies and government agencies of all sizes.

People like to point out the many possibilities offered by Active Directory Certificate Services. Rarely, however, is it pointed out what is not possible with them. In fact, the product has by now reached its limits in many places.

What these are will be explained in more detail below in order to better decide whether AD CS can be the right solution for planned projects.

Continue reading "Limits of Microsoft Active Directory Certificate Services"

Assume the following scenario:

• A certification authority is migrated to another server or restored from backup .
• A Thales (nCipher) hardware security module (HSM) is used to protect the private key of the certification authority certificate. Security World is configured with Operator Card Set (OCS) Protection.
• The certification authority certificate was successfully restored and associated with the private key stored on the HSM .
• When installing the certification authority role, the restored certification authority certificate cannot be selected.

Continue reading "When restoring a certification authority, the certification authority certificate is not selectable during role installation"

Assume the following scenario:

• A new certification authority is installed.
• After configuring the certification authority role and issuing the certification authority certificate, it should now be installed on the certification authority.
• A hardware security module (HSM) is used to protect the private key of the certification authority certificate.
• The installation of the certification authority certificate fails with the following error message:

An error was detected while configuring Active Directory Certificate Services.
The Active Directory Certificate Services Setup Wizard will need to be rerun to complete the configuration.
The new certificate public key does not match the current outstanding request.
The wrong request may have been used to generate the new certificate:  Object was not found. 0x80090011 (-2146893807 NTE_NOT_FOUND)

Continue reading "Installation of a certification authority certificate fails with error message "Object was not found. 0x80090011 (-2146893807 NTE_NOT_FOUND)""

Assume the following scenario:

• A certification authority is migrated to another server or restored from backup .
• A hardware security module (HSM) is used to protect the private key of the certification authority certificate.
• The certification authority certificate is now to be restored on the target system and linked to the private key .
• The operation fails with the following error message:

Cannot find the certificate and private key for decryption.
CertUtil: -repairstore command FAILED: 0x80092004 (-2146885628 CRYPT_E_NOT_FOUND)
CertUtil: Cannot find object or property.

Continue reading "Reconnecting to the private key fails with error message "Cannot find object or property. 0x80092004 (-2146885628 CRYPT_E_NOT_FOUND)""

Assume the following scenario:

• For the first time, a certification authority (Enterprise Certification Authority) integrated into Active Directory is to be installed in the network.
• The rights to install the certification authority have been delegated to a separate security group or account for security reasons, so no logon as Enterprise Administrator is required. Put another way: The user used is not a member of the Enterprise Administrators group in the Active Directory forest.
• Since this is the first certification authority in the network, no default certificate templates are installed in Active Directory yet. When opening the certificate template management console (certtmpl.msc), one is prompted to install them.
• The installation fails with the following error message:

Windows could not install the new certificate templates. This security ID may not be assigned as the owner of this object.

Continue reading "Installation of the default certificate templates fails with error message "This security ID may not be assigned as the owner of this object.""

Sometimes it is necessary to issue certificates with a shorter validity period than configured in the certificate template. Therefore, you may not want to reconfigure the certificate template right away or create another certificate template.

Continue reading "Issue certificates with shortened validity period"

Some will have noticed that the certificate store for intermediate CAs usually also contains certificates for root CAs.

As a rule, this behavior is not critical. In certain cases however, this can also cause problems with applications.

Continue reading "Root CA certificates are imported on domain members into the certificate store for intermediate certification authorities"

Assume the following scenario:

• A user's computer is stolen or infected with malware.
• The integrity of certificates located on the computer can no longer be guaranteed.
• The certificates of the user(s) that were requested on this computer must be revoked.
• However, one would like to avoid revoking all certificates of a user.
• Thus, a connection must be established between the user's certificates and the computer on which they were requested.

If the certificates were requested via autoenrollment , we can take advantage of the fact that a corresponding attribute was part of the original certificate request, and that the certificate request is stored in the certification authority database along with the certificate.

Continue reading "Establish a mapping from a user certificate to the associated computer"

If you restore a certification authority from a backup after a disaster has occurred , you will probably find that certificates were issued in the period between the last backup and the system failure with corresponding data loss.

These certificates are now not stored in the restored certification authority database, so they cannot be restored if needed.

If you are using the SMTP Exit Module, you can at least determine the serial numbers of the certificates from the sent e-mails and revoke them.

Continue reading "Restoring certificates from the SMTP Exit Module data"

Assume the following scenario:

• A certification authority is implemented in the network.
• The certification authority service does not start.
• When trying to start the certification authority service, you get the following error message:

Provider DLL failed to initialize correctly. 0x8009001d (-2146893795 NTE_PROVIDER_DLL_FAIL).

Continue reading "The certification authority service does not start and throws the error message "Provider DLL failed to initialize correctly. 0x8009001d (-2146893795 NTE_PROVIDER_DLL_FAIL).""

The purposes for which a digital certificate may be used are controlled via the certificate extensions "Key Usage" and "Extended Key Usage".

The "Extended Key Usage" certificate extension contains the extended key usages for which the certificate may be used.

However, certificates issued by a Microsoft certification authority contain another certificate extension called "Application Policies", which also contains a list very similar to the Extended Key Usages extension.

Continue reading "The "Application Policies" certificate extension"

Assume the following scenario:

• A certificate template is configured for automatic request and issuance (autoenrollment).
• Users or computers request new certificates at regular intervals and long before the defined renewal period.

Continue reading "New certificates are regularly requested via autoenrollment"

Assume the following scenario:

• A certificate template is configured to use elliptic curve based keys (e.g. ECDSA_P256).
• As a result, a minimum key length of 256 bits is configured.
• Nevertheless, certificate requests that use other ECC curves or RSA-based keys are also signed.

Continue reading "The key algorithm of certificate requests is not checked by the certification authority's policy module"

In the following, I would like to present a highly dangerous PKI configuration, perhaps not necessarily known to the general public, which can probably be encountered quite frequently in this way in corporate networks.

I show how, by exploiting various unfortunate circumstances in the Windows PKI, it is possible to elevate privileges from mere network access to complete Active Directory takeover.

The initial point of attack in this example is the Network Device Enrollment Service (NDES).

Continue reading "From Zero to Enterprise Administrator through Network Device Enrollment Service (NDES) - and What to Do About It"

Assume the following scenario:

• A certification authority is installed.
• An error occurred during installation that required a retry.
• The certification authority role was uninstalled and then the role configuration was tried again.
• The role configuration fails with the following error message:

The Certification Authority is already installed. If you are trying to reinstall the role service, you must first uninstall it.

Continue reading "Installation of a certification authority fails with error message "The Certification Authority is already installed.""