Category: Certification Authority

Assume the following scenario:

• A Windows role related to Active Directory Certificate Services (Certification Authority, Network Device Enrollment Service (NDES), Certification Authority Web Enrollment (CAWE), Certificate Enrollment Web Services (CEP, CES), or Online Responder (OCSP)) is to be installed or uninstalled.
• The installation or uninstallation fails with the following error message:

The status of the role services on the target machine cannot be determined. Please retry. The error is The WS-Management service cannot process the request. The service is configured to not accept any remote shell requests.

Continue reading "Installation or uninstallation of a Windows feature fails with error message "The service is configured to not accept any remote shell requests.""

Assume the following scenario:

• A certificate is revoked via the command line (certutil -revoke).
• The operation fails with the following error message:

ICertAdmin::RevokeCertificate: The data is invalid. 0x8007000d (WIN32: 13 ERROR_INVALID_DATA)

Continue reading "Revocation of an issued certificate fails with error message "The data is invalid. 0x8007000d (WIN32: 13 ERROR_INVALID_DATA)""

By default, the Microsoft Certification Authority removes the serial numbers of expired certificates from the revocation lists it issues.

However, there are some exceptions to this.

Continue reading "Treatment of expired certificates when issuing certificate revocation lists"

Assume the following scenario:

• A certification authority is installed.
• The installation is successful, but the certification authority service does not start after the installation.
• When trying to start the certification authority service from the Certification Authority management console, you receive the following error message:

The system cannot find the file specified. 0x2 (WIN32: 2 ERROR_FILE_NOT_FOUND)
The policy module for a CA is missing or incorrectly registered. To view or change policy module settings, right-click on the CA, click Properties, and then click the Policy Module tab.

Continue reading "The certification authority service does not start and throws the error message "The system cannot find the file specified. 0x2 (WIN32: 2 ERROR_FILE_NOT_FOUND)""

Assume the following scenario:

• A user sends a certificate request to a certification authority.
• The certificate request fails with the following error message:

The request is missing required signature policy information. 0x80094809 (-2146875383 CERTSRV_E_SIGNATURE_POLICY_REQUIRED)
Denied by Policy Module

Continue reading "Certificate request fails with error message "The request is missing required signature policy information. 0x80094809 (-2146875383 CERTSRV_E_SIGNATURE_POLICY_REQUIRED)"."

The capolicy.inf contains basic settings that can or should be specified before installing a certification authority. Put simply, no certification authority should be installed without it.

Continue reading "Basics: Configuration file for the certification authority (capolicy.inf)"

Microsoft Active Directory Certificate Services offers the possibility to develop your own policy and exit modules to extend the functionality of the certification authority.

Below are the steps necessary to create an exit module in C# using Visual Studio 2019. The exit module will write issued certificates to a configurable directory in the file system.

Continue reading "Create an exit module for the certification authority in C#"

Since Windows 8, it is possible to protect the private keys of certificates with a Trusted Platform Module (TPM), if one is present . This makes the key non-exportable - even with tools like mimikatz.

However, it is not obvious at first glance that it cannot be guaranteed that a TPM is really used. It is true that no request via the Microsoft Management Console or autoenrollment is possible if the computer does not have a TPM.

However, the configuration in the certificate template is only a default setting for the client. When a certificate is requested, the certification authority will not explicitly check whether a Trusted Platform Module was really used .

To ensure that the private key of a certificate request has really been protected with a Trusted Platform Module, only the TPM Key Attestation remains.

Continue reading "Configuring the Trusted Platform Module (TPM) Key Attestation"

Time and again in discussions about the security of a certification authority, it comes up that abuse of the certification authority could be contained by its security settings.

However, the fact that the integrity of a certification authority is directly tied to its key material and can therefore also be compromised through it is not obvious at first glance.

One has to think of the certification authority software as a kind of management around the key material. For example, the software provides an online interface for certificate enrollment , takes care of the authentication of the enrollees, the automated execution of signature operations (issuing certificates and certificate revocation lists ) and their logging (certification authority database , audit log , event log ).

However, signature operations require nothing more than the private key of the certification authority. The following example shows how an attacker, given access to the certification authority's private key, can generate and issue certificates without the certification authority software and its security mechanisms noticing.

With such a certificate, it would in the worst case even be possible to take over the Active Directory forest undetected .

Continue reading "Signing certificates bypassing the certification authority"

In the operation of a certification authority, one may find that it is necessary to subsequently change the storage path for the certification authority database. For example, one may want to move the database to another partition/drive.

Continue reading "Moving the certification authority database to another directory or drive"

However, if you take a look at the symmetric algorithms included in such a certificate, you will probably find that the list contains rather outdated algorithms - the "strongest" of these algorithms is Triple DES (3DES), which is now considered obsolete.

Continue reading "Extend the "S/MIME Capabilities" certificate extension in issued certificates to include the Cryptography Next Generation (CNG) algorithms"

Assume the following scenario:

• A certification authority (Enterprise Certification Authority) integrated into Active Directory is installed via Windows PowerShell.
• Delegated permissions are used to install the certification authority. Thus, the installing user is not a member of the Enterprise Administrators group.
• After running the Role Configuration Wizard, one or more of the following error messages is displayed on the command line:

Setup could not add the Certification Authority's computer account to the Pre-Windows 2000 Compatible Access security group. Certificate managers Restrictions feature will not work correctly on this Certification Authority. To fix this, an administrator must manually add the Certification's Authority's computer account to the Pre-Windows 2000 Compatible Access security group in Active Directory. Insufficient access rights to perform the operation. 0x80072098 (Win32: 8344 ERROR_DS_INSUFF_ACCESS_RIGHTS)

Warning: Setup could not add the certification authority’s computer account to the cert Publishers Security Group. This Certification Authority will not be able to publish certificates in Active Directory. To fix this, an administrator must manually add the Certification Authority’s computer account to the Cert Publishers security group in Active Directory.  Insufficient access rights to perform the operation. 0x80072098 (Win32: 8344 ERROR_DS_INSUFF_ACCESS_RIGHTS)

Continue reading "When installing an Active Directory integrated certification authority, the error message "Insufficient access rights to perform the operation. 0x80072098 (Win32: 8344 ERROR_DS_INSUFF_ACCESS_RIGHTS)" appears"

Assume the following scenario:

• A certification authority (Enterprise Certification Authority) integrated into Active Directory is installed.
• Delegated permissions are used to install the certification authority. Thus, the installing user is not a member of the "Enterprise Administrators" group.
• After the certification authority certificate is issued by the parent certification authority, it is installed to complete the role configuration.
• The installation of the certification authority certificate fails with the following error message:

Insufficient access rights to perform the operation. 0x80072098 (WIN32: 8344 ERROR_DS_INSUFF_ACCESS_RIGHTS)

Continue reading "Installation of a certification authority certificate fails with error message "Insufficient access rights to perform the operation. 0x80072098 (WIN32: 8344 ERROR_DS_INSUFF_ACCESS_RIGHTS)""

Assume the following scenario:

• A certification authority is installed.
• The certification authority uses a Gemalto/SafeNet hardware security module (HSM) with the SafeNet Luna Key Storage Provider.
• After the certification authority certificate is issued by the parent certification authority, it is installed to complete the role configuration.
• The installation of the certification authority certificate fails with the following error message:

An error was detected while configuring Active Directory Certificate Services.
The Active Directory Certificate Services Setup Wizard will need to be rerun to complete the configuration.
The new certificate public key does not match the current outstanding request.
The wrong request may have been used to generate the new certificate: Provider DLL failed to initialize correctly.
0x8009001d (-2146893795 NTE_PROVIDER_DLL_FAIL)

Continue reading "The installation of a certification authority certificate fails with error code "NTE_PROVIDER_DLL_FAIL""

Sometimes it is necessary to allow Relative Distinguished Names (RDNs) in issued certificates that are not defined and therefore could not be configured in the SubjectTemplate value in the certification authority's registry either.

An example of this is the Organization Identifier with object identifier 2.5.4.97, which is required, for example, for certificates that comply with the eIDAS Regulation.

Continue reading "Use of undefined Relative Distinguished Names (RDN) in issued certificates"