Uwe Gradenegger - Page 53 - Passionate about PKI

certutil -dcinfo fails with error message "KDC certificates: Cannot find object or property. 0x80092004 (-2146885628 CRYPT_E_NOT_FOUND)"

Assume the following scenario:

Domain controllers have certificates for LDAP over SSL.
The certificates do not include the Extended Key Usage "Smart Card Logon" or "Kerberos Authentication".
If you run certutil -dcinfo, the command reports the following error message:

0 KDC certificates for DC01
No KDC Certificate in MY store
KDC certificates: Cannot find object or property. 0x80092004 (-2146885628 CRYPT_E_NOT_FOUND)

Publishing a certificate revocation list (CRL) fails with error message "Access is denied. 0x80070005 (WIN32: 5 ERROR_ACCESS_DENIED)".

Assume the following scenario:

A new revocation list is created on the certification authority.
The certification authority is configured to publish revocation lists to a network path.
Publishing fails with the following error message:

Access is denied. 0x80070005 (WIN32: 5 ERROR_ACCESS_DENIED)

Publishing a certificate revocation list (CRL) fails with error message "The directory name is invalid. 0x8007010b (WIN32/HTTP: 267 ERROR_DIRECTORY)".

Assume the following scenario:

A new revocation list is created on the certification authority.
Publishing fails with the following error message:

The directory name is invalid. 0x8007010b (WIN32/HTTP: 267 ERROR_DIRECTORY)

Manual publishing of a certificate revocation list (CRL) to Active Directory fails with error 0x8007202b (WIN32: 8235 ERROR_DS_REFERRAL)

Assume the following scenario:

An offline root certificate authority has been installed. The server on which the certificate authority is installed is not a domain member.
This is configured for Active Directory blacklist publications.
The blacklists are uploaded to the Active Directory using certutil -dspublish.
The operation fails with the following error message:

certutil -dspublish "ADCS Labor Root CA.crl"
 ldap:///CN=ADCS Lab Root CA,CN=ADCS Lab Root CA,CN=cdp,CN=Public Key Services,CN=Services,DC=UnavailableConfigDN?certificateRevocationList?base?objectClass=cRLDistributionPoint?certificateRevocationList
 ldap: 0xa: LDAP_REFERRAL: 0000202B: RefErr: DSID-03100835, data 0, 1 access points
         ref 1: 'unavailableconfigdn'
 CertUtil: -dsPublish command FAILED: 0x8007202b (WIN32: 8235 ERROR_DS_REFERRAL)
 CertUtil: A referral was returned from the server.

Manual application for a domain controller certificate

There are cases where you cannot or do not want to obtain domain controller certificates from a certification authority in your own Active Directory forest.

In this case, the use of certificate templates is not possible, and one must manually create a Certificate Signing Request (CSR).

Use Microsoft Network Load Balancing (NLB) for revocation list distribution points (CDP), access to job information (AIA), and online responders (OCSP).

It is generally a good idea to ensure the availability of CRL Distribution Points (CDP), Authority Information Access (AIA), and if available, Online Responders (OCSP) at all times.

Access to the revocation information is even more critical than to the certificate authority itself. If the revocation status of a certificate cannot be checked, it is possible (depending on the application) that the certificate is not considered trustworthy and the associated IT service cannot be used.

Combining the SMTP Exit Module with a local SMTP server for increased resilience

Assume the following scenario:

The certification authority is configured to send e-mail notifications about the events on the certification authority only using the SMTP Exit module.
The configured SMTP server is not always reliably accessible, for example, because it is not designed to be highly available.
If the SMTP server fails, the certificate authority will operate very slowly because the email notifications cannot be delivered. In some circumstances, the certificate authority service will no longer start.

Disabling the SMTP Exit Module of a Certification Authority

Assume the following scenario:

The certification authority is configured to send e-mail notifications about the events on the certification authority only using the SMTP Exit module.
The configured SMTP server is unreachable, for example due to a failure.

In this case, the exit module cannot deliver the email notifications. It will time out and the certificate authority will work very slowly.

The online responder (OCSP) requests new signature certificates every four hours

Assume the following scenario:

The online responders are configured to request signing certificates using a certificate template from an Active Directory integrated certificate authority.
The online responders apply for a new signature certificate at regular intervals (every four hours), even though the existing certificate is still valid for a sufficiently long time.

Transfer certificate revocation lists to revocation list distribution points using SSH Secure Copy (SCP) with public key authentication (Windows Server 2019).

If the servers providing the revocation list distribution points are located in a Demilitarized Zone (DMZ), for example, or data transfer via Server Message Block (SMB) is not possible for other reasons, the blacklists can be transferred to the distribution points using SSH Secure Copy (SCP). As of Windows Server 2019, the OpenSSH server and client packages are available. The following describes the setup with authentication via public keys (Public Key Authentication) instead of passwords as an example

Advanced queries against the certification authority database

The Certification Authority database stores much of the information about a Certification Authority's activities. Among other things, it contains information about:

Certificates issued
Revoked certificates
Published blacklists
Pending certificate requirements
Rejected certificate requests
Failed certificate requests

Viewing the contents of the certification authority database is usually done via the certification authority's management console (certsrv.msc), but the possibilities for evaluation and especially for machine processing are very limited.

Requesting a certificate fails with the error message "A certification chain processed correctly, but one of the CA certificates is not trusted by the policy provider. 0x800b0112 (-2146762478 CERT_E_UNTRUSTEDCA)".

Here's the scenario:

A user applies for a certificate from an Active Directory integrated certification authority (Enterprise Certification Authority).
The certificate of the certification authority is trusted, i.e. it is located in the Trusted Root Certification Authorities store.
The certificate request fails with the following error message:

A certification chain processed correctly, but one of the CA certificates is not trusted by the policy provider. 0x800b0112 (-2146762478 CERT_E_UNTRUSTEDCA)

Required Windows security permissions for the Network Device Enrollment Service (NDES)

Assuming one implements Microsoft's Active Directory Administrative Tiering Model, or applies similar hardening measures to one's servers, this will have an impact on NDES components.

Requesting a certificate fails with the error message "The requested operation cannot be completed. The computer must be trusted for delegation and the current user account must be configured to allow delegation. 0x80090345 (-2146892987 SEC_E_DELEGATION_REQUIRED).". When importing PFX files, the private key is missing.

Here's the scenario:

The import of a PFX file seems to be successful, but afterwards the private key is missing. A check with certutil ends with the error message "Missing stored keyset".
Requesting a certificate on a client fails with the following error message:

The requested operation cannot be completed. The computer must be trusted for delegation and the current user account must be configured to allow delegation. 0x80090345 (-2146892987 SEC_E_DELEGATION_REQUIRED).

Requesting a certificate for domain controller fails with error message "The RPC server is unavailable. 0x800706ba (WIN32: 1722 RPC_SERVER_UNAVAILABLE)".

Here's the scenario:

Requesting a certificate for a domain controller fails.
On the certification authority, the certificate request is logged in the failed requests. The error message reads:

The RPC server is unavailable. 0x800706ba (WIN32: 1722 RPC_SERVER_UNAVAILABLE)