Is there a dependency of the Network Device Enrollment Service (NDES) on the NTAuthCertificates object?

Author Uwe Gradenegger Posted on Categories Network Device Enrollment Service (NDES), Security, Active Directory Tags NTAuthCertificates, Registration Authority (RA), Enroll on Behalf of (EOBO)

The Network Device Enrollment Service (NDES) has two Registration Authority certificates. The Enrollment Agent certificate is used to sign certificate requests, and one can configure the NDES device template accordingly, so that certificates are only issued if the submitted certificate requests also have a corresponding signature .

If you plan to remove the certification authority connected to NDES from the NTAuthCertificates object , the question may arise as to whether mutual dependencies need to be taken into account here - after all, Enroll on Behalf Of (EOBO) requires the presence of the certification authority certificate in NTAuthCertificates.

The Network Device Enrollment Service (NDES) provides a way for devices that do not have an identifier in Active Directory (for example, network devices such as routers, switches, printers, thin clients, or smartphones and tablets) to request certificates from a certification authority. For a more detailed description, see the article "Basics: Network Device Enrollment Service (NDES) ".

Does NDES have a dependency on NTAuthCertificates?

Do you know TameMyCerts? TameMyCerts is an add-on for the Microsoft certification authority (Active Directory Certificate Services). It extends the function of the certification authority and enables the application of rule sets to realize the secure automation of certificate issuance. TameMyCerts is unique in the Microsoft ecosystem, has already proven itself in countless companies around the world and is available under a free license. It can be downloaded via GitHub and used free of charge. Professional maintenance is also offered.

NDES can be operated without membership of the certification authorities concerned in NTAuthCertificates.

The only exception is the renewal mode, i.e. when a certificate request is to be signed with an existing certificate. In this case, the certification authority that issued the certificates to be renewed must be a member of NTAuthCertificates. If this is not the case, the NDES server will log event no. 28 when a certificate request is processed in renewal mode, and reject it.

However, most client-side implementations of the SCEP protocol do not use renewal mode anyway, so this should not be a major limitation. The biggest attack vector remains the regular certificate enrollment with or without a one-time password, the effects of which can be drastically reduced, for example, with the TameMyCerts Policy Module for Microsoft Active Directory Certificate Services .

Does NDES use the Enroll on Behalf Of (EOBO) mechanism?

The answer to this question is clearly "no" - the certificate request via NDES does not use Enroll on Behalf Of. It is simply a signed certificate request. Accordingly, it also works if the certification authority is not a member of NTAuthCertificates.

Conversely, however, this also means that NDES cannot work with Restricted Enrollment Agents.

If you want to operate your certification authority with one or more Network Device Enrollment Service (NDES) servers and at the same time equip it with Extended Key Usage Constraints , make sure that the "Certificate Request Agent" Extended Key Usage is included in the list of extended key usages, since the Registration Authority (RA) certificates of the NDES must always come from the same certification authority .