Assume the following scenario:
sscep: Subject of our request does not match that of the returned Certificate!Continue reading „SSCEP: Subject of our request does not match that of the returned Certificate!“
Sometimes it is necessary to allow Relative Distinguished Names (RDNs) in issued certificates that are not defined and accordingly not included in the SubjectTemplate value of the certification authority registration could be configured.
An example of this is the Organization Identifier with Object Identifier 2.5.4.97, which is required, for example, for certificates that are used for the eIDAS Regulation are compliant.
Continue reading „Verwenden von nicht definierten Relative Distinguished Names (RDN) in ausgestellten Zertifikaten“The Microsoft Certification Authority accepts subjects from certificate requests for templates in which their specification by the requester is allowed, not 1:1 in the issued certificate.
Instead, both is defined, which Relative Distinguished Names (RDNs) are allowedas well as in which order they are written to issued certificates. However, this order can be changed. How this is done is explained below.
Continue reading „Die Reihenfolge der Relative Distinguished Names (RDNs) im Subject Distinguished Name (DN) ausgestellter Zertifikate ändern“| Event Source: | Microsoft-Windows-CertificationAuthority |
| Event ID: | 53 (0x35) |
| Event log: | Application |
| Event type: | Warning |
| Symbolic Name: | MSG_DN_CERT_DENIED_WITH_INFO |
| Event text (English): | Active Directory Certificate Services denied request %1 because %2. The request was for %3. Additional information: %4 |
| Event text (German): | The request %1 was rejected because %2. The request was for %3. More information: %4 |
| Event Source: | Microsoft-Windows-CertificationAuthority |
| Event ID: | 19 (0x13) |
| Event log: | Application |
| Event type: | Error |
| Symbolic Name: | MSG_E_REG_BAD_SUBJECT_TEMPLATE |
| Event text (English): | Active Directory Certificate Services did not start: The Subject Name Template string in the registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CertSvc\Configuration\%1\SubjectTemplate is invalid. An example of a valid string is: CommonName OrganizationalUnit Organization Locality State Country |
| Event text (German): | Active Directory certificate services were not started: The applicant name template string in the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CertSvc\Configuration\%1\SubjectTemplate registry entry is invalid. An example of a valid entry is: CommonName OrganizationalUnit Organization Locality State Country |
| Event Source: | Microsoft-Windows-CertificationAuthority |
| Event ID: | 22 (0x16) |
| Event log: | Application |
| Event type: | Error |
| Symbolic Name: | MSG_E_PROCESS_REQUEST_FAILED_WITH_INFO |
| Event text (English): | Active Directory Certificate Services could not process request %1 due to an error: %2. The request was for %3. Additional information: %4 |
| Event text (German): | The request %1 could not be executed due to an error: %2. The request was for %3. More information: %4 |
Even with a certificate template for domain controllers that is supposedly simple to configure, there are a few things to keep in mind.
Continue reading „Konfigurieren einer Zertifikatvorlage für Domänencontroller“In order to determine whether a certificate has been issued by a certification authority that has been classified as trustworthy, a trust chain must be formed. To do this, all certificates in the chain must be determined and checked. Microsoft CryptoAPI builds all possible certificate chains and returns those with the highest quality to the requesting application.
Continue reading „Grundlagen: Auffinden von Zertifikaten und Validierung des Zertifizierungspfades“Internationalized Domain Names (IDNs) have been officially supported since Windows Server 2012 as part of the Certificate Authority and associated components.
However, if you want to use them in your certification authority certificates, there are some specifics to consider.
Continue reading „Umlaute in Zertifizierungsstellen-Zertifikaten“Assume the following scenario
Error Parsing Request The request subject name is invalid or too long. 0x80094001 (-2146877439 CERTSRV_E_BAD_REQUESTSUBJECT)Continue reading „Die Beantragung eines Zertifikats schlägt fehl mit Fehlermeldung „Error Parsing Request The request subject name is invalid or too long. 0x80094001 (-2146877439 CERTSRV_E_BAD_REQUESTSUBJECT)““
Nowadays rather a curiosity than really relevant in practice, but it does happen from time to time that you receive certificate requests that contain more than one common name in the subject. Even though it may seem surprising, this is quite possible and also RFC compliant.
Continue reading „Mehr als ein gemeinsamer Name (Common Name, CN) im Zertifikat“The following is a description of what configuration settings are necessary for a certificate hierarchy based on Active Directory Certificate Services to be compliant with the "Common PKI" standard.
Continue reading „Beschreibung der notwendigen Konfigurationseinstellungen für das „Common PKI“ Zertifikatprofil“In principle, the RFC 5280 the use of arbitrary strings in the subject string of a certificate. Common fields in the standard are X.520 described. The Length restrictions are also recommended by the ITU-T. The abbreviations commonly used today are mainly taken from the RFC 4519.
However, Microsoft Active Directory Certificate Services only allows certain RDNs by default.
The following Relative Distinguished Names (RDNs) are accepted by the Active Directory Certificate Services (ADCS) certificate authority by default:
Continue reading „Erlaubte Relative Distinguished Names (RDNs) im Subject Distinguished Name (DN) ausgestellter Zertifikate“Sometimes it is necessary to change the Subject Distinguished Name (also called Subject, Subject DN, Applicant or Subject) of a certificate request before issuing the certificate.
Under certain circumstances, this is certainly possible, as described below.
Continue reading „Den Subject Distinguished Name (DN) einer Zertifikatanforderung (CSR) nachträglich verändern“
English 
Deutsch