Performing a functional test for a certification authority

Author Uwe Gradenegger Posted on Categories Certification Authority, Functional test Tags Certificate enrollment, Certificate revocation list (CRL), Certificate template, Event Viewer, certutil, Cache

After installing a certification authority, after migrating to a new server, or after more extensive maintenance work, an extensive functional test should be performed to ensure that all components of the certification authority are working as desired.

Performing a functional test

Do you know TameMyCerts? TameMyCerts is an add-on for the Microsoft certification authority (Active Directory Certificate Services). It extends the function of the certification authority and enables the application of rule sets to realize the secure automation of certificate issuance. TameMyCerts is unique in the Microsoft ecosystem, has already proven itself in countless companies around the world and is available under a free license. It can be downloaded via GitHub and used free of charge. Professional maintenance is also offered.

A functional test of the certification authority includes the following steps:

  • Verification of the connection to the private key
  • Ensure start of the certification authority service
  • Checking the Event Viewer of the certification authority
  • Test the connection to the enrollment interface of the certification authority
  • Generate and verify the certification authority exchange certificate
  • Publish a certificate template on the certification authority
  • Request a certificate from the certification authority
  • Revoke a certificate
  • Publish a certificate revocation list
  • Recheck the certificate

Details: Verification of the connection to the private key

In particular, if a hardware security module is used, the first thing to check is whether the connection to it works and the private key material can be used by the certification authority. The procedure for this is described in the article "Checking the connection to the private key of a certificate (e.g. when using a hardware security module) ".

Details: Ensure the start of the certification authority service

Next, check that the certification authority service starts correctly.

If you encounter problems with this step, the following articles may be helpful:

Details: Checking the Event Viewer of the certification authority

For information on the individual events, see the article "Overview of Windows events generated by the certification authority ".

First, the Windows Event Viewer on the certification authority should be scanned for any certification authority events that could indicate an error. For this purpose, there is a predefined view in Event Viewer under "Custom Views" - "Server Roles" - "Active Directory Certificate Services", which has already defined the required filters on Event Viewer.

If you encounter problems with this step, the following articles may be helpful:

Details: Testing the connection to the enrollment interface of the certification authority

First, a simple test should be performed to see if clients can connect to the certification authority. This can be achieved with the following command line command:

certutil -config {ConfigString} -ping

The ConfigString denotes the connection information to the certification authority in the format "{Servername}\{Common-Name}".

If you encounter problems with this step, the following articles may be helpful:

Details: Generate and verify the certification authority exchange certificate

To ensure that the certification authority writes the CRL distribution points (CDP), the Authority Information Access (AIA) information, and certificate policies to the issued certificates, a certificate is required, the contents of which are then verified.

The subsequent check can in principle be performed with any certificate issued by the certification authority. However, the certification authority exchange certificate is a good choice because it is automatically generated by the certification authority and can be requested by any user in Active Directory. Thus, at this point, the need for the potentially cumbersome creation of a certificate request is eliminated for the time being.

The certificate for the certification authority exchange can be generated with the following command line command:

certutil -cainfo xchg > test.cer

The command can be executed directly on the certification authority as listed above. For an Active Directory integrated certification authority, it can also be executed by another domain member if the -config switch is included with the config string (Servername\Common-Name) as an argument.

If you encounter problems with this step, the following articles may be helpful:

The certificate created with the command can now be inspected by double-clicking on it.

The following contents of the certificate must be verified:

  • CRL distribution points
  • Authority Information Access
  • Certificate policies

The addresses specified in the certificate for CRL distribution points (CDP) and Authority Information Access (AIA) can then be checked using the following command line command:

certutil -verify -urlfetch {Dateiname}.cer

The -urlfetch switch bypasses local caching, and results in command line output instead of a graphical interface. For more information, see the article "View and clear the revocation list address cache (CRL URL Cache). ".

Due to the extensive output, it is recommended to redirect the command line output to a text file.

The command line output contains the respective check result for all addresses of all certificates in the chain. These should all have been checked successfully. Errors are output with a detailed error code describing the cause.

At the end of the command line output are the check results for certificate policy, revocation status and trust status (only in case of error).

Details: Publish a certificate template on the certification authority

In order to check the certification authority's permissions on its pKIEnrollmentService object, and then to be able to request a certificate, a certificate template should now be published on the certification authority.

If you encounter problems with this step, the following articles may be helpful:

Details: Request a certificate from the certification authority

To verify that the certificate enrollment policies are configured correctly and that the certification authority can sign certificate requests, a certificate should now be requested from the previously published certificate template.

If the certification authority is in maintenance mode as described in the article "Putting an Active Directory integrated certification authority (Enterprise Certification Authority) into maintenance mode ", the requesting user or computer object must temporarily be explicitly granted the "Request Certificates" right in the certification authority's security settings until maintenance mode is exited again.

If you encounter problems with this step, the following articles may be helpful:

Details: Revoke a certificate

In order to verify that the revocation of a certificate is correctly recognized by all participants in the network, the previously requested certificate should now be revoked. The procedure for revoking a certificate is described in the article "Revoking an issued certificate ".

Details: Issue a certificate revocation list

After the certificate has been revoked, the creation of a certificate revocation list can now be tested. The procedure for issuing a certificate revocation list is described in the article "Create and publish a certificate revocation list ".

The certificate revocation list should now be created and the serial number of the revoked certificate should be found on it again.

If you encounter problems with this step, the following articles may be helpful:

Details: Recheck the certificate

The revoked certificate should now be on the revocation list and should be recognized as revoked by the subscribers. Therefore, the steps described in the section "Generate and verify the certification authority exchange certificate" should now be performed again to verify the addresses within the certificate.

To be on the safe side, the local cache for the revocation information should be cleared beforehand, as described in the article "View and clear the revocation list address cache (CRL URL Cache). ".

The revocation of the certificate should now be correctly detected and reported.

If an Online Responder is used, it has a server-side cache so that it does not reflect the revocation of the certificate until the previous certificate revocation list has expired.