Windows operating system | Uwe Gradenegger

Configuring an SSL certificate binding for Microsoft Internet Information Server (IIS) fails with an error message when using ML-DSA-based keys

Assume the following scenario:

A web server certificate was generated using an ML-DSA-based key pair.
We would like to bind it to Internet Information Services (IIS).
The configuration fails with the following error message:

There was an error while performing this operation.

Details: 

A specified logon session does not exist. It may already have been terminated. (Exception from HRESULT: 0x80070520)

Continue reading "Configuring an SSL certificate binding for Microsoft Internet Information Server (IIS) fails with an error message when using ML-DSA-based keys"

YubiKey Personal Identity Verification (PIV) Attestation - with the TameMyCerts Policy Module for Microsoft Active Directory Certificate Services (ADCS)

Since the recently released version 1.7, the TameMyCerts Policy Module for Microsoft Active Directory Certificate Services supports Personal Identity Verification (PIV) attestation for YubiKeys.

A YubiKey is a compact security token that can be used, among other things, like a smart card for the secure storage and use of certificates and can therefore also be used for passwordless logon to Active Directory environments.

This cool function was developed by Oscar Virot and integrated into TameMyCerts. This makes it possible to provide cryptographic proof when issuing certificates and thus ensure that a key pair is actually generated with a YubiKey and secured by it and cannot be exported.

This can be particularly helpful in complying with the NIS2 directive if companies decide to use certificates as a second factor for logon with security-critical accounts in Active Directory.

Continue reading "YubiKey Personal Identity Verification (PIV) Attestation - with the TameMyCerts Policy Module for Microsoft Active Directory Certificate Services (ADCS)"

Revocation lists are not recognized as valid (only) on Windows (CRYPT_E_REVOCATION_OFFLINE)

Someone recently approached me with an interesting problem.

A certification authority has been installed. Linux is used as the basis, i.e. (presumably) OpenSSL. The revocation lists work on Linux clients, but are not accepted by Windows systems. The following error message always appears when checking the revocation lists.

0x80092013 (-2146885613 CRYPT_E_REVOCATION_OFFLINE) -- 2148081683 (-2146885613)
Text der Fehlermeldung: Die Sperrfunktion konnte die Sperrung nicht überprüfen, da der Sperrserver offline war.

The error message reads as follows:

0x80092013 (-2146885613 CRYPT_E_REVOCATION_OFFLINE) -- 2148081683 (-2146885613)
The revocation function was unable to check revocation because the revocation server was offline.

Continue reading "Revocation lists are not recognized as valid (only) on Windows (CRYPT_E_REVOCATION_OFFLINE)"

List of certificate use cases for which compatibility with elliptic curve (ECC)-based keys is known

As computing power becomes increasingly available, the need to use stronger cryptographic keys also increases. In this course, there is often a need (for example, because the keys have to be protected by a Trusted Platform Module) to use keys based on elliptic curves (ECC) . For their use, it is essential that compatibility with the intended use cases is ensured.

Below is a list of use cases for which I know the compatibility.

Continue reading "List of certificate use cases for which compatibility with elliptic curve (ECC)-based keys is known"

It's time: Migrating the PKI components from Windows Server 2012 to a new operating system

At the turn of the year, a note to all operators of a Microsoft certification authority and connected services:

The end of Microsoft product support for Windows Server 2012 and 2012 R2 is slowly approaching: it is October 10, 2023.

Thus, it is time to prepare for the move to a new operating system.

Continue reading "It's time: Migrating the PKI components from Windows Server 2012 to a new operating system"

Cause research: Snipping Tool and other components in Windows 11 no longer usable due to expired certificate

Today went through many Media that some apps and components in the recently released Windows 11 no longer work since 01.11.2021 and that the cause for this is a certificate that expired on 31.10.2021. In the meantime Microsoft has pointed out in a blog post and also published a patch for some affected components .

Unfortunately, none of the available sources provided detailed information about what exactly the problem was. So let's get to the bottom of this ourselves.

Continue reading "Cause research: Snipping Tool and other components in Windows 11 no longer usable due to expired certificate"

Limits of Microsoft Active Directory Certificate Services

Active Directory Certificate Services have existed (albeit under a different name) in their basic form since Windows NT 4.0. The Active Directory-based architecture used today was introduced with Windows 2000 Server. AD CS is very well integrated into the Windows ecosystem and continues to enjoy great popularity worldwide in companies and government agencies of all sizes.

People like to point out the many possibilities offered by Active Directory Certificate Services. Rarely, however, is it pointed out what is not possible with them. In fact, the product has by now reached its limits in many places.

What these are will be explained in more detail below in order to better decide whether AD CS can be the right solution for planned projects.

Continue reading "Limits of Microsoft Active Directory Certificate Services"

SignTool installation without Windows Software Development Kit (SDK) installation

One way to perform code signatures is to use the SignTool command line tool. This is part of the Windows 10 Software Development Kit (SDK).

If you want to use the tool on a system without having to install Visual Studio or the Windows SDK, you can proceed as follows.

Continue reading "SignTool installation without Windows Software Development Kit (SDK) installation"

What to consider when applying Microsoft Security Baselines?

In the context of hardening measures, it is a good idea to apply the Microsoft Security Baselines published by Microsoft to your own server landscape.

This will inevitably have an impact on PKI components. The following is an overview of the expected effects and countermeasures.

Continue reading "What to consider when applying Microsoft Security Baselines?"