Posts

With the May 2026 security update, Microsoft has added support for the ML-DSA algorithm in Active Directory Certificate Services.

In their documentation, they do write that NDES is not compatible with ML-DSA :

You can enroll ML-DSA certificates through the Certificates Microsoft Management Console (MMC) snap-in and certreq.exe. Enrollment through the Network Device Enrollment Service (NDES) isn't currently available.

But that's not entirely true…

Assume the following scenario:

• A web server certificate was generated using an ML-DSA-based key pair.
• We would like to bind it to Internet Information Services (IIS).
• The configuration fails with the following error message:

There was an error while performing this operation.

Details: 

A specified logon session does not exist. It may already have been terminated. (Exception from HRESULT: 0x80070520)

Assume the following scenario:

• You try to request certificates using the ML-DSA algorithm.
• The request fails with the following error message:

The parameter is incorrect. 0x80070057 (WIN32: 87 ERROR_INVALID_PARAMETER)

The Simple Certificate Enrollment Protocol (SCEP) is an ancient protocol from the early 2000s. It does not use Transport Layer Security (TLS). Therefore, the protocol messages are encrypted at the transport layer.

When sending the certificate request to the NDES server, the client will encrypt the certificate request with the NDES server's CEP Encryption certificate (which was previously communicated to it via the GetCACert message).

When the issued certificate is received, the NDES server will encrypt the response with a self-signed certificate temporarily created by the SCEP client.

In both cases, a symmetric encryption algorithm is used.

I often hear that PKI operators would like to see a new certificate revocation list issued immediately for revoked certificates.

Below, I would like to share some thoughts on why this approach is not ideal and propose a more elegant solution.

If you want to request or renew certificates on a Windows client using the Microsoft Management Console (MMC), you have several options—all of which achieve the same result but behave differently. Below, we’ll discuss the differences.

Dirk-jan Mollema recently presented an attack that can be used to obtain a certificate for highly privileged accounts via Intune . This can then be used to compromise the entire Active Directory environment.

The attack is similar in its basic features to what I have already described in the article "From Zero to Enterprise Administrator through Network Device Enrollment Service (NDES) - and What to Do About It " and in the article "Attack vector on Active Directory directory service via smart card logon mechanism " (generally also known as ESC1 ).

What is new, however, is to utilize the Mobile Device Management (MDM) system - in this case Microsoft Intune - accordingly.

What is not new, however, is what can be done with the TameMyCerts Policy Module for Active Directory Certificate Services to drastically reduce the attack surface...

After several postponements, Microsoft finally decided that the Changes to Certificate Issuance and Certificate-Based Logon to Active Directory with the May 10, 2022 Patch for Windows Server (KB5014754) should now finally come into force.

Domain controllers will therefore automatically switch to full enforcement mode on February 25, 2025, unless configured otherwise. As of September 2025, it has been announced that deviating settings will no longer apply and there will therefore no longer be an alternative to full enforcement.

The consequence of this is that certificates can only be used for logon via PKInit if they have the new Security Identifier (SID) certificate extension introduced with the patch.

What at first sounds as if this is not a major problem may well become one when you consider that fewer and fewer certificate-based use cases are using classic autoenrollment these days.

How the TameMyCerts Policy Module for the Active Directory Certificate Services can help with this problem is explained in more detail in the following article.

With existing public key infrastructures, you may find that the validity period of the root certification authority certificate has not proven itself. For example, it could be that it was chosen too short (the default setting of Microsoft AD CS is only five years), or even too long, which may not be optimal from a security perspective.

If you renew the certification authority certificate, you may want to achieve a different validity period.

During penetration tests and also for attackers searching the network for potential targets, insights into the configuration of the certification authority are highly interesting.

In addition to possible misconfigurations, attackers can obtain information about the policy module used on the certification authority.

Since the recently released version 1.7, the TameMyCerts Policy Module for Microsoft Active Directory Certificate Services supports Personal Identity Verification (PIV) attestation for YubiKeys.

This cool function was developed by Oscar Virot and integrated into TameMyCerts. This makes it possible to provide cryptographic proof when issuing certificates and thus ensure that a key pair is actually generated with a YubiKey and secured by it and cannot be exported.

This can be particularly helpful in complying with the NIS2 directive if companies decide to use certificates as a second factor for logon with security-critical accounts in Active Directory.

Someone recently approached me with an interesting problem.

A certification authority has been installed. Linux is used as the basis, i.e. (presumably) OpenSSL. The revocation lists work on Linux clients, but are not accepted by Windows systems. The following error message always appears when checking the revocation lists.

0x80092013 (-2146885613 CRYPT_E_REVOCATION_OFFLINE) -- 2148081683 (-2146885613)
Text der Fehlermeldung: Die Sperrfunktion konnte die Sperrung nicht überprüfen, da der Sperrserver offline war.

The error message reads as follows:

0x80092013 (-2146885613 CRYPT_E_REVOCATION_OFFLINE) -- 2148081683 (-2146885613)
The revocation function was unable to check revocation because the revocation server was offline.

Assume the following scenario:

• The company would like to use smart card logon.
• The domain controllers are equipped with certificates that can be used for smart card logon .
• The users are equipped with certificates that can be used for smart card logon.
• Logon to the domain via smart card fails with the following error message:

A certification chain processed correctly, but one of the CA certificates is not trusted by the policy provider. 0x800b0112 (-2146762478 CERT_E_UNTRUSTEDCA)

Like any software Microsoft Active Directory Certificate Services are also subject to certain limits imposed by their design.

What is not so obvious is the question of how many subject alternative names (SAN) can be issued with the Microsoft certification authority.

The IETF RFC 5280 describes the structure for Subject Alternative Names as follows:

SubjectAltName ::= GeneralNames

Nowadays, it is essential to protect the authentication of devices on the company network and administrative interfaces. As a rule, digital certificates are used for this purpose.

Printers therefore also generally require digital certificates in order to be operated securely. From a certain number of devices, there is no getting around automatic certificate distribution.

Some printer manufacturers offer centralized management solutions for certificate distribution.

Unfortunately, it has been shown time and again that the secure handling of digital certificates requires a great deal of knowledge, experience and care, which is often not the case.

The purposes for which a digital certificate may be used are controlled via the "Key Usage" and "Extended Key Usage" certificate extensions. The "Extended Key Usage" certificate extension contains the extended key usages for which the certificate may be used.

However, certificates issued by a Microsoft certification authority contain another certificate extension called "Application Policies", which also contains a list very similar to the Extended Key Usages extension.

Justin Bollinger from TrustedSec has found out that with offline certificate requests against schema version 1 certificate templates it is possible (similar to the Security Identifier extension ) to include arbitrary Application Policies in the certificate request, which are transferred unchanged to the issued certificate and can then be used to attack the Active Directory forest. The attack was named ESC15.

Starting with version 58, Google has decided to remove support for the Subject Distinguished Name of web server certificates in the Chrome browser and instead only accept certificates with Subject Alternative Name.

Since then, web server certificates without a Subject Alternative Name in the form of a dNSName have been rejected by Google Chrome and other Chromium -based browsers (i.e. also Microsoft Edge ). Other browser manufacturers quickly adopted this approach, so that this problem now affects all popular browsers.

Attacks on Microsoft certification authorities can be aimed at exploiting permissions on certificate templates. In many cases, certificate templates must be configured to grant the enrollee the right to request arbitrary identities. This can lead to the attacker taking over the identities of Active Directory accounts and subsequently to privilege escalation. Attacks of this type are known in the security scene as "ESC1 ".

Companies use Mobile Device Management (MDM) products for managing, configuring and updating mobile devices such as smartphones, tablet computers or desktop systems via the Internet (over-the-air, OTA).

Common mobile device management products are:

• Microsoft Intune
• VMware Workspace One (previously known under the brand name AirWatch)
• Ivanti MobileIron UEM
• Jamf Pro
• Baramundi Enterprise Mobility Management
• BlackBerry Enterprise Mobility Suite
• Sophos Mobile Control
• SOTI MobiControl
• Samsung Knox
• IBM MaaS360

Nowadays, many companies want to rely on paperless processes to speed up internal approval and signature processes. In times when most employees are working from home, this has become even more important.

Although the Microsoft certification authority is able to implement automatic certificate issuance processes, its ability to influence the content of the certificate is severely limited .

The TameMyCerts Policy Module for Microsoft Active Directory Certificate Services (AD CS) allows the definition of extended rules for the Subject Distinguished Name and also the Subject Alternative Name of issued certificates.

With the supposedly good intention of making it possible to issue such certificate requests with a SAN, unfortunately far too many guides advise enabling the EDITF_ATTRIBUTESUBJECTALTNAME2 flag on the certification authority.

If this flag is enabled, a very large attack surface is offered, as any enrollee can now instruct the certification authority to issue certificates with any content. This type of attack is known in the security scene as ESC6 and ESC7 .

With the Chromium project and products based on it such as Google Chrome and Microsoft Edge, Google has moved to enforce RFC 2818 , adopted in 2000, and to no longer trust certificates that no longer fulfill this requirement.

For us, the following sentence is of great significance:

If a subjectAltName extension of type dNSName is present, that MUST be used as the identity. Otherwise, the (most specific) Common Name field in the Subject field of the certificate MUST be used. Although the use of the Common Name is existing practice, it is deprecated and Certification Authorities are encouraged to use the dNSName instead

— https://tools.ietf.org/html/rfc2818

On the internet, there are unfortunately far too many instructions (the big players are not excluded from this , not even Microsoft itself or the grandmaster Komar ), which fatally recommend that the flag EDITF_ATTRIBUTESUBJECTALTNAME2 should be set on the certification authority - supposedly to be able to issue certificates with Subject Alternative Name (SAN) extension for manually submitted certificate requests.

Unfortunately, this procedure is not only unnecessary, it also has some unpleasant side effects, which in the worst case can help an attacker to take over the entire Active Directory forest .

Certificate revocation lists (CRLs) are used to remove issued certificates from circulation before the end of their validity period.

A CRL is a signed list of the serial numbers of certificates that have been revoked by the certification authority. The CRL has an expiration date (usually only a few days ahead) and is reissued and signed by the associated certification authority at regular intervals.

Certificate revocation lists can reach a considerable size if the volume of revoked certificates is high (as a rule of thumb, you can expect about 5 megabytes per 100,000 entries). The regular download of large certificate revocation lists by subscribers can generate a large network load. To address this problem, there is the concept of delta CRLs.

Understanding the roles involved is essential for designing a public key infrastructure.

The term "public key infrastructure" encompasses much more than the technical components and is often used in a misleading way.

In summary, a public key infrastructure is both an authentication technology and the totality of all the components involved.

There are many instructions for setting up and commissioning IT services. However, the associated instructions for decommissioning are usually forgotten.

The following describes how to correctly decommission a certification authority integrated into Active Directory (Enterprise Certification Authority).

When creating a backup of a certification authority , the question may arise as to how to ensure the integrity of the certification authority database backup, so that it can be correctly restored in an emergency.

The certification authority database is based on a Microsoft JET Blue database engine (also known as Extensible Storage Engine, ESE ). Its working and backup files have the extension .edb and can be managed with the operating system tool esentutl .

To use the Online Certificate Status Protocol (OCSP), it is necessary to configure an appropriate certificate template.

Assume the following scenario:

• The certificates were transferred to the smartphone via the Intune Connector .
• Reading encrypted messages works.
• However, when enabling encryption for outgoing messages, the following error message is displayed:

There's a problem with one of your S/MIME encryption certificates. Contact your IT help desk for more info.

Es gibt ein Problem mit einem ihrer S/MIME-Verschlüsselungszertifikate. Wenden Sie sich für weitere Informationen an Ihren IT-Helpdesk.

Assume the following scenario:

• A certificate-based logon is performed with user or computer accounts to log them on to a wireless (IEEE 802.11 or Wireless LAN) or wired network (IEEE 802.3), or to a remote access connection (e.g. DirectAccess, Routing and Remote Access (RAS), Always on VPN ).
• As a server for authentication, authorization and accounting (AAA), the company uses the Network Policy Server (NPS) from Microsoft.
• Logging on to the network is no longer possible.
• The Network Policy Server logs the following event when a logon attempt is made:

Network Policy Server denied access to a user. [...] Authentication failed due to a user credentials mismatch. Either the user name provided does not map to an existing user account or the password was incorrect.

Der Netzwerkrichtlinienserver hat einem Benutzer den Zugriff verweigert. [...] Authentifizierungsfehler aufgrund der Nichtübereinstimmung von Benutzeranmeldeinformationen. Der angegebene Benutzername ist keinem vorhandenen Benutzerkonto zugeordnet, oder das Kennwort war falsch.

Assume the following scenario:

• A Network Device Enrollment Service (NDES) is to be implemented in the network.
• Only read-only domain controllers (RODC) are located at the Active Directory site of the NDES server.
• NDES role configuration fails with the following error message:

Failed to add the following certificate templates to the enterprise Active Directory Certificate Service or update security settings on those templates:
EnrollmentAgentOffline 
CEPEncryption
IPSEC(Offline request)
A referral was returned from the server. 0x8007202b (WIN32:8235 ERROR_DS_REFERRAL)

For the encryption of email messages, companies typically use the Secure / Multipurpose Internet Message Extensions (S/MIME) standard and provide their users with appropriate certificates for this purpose.

An important aspect here is that the users' private keys should be secured centrally - in contrast to the signing certificates that are otherwise mostly used. Incoming messages are encrypted for a specific private key and can only be decrypted again by this key . Thus a backup of these keys must absolutely be available - this is also indispensable for synchronization to mobile devices . For this purpose, the Microsoft Active Directory Certificate Services offer the private key archival function.

But what if private key archival has not been set up and users have already requested corresponding certificates?

In a networked world, it has become standard to work from anywhere, and also to work with mobile end devices such as smartphones or tablets in addition to classic desktop computers. Such end devices are usually managed by Mobile Device Management (MDM) systems such as Microsoft Intune.

In most cases, users of mobile devices need digital certificates to prove their identity in order to gain access to corporate resources. Thus, it is necessary to provide these devices with an automatable yet secure interface for requesting these certificates.

In a modern networked world, the confidential transmission of messages in the corporate environment is essential for business success. Despite its age , it is still impossible to imagine modern corporate communications without e-mail. However, its use has changed significantly over the decades.

Nowadays, it is common to be able to read and write business e-mails on mobile devices such as smartphones and tablets. Such end devices are usually managed with Mobile Device Management (MDM) systems such as Microsoft Intune.

To encrypt e-mail messages, companies typically use the Secure / Multipurpose Internet Message Extensions (S/MIME) standard and provide their users with the corresponding certificates. How do these certificates get to the end devices of the users in a scalable way?

In the article "Signing certificates bypassing the certification authority " I described how an attacker with administrative rights on the certification authority can generate a logon certificate for administrative accounts of the domain by bypassing the certification authority software, i.e. by directly using the private key of the certification authority.

In the previous article I used the PSCertificateEnrollment Powershell Module to demonstrate the procedure. However, with certreq and certutil Microsoft already ships perfectly suitable pentesting tools directly with the operating system ex works.

Assume the following scenario:

• A certificate is requested through the Network Device Enrollment Service (NDES).
• Renewal mode is used here, i.e. the certificate request is signed with an existing certificate.
• The request for the new certificate fails with the following error message:

A certification chain processed correctly, but one of the CA
certificates is not trusted by the policy provider. 0x800b0112 (-2146762478 CERT_E_UNTRUSTEDCA)

Assume the following scenario:

• A new certification authority certificate is requested for a subordinate certification authority and issued by the parent certification authority.
• The Subject Distinguished Name (Subject DN) is identical to that of the previous certification authority certificate.
• However, the installation of the certification authority certificate fails with the following error message:

An error was detected while configuring Active Directory Certificate Services.
The Active Directory Certificate Services Setup Wizard will need to be rerun to complete the configuration.
The new certificate subject name does not exactly match the active CA name.
Renew with a new key to allow minor subject name changes: The parameter is incorrect. 0x80070057 (WIN32: 87 ERROR_INVALID_PARAMETER).

Usually, the encoding of characters and strings in certificates is not a topic of great interest to the users of a PKI. However, there are cases where the default settings of the certification authority do not provide the desired results.

As computing power becomes increasingly available, the need to use stronger cryptographic keys also increases. In this course, there is often a need (for example, because the keys have to be protected by a Trusted Platform Module) to use keys based on elliptic curves (ECC) . For their use, it is essential that compatibility with the intended use cases is ensured.

Below is a list of use cases for which I know the compatibility.

The Network Device Enrollment Service (NDES), because it implements the web-based Simple Certificate Enrollment Protocol (SCEP), is mapped as a web application in Microsoft Internet Information Service (IIS). Here, the service runs in an application pool called "SCEP". In many cases it is sufficient to use the integrated application pool identity for it .

However, there are cases where you want to use a domain account. An example of this is the Certificate Connector for Microsoft Intune, which requires this.

Assume the following scenario:

• An NDES server has been set up for use with Microsoft Intune.
• The configuration of the Intune Certificate Connector cannot be completed because the following error message is thrown:

Fehler bei der Microsoft Intune Certificate Connector Konfiguration. Es wurden keine Änderungen an Feature- oder Proxyeinstellungen vorgenommen.
Unerwarteter Fehler: System.ArgumentException: Die Zeichenfolge kann keine Länge von 0 (null) haben.
Parametername: name
  bei System.Security.Principal.NTAccount.ctor(String name)

Assume the following scenario:

• The company is using Windows Hello for Business.
• Users receive the following error message when logging on to the client:

Sign-in failed. Contact your system administrator and tell them that the KDC certificate could not be validated. Additional information may be available in the system event log.

As the operator of a certification authority, you are (among other things) responsible for the identification of the enrollees and the confirmation of the requested identities . The fact that this task is carried out conscientiously and without error is the central pillar of the trust placed in the certification authority. Well-known companies have already failed at this task , even had to file for insolvency as a result of misissuances and/or were severely punished by the big players in the market.

In many cases, we as (Microsoft) PKI operators in companies (regardless of the associated quality) are able to delegate our task of uniquely identifying an enrollee to the Active Directory. In many cases, however, we unfortunately also have to instruct our certification authority(ies) to simply issue everything that is requested.

Assume the following scenario:

• A certification authority uses a hardware security module (HSM) .
• The partition of the hardware security module fills up with more and more keys over the lifetime of the certification authority.
• With SafeNet hardware security modules, this can even cause the partition to run full. As a result, the events 86 and 88 are logged by the certification authority.

The Active Directory Certificate Services offer a number of web-based add-on interfaces (Network Device Enrollment Service (NDES) , Certificate Enrollment Policy Web Service (CEP) , Certificate Enrollment Web Service (CES) , Certification Authority Web Enrollment (CAWE) .

The Microsoft Internet Information Services (IIS) are thus almost indispensable for a Microsoft PKI. Each of the web-based interfaces (and also in-house developments) bring their own unique challenges in terms of authentication procedures and their implementation.

The following article should bring a little clarity to the topic.

If the Network Device Enrollment Service (NDES) is newly installed (preferably without Enterprise Administrator permissions ), only the Windows-integrated authentication for the administration web page is activated at first. With this (via NT LAN Manager, NTLM) protocol, authentication via user name and password is also possible. However, not all client applications support this.

Likewise, a company might want to disable NTLM where possible and enforce Kerberos for logon . Enforcing Kerberos removes the ability to log on to the Network Device Enrollment Service administration page via username and password (since this is done with NTLM credentials). However, Basic Authentication can be retrofitted to provide an option here again.

One way out of this dilemma can be Basic Authentication, the setup of which will be explained below.

Many companies pursue the strategy of (largely) disabling the NT LAN Manager (NTLM) authentication protocol in their networks.

This is also possible for the administration web page of the Network Device Enrollment Service (NDES). How exactly this is implemented and how this may change the application behavior is explained below.

With the May 10, 2022 patch, Microsoft is attempting to close a vulnerability in Active Directory that affects certificate-based logon (commonly known as PKINIT or also smart card logon ).

The update changes both the behavior of the certification authority as well as the behavior of Active Directory when processing certificate-based logons.

If one installs a Network Device Enrollment Service (NDES), one is faced with the question under which identity the IIS application pool should be operated. In the following, the individual options are examined in more detail in order to facilitate a selection.

When configuring a certificate template, one must decide on the intended certificate content, i.e., among other things, which identities are confirmed by the certificates and how they are mapped.

In the "Subject Name" tab of the certificate template configuration dialog, you can configure how the identity confirmed by the certificate is mapped.

Assume the following scenario:

• With certutil a verification of the domain controller certificates is performed.
• The operation fails with the following error message:

0: DC01

*** Testing DC[0]: DC01
Enterprise Root store: Access is denied. 0x80070005 (WIN32: 5 ERROR_ACCESS_DENIED)
KDC certificates: Access is denied. 0x80070005 (WIN32: 5 ERROR_ACCESS_DENIED)

CertUtil: -DCInfo command FAILED: 0x80070005 (WIN32: 5 ERROR_ACCESS_DENIED)
CertUtil: Access is denied.

The ACME protocol was designed by the operators of the Let's Encrypt project to automate the issuance of web server certificates . It is specified in RFC 8555 .

The goal is to automate the process of proving ownership of the DNS resource (IP addresses cannot currently be identified, but this is planned in the future), but not of the person or organization behind it, in order to subsequently be able to obtain a web server certificate without human interaction.

Name constraints are part of the X.509 standard and are described in RFC 5280 . They are a tool that can be used as part of qualified subordination to control the scope of a certification authority certificate in a fine-grained manner.

At the turn of the year, a note to all operators of a Microsoft certification authority and connected services:

The end of Microsoft product support for Windows Server 2012 and 2012 R2 is slowly approaching: it is October 10, 2023.

Thus, it is time to prepare for the move to a new operating system.

Assume the following scenario:

• A certificate template is configured to use keys based on elliptic curves .
• In addition, the certificate template is configured to use the Microsoft Platform Crypto Provider to protect the private key with the Trusted Platform Module (TPM) of the device.
• The certificate request fails with the following error message:

Error: The requested operation is not supported. 0x80090029 (-2146893783 NTE_NOT_SUPPORTED)

With Windows Vista and Windows Server 2008, the Cryptography API: Next Generation (CNG) was introduced into the Windows systems.

This term refers to a collection of modern cryptographic functions. Among other things, the CNG enables the use of certificates that use keys based on elliptic curves (also called Elliptic Curve Cryptography, ECC) with the Microsoft Certification Authority and the Windows operating system.

Assume the following scenario:

• A user sends an e-mail message signed with Secure/Multipurpose Internet Mail Extensions (S/MIME).
• The sender uses Microsoft Outlook for Macintosh.
• The receiving mail server rejects the message and sends back a Non-Delivery Report (NDR):

550 5.6.0 M2MCVT.StorageError.Exception: ConversionFailedException - , Content conversion: Invalid S/MIME encrypted message.; storage error in content conversion.

I recently encountered the phenomenon that due to a faulty request logic, several users had made new certificate requests at regular intervals.

The certificate template was configured to have incoming certificate requests approved by a certificate manager, i.e., certificates were not issued automatically. Certificate requests were to be checked using a separate code and then approved.

One would now expect that (since all certificate requests would eventually be approved) users would now find multiple certificates of the same type in their certificate store (and the applications that use it). However, this was not the case.

Assume the following scenario:

• A new certificate template is to be created.
• The creation fails with the following error message:

The following template name has already been used: ADCSLaborBenutzerTest. Enter a unique template name.

If a certification authority is installed, the "Windows Default" exit module is automatically activated. This enables e-mail messages to be sent when certain events occur at the certification authority. However, most companies do not use this feature at all.

However, even if the exit module is not used at all, it causes sessions on the certification authority database (see Event no. 46 ). On certification authorities with high load this can be problematic .

If the functions it offers are not used at all (the "Windows Default" exit module never works on Windows Server Core ), it can also be disabled completely.

Today went through many Media that some apps and components in the recently released Windows 11 no longer work since 01.11.2021 and that the cause for this is a certificate that expired on 31.10.2021. In the meantime Microsoft has pointed out in a blog post and also published a patch for some affected components .

Unfortunately, none of the available sources provided detailed information about what exactly the problem was. So let's get to the bottom of this ourselves.

If you want to formulate queries against the certification authority database , you must first know what you want to look for.

There is a possibility to output the database schema of the certification authority database.

Active Directory Certificate Services have existed (albeit under a different name) in their basic form since Windows NT 4.0. The Active Directory-based architecture used today was introduced with Windows 2000 Server. AD CS is very well integrated into the Windows ecosystem and continues to enjoy great popularity worldwide in companies and government agencies of all sizes.

People like to point out the many possibilities offered by Active Directory Certificate Services. Rarely, however, is it pointed out what is not possible with them. In fact, the product has by now reached its limits in many places.

What these are will be explained in more detail below in order to better decide whether AD CS can be the right solution for planned projects.

Assume the following scenario:

• A manually requested Remote Desktop certificate is to be assigned to the Remote Desktop session host on a computer.
• The operation fails with the following error message:

Set-WMIInstance : Invalid parameter
 At line:1 char:1
 Set-WMIInstance -path $TerminalServicesConfig.__path -argument @{SSLC …
 ~~~~~~~~~~~~~~~~~ CategoryInfo          : InvalidOperation: (:) [Set-WmiInstance], ManagementException
 FullyQualifiedErrorId : SetWMIManagementException,Microsoft.PowerShell.Commands.SetWmiInstance 

Assume the following scenario:

• A certification authority is migrated to another server or restored from backup .
• A Thales (nCipher) hardware security module (HSM) is used to protect the private key of the certification authority certificate. Security World is configured with Operator Card Set (OCS) Protection.
• The certification authority certificate was successfully restored and associated with the private key stored on the HSM .
• When installing the certification authority role, the restored certification authority certificate cannot be selected.

Assume the following scenario:

• A new certification authority is installed.
• After configuring the certification authority role and issuing the certification authority certificate, it should now be installed on the certification authority.
• A hardware security module (HSM) is used to protect the private key of the certification authority certificate.
• The installation of the certification authority certificate fails with the following error message:

An error was detected while configuring Active Directory Certificate Services.
The Active Directory Certificate Services Setup Wizard will need to be rerun to complete the configuration.
The new certificate public key does not match the current outstanding request.
The wrong request may have been used to generate the new certificate:  Object was not found. 0x80090011 (-2146893807 NTE_NOT_FOUND)

Assume the following scenario:

• A certification authority is migrated to another server or restored from backup .
• A hardware security module (HSM) is used to protect the private key of the certification authority certificate.
• The certification authority certificate is now to be restored on the target system and linked to the private key .
• The operation fails with the following error message:

Cannot find the certificate and private key for decryption.
CertUtil: -repairstore command FAILED: 0x80092004 (-2146885628 CRYPT_E_NOT_FOUND)
CertUtil: Cannot find object or property.

Assume the following scenario:

• For the first time, a certification authority (Enterprise Certification Authority) integrated into Active Directory is to be installed in the network.
• The rights to install the certification authority have been delegated to a separate security group or account for security reasons, so no logon as Enterprise Administrator is required. Put another way: The user used is not a member of the Enterprise Administrators group in the Active Directory forest.
• Since this is the first certification authority in the network, no default certificate templates are installed in Active Directory yet. When opening the certificate template management console (certtmpl.msc), one is prompted to install them.
• The installation fails with the following error message:

Windows could not install the new certificate templates. This security ID may not be assigned as the owner of this object.

Assume the following scenario:

• An Appx package is to be signed.
• For this purpose, SignTool.exe is used.
• The code signing certificate used was recently renewed.
• The signing process with the new code signing certificate fails with the following error message:

"Error: SignerSign() failed." (-2147024885/0x8007000b) 

Sometimes it is necessary to issue certificates with a shorter validity period than configured in the certificate template. Therefore, you may not want to reconfigure the certificate template right away or create another certificate template.

Some will have noticed that the certificate store for intermediate CAs usually also contains certificates for root CAs.

As a rule, this behavior is not critical. In certain cases however, this can also cause problems with applications.

Certificate extensions were introduced with version 3 of the X.509 standard. The Key Usage extension is an optional certificate extension that is defined in RFC 5280 and is used to limit the permitted uses of a key.

Assume the following scenario:

• A user's computer is stolen or infected with malware.
• The integrity of certificates located on the computer can no longer be guaranteed.
• The certificates of the user(s) that were requested on this computer must be revoked.
• However, one would like to avoid revoking all certificates of a user.
• Thus, a connection must be established between the user's certificates and the computer on which they were requested.

If the certificates were requested via autoenrollment , we can take advantage of the fact that a corresponding attribute was part of the original certificate request, and that the certificate request is stored in the certification authority database along with the certificate.

Assume the following scenario:

• You want to establish a remote desktop connection.
• The client computer from which the connection is made is not a member of the same Active Directory forest as the target computer.
• The connection fails with the following error message:

A user account restriction (for example, a time-of-day restriction) is preventing you from logging on. For assistance, contact your system administrator or technical support.

Assume the following scenario:

• An NDES server is configured on the network.
• When calling the NDES administration web page (certsrv/mscep_admin), logon is not possible.
• After several unsuccessful logon attempts, the following HTTP error message is returned:

401 - Unauthorized: Access is denied due to invalid credentials.
You do not have permission to view this directory or page using the credentials that you supplied.

Recently, together with B-I-T GmbH Informationen und Prozesse from Hanover, I worked on implementing the electronic data exchange with the statutory health insurance funds and the pension insurance from within an application.

Here, a combination of authenticated data transmission of both signed and encrypted messages is used. PKI technologies are used in all these cases.

If you restore a certification authority from a backup after a disaster has occurred , you will probably find that certificates were issued in the period between the last backup and the system failure with corresponding data loss.

These certificates are now not stored in the restored certification authority database, so they cannot be restored if needed.

If you are using the SMTP Exit Module, you can at least determine the serial numbers of the certificates from the sent e-mails and revoke them.

The following is an overview of the events in the Windows Event Viewer generated by the Remote Desktop Session Host that are relevant to the public key infrastructure.

With the introduction of version 2 certificate templates along with Windows XP and Windows Server 2003, the option was introduced for a certificate template to replace one or more others.

This makes it possible to replace issued certificates with those of another certificate template, or to consolidate multiple certificate templates into a single one.

Since Windows NT 4.0, Cryptographic Service Providers (CSP) have been part of the CryptoAPI.

The idea is that an application does not have to worry about the specific implementation of key management, but can leave this to generic operating system interfaces. This also prevents cryptographic keys from being loaded into the working memory in the security context of the user/application used (a fatal security incident based precisely on this problem was the Heartbleed incident ).

For example, it makes no technical difference to the certification authority software how its private key is protected - whether in software or with a hardware security module (HSM), for example. The call of the private key is always identical for the certification authority.

With Windows Vista and the introduction of Cryptography Next Generation (CNG) as a replacement for CryptoAPI, Key Storage Providers (KSP) were introduced.

Assume the following scenario:

• Machines are configured by Group Policy to request certificates for the Remote Desktop Session Host .
• However, the certificates are not requested.
• In the event log of the affected system, the event with ID 1064 of the source Terminalservices-RemoteConnectionManager is logged:

The RD Session Host server cannot install a new template-based certificate to be used for Transport Layer Security (TLS) 1.0\Secure Sockets Layer (SSL) authentication and encryption. The following error occurred: The permissions on the certificate template do not allow the current user to enroll for this type of certificate.

Assume the following scenario:

• Machines are configured by Group Policy to request certificates for the Remote Desktop Session Host .
• However, the certificates are not requested or existing certificates expire without renewal.
• In the event log of the affected system, the event with ID 1064 of the source Terminalservices-RemoteConnectionManager is logged:

The RD Session Host server cannot install a new template-based certificate to be used for Transport Layer Security (TLS) 1.0\Secure Sockets Layer (SSL) authentication and encryption. The following error occurred: The requested certificate template is not supported by this CA.

Assume the following scenario:

• A certification authority hierarchy is established in the network and the root certification authority is mapped in the configuration partition of the Active Directory forest.
• Domain members are configured to run the autoenrollment process to update trusted root certification authorities from the Configuration partition.
• However, this process does not work for some clients. The root CA certificates are not automatically downloaded and entered into the local trust store.
• As a consequence certificate requests can fail because, for example, the certification authority hierarchy is not trusted.

Assume the following scenario:

• An Online Responder (OCSP) is set up in the network.
• The certification authorities report at irregular intervals that certificate requests for the OCSP response signing certificates fail with the following error message:

The revocation function was unable to check revocation for the certificate. 0x80092012 (-2146885614 CRYPT_E_NO_REVOCATION_CHECK).

Assume the following scenario:

• You write a script or an application that should trigger the autoenrollment process for the currently logged-on user.
• You will find out that the scheduled task cannot be executed.
• The error message reads:

The user account does not have permissions to run this task.

The following is an overview of the Windows Event Viewer events generated by Windows certificate clients, their activation, and their identification.

Assume the following scenario:

• A certificate template is configured for automatic certificate request (autoenrollment).
• The certificate template is published on a certification authority (Enterprise Certification Authority) integrated into Active Directory.
• However, the users or computers configured for automatic certificate request do not request certificates as intended.

The following is a troubleshooting guide.

Assume the following scenario:

• A user works remotely via Virtual Private Network (VPN)
• Actually, a certificate should be requested via autoenrollment, but this is not done
• A connection test (certutil -ping) to the certification authority throws the following error message:

Server could not be reached: The RPC server is unavailable. 0x800706ba (WIN32: 1722 RPC_S_SERVER_UNAVAILABLE) -- (31ms)

CertUtil: -ping command FAILED: 0x800706ba (WIN32: 1722 RPC_S_SERVER_UNAVAILABLE)
CertUtil: The RPC server is unavailable.

Assume the following scenario

• A user receives an e-mail message signed with Secure/Multipurpose Internet Mail Extensions (S/MIME).
• The user (the recipient) uses Microsoft Outlook for Windows.
• The sender uses Microsoft Outlook for Macintosh.
• The certificate used to sign the message is valid.
• The e-mail signature is displayed as invalid. Inspection of the signature reveals that no details about the signing certificate can be displayed.

Fehler: Es wurde kein Zertifikat zum Überprüfen der Signatur dieser Nachricht gefunden.
Signiert von (Name des Zertifikatsbetreffs unbekannt) unter Verwendung von RSA/SHA256 um 15:44:59 19.05.2021.

Assume the following scenario:

• A user wants to send a signed e-mail
• The operation fails with the following error message:

Diese Nachricht kann von Microsoft Outlook weder verschlüsselt noch signiert werden, da keine Zertifikate für das Senden von Nachrichten von der E-Mail Adresse "rudi.ratlos@adcslabor.de" vorhanden sind. Fordern Sie entweder eine neue digitale ID für dieses Konto an, oder verwenden Sie die Schaltfläche "Konten", um die Nachricht mithilfe eines Kontos zu senden, für das Sie Zertifikate besitzen.

Assume the following scenario:

• A certification authority is implemented in the network.
• The certification authority service does not start.
• When trying to start the certification authority service, you get the following error message:

Provider DLL failed to initialize correctly. 0x8009001d (-2146893795 NTE_PROVIDER_DLL_FAIL).

The purposes for which a digital certificate may be used are controlled via the certificate extensions "Key Usage" and "Extended Key Usage".

The "Extended Key Usage" certificate extension contains the extended key usages for which the certificate may be used.

However, certificates issued by a Microsoft certification authority contain another certificate extension called "Application Policies", which also contains a list very similar to the Extended Key Usages extension.

Assume the following scenario:

• A certificate template is configured for automatic request and issuance (autoenrollment).
• Users or computers request new certificates at regular intervals and long before the defined renewal period.

Assume the following scenario:

• A certificate template is configured to use elliptic curve based keys (e.g. ECDSA_P256).
• As a result, a minimum key length of 256 bits is configured.
• Nevertheless, certificate requests that use other ECC curves or RSA-based keys are also signed.

One way to perform code signatures is to use the SignTool command line tool. This is part of the Windows 10 Software Development Kit (SDK).

If you want to use the tool on a system without having to install Visual Studio or the Windows SDK, you can proceed as follows.

Below is a description of the options available for executing PowerShell script files, and what is possible by signing them.

Assume the following scenario:

• A certificate is requested from an Active Directory integrated certification authority (Enterprise Certification Authority).
• The request fails with the following error message:

An error occurred while enrolling for a certificate.
The certificate request could not be submitted to the certification authority.
Url: CA02.intra.adcslabor.de\ADCS Labor Issuing CA 1
Error: The request is not supported. 0x80070032 (WIN32: 50 ERROR_NOT_SUPPORTED)

Assume the following scenario:

• A role configuration for the Certificate Enrollment Web Service (CES) is performed.
• The role configuration fails with the following error message:

CCertificateEnrollmenServerSetup::InitializeInstallDefaults: Access is denied. 0x80070005 (WIN32: 5 ERROR_ACCESS_DENIED)

Assume the following scenario:

• A role configuration for the Certificate Enrollment Web Service (CES) is performed.
• The role configuration fails with the following error message:

The Certificate Enrollment Web Service Setup failed because the CA "CA02.intra.adcslabor.de\ADCS Labor Issuing CA 1" cannot  be contacted. Check the name, and confirm that the CA is properly configured and available. The RPC server is unavailable. 0x800706ba (WIN32: 1722 RPC_S_SERVER_UNAVAILABLE)   

Assuming a use case is implemented for certificates where users specify the identity contained in the certificate in the certificate request, and this requires manual intervention by the certificate managers, the question arises as to how to proceed when the certificates expire or the certificate template is moved to another certification authority in order to minimize tickets at the help desk and thus the resulting work for the certificate managers.

Assume the following scenario:

• A user receives an e-mail message encrypted with Secure/Multipurpose Internet Mail Extensions (S/MIME).
• The message cannot be opened.
• When opening the message, the following error message is displayed:

Leider besteht ein Problem beim Öffnen dieses Elements. Dies kann vorübergehend sein. Wenn dieser Fehler erneut auftritt, sollten Sie Outlook neu starten. Fehler im zugrunde liegenden Sicherheitssystem. Interner Fehler.

If you want to make S/MIME certificates available to your users on the smartphone as well, you may be surprised to discover that this is not possible with the Outlook app unless you also use Microsoft Intune as a management solution for the devices.

Microsoft has now clarified in the article "Sensitivity labeling and protection in Outlook for iOS and Android " that this is due to the respective system architecture.

In the following, I would like to present a highly dangerous PKI configuration, perhaps not necessarily known to the general public, which can probably be encountered quite frequently in this way in corporate networks.

I show how, by exploiting various unfortunate circumstances in the Windows PKI, it is possible to elevate privileges from mere network access to complete Active Directory takeover.

The initial point of attack in this example is the Network Device Enrollment Service (NDES).

With Windows Server 2016 and Windows 10, a new "Enable Certificate Privacy" option has been implemented for exporting certificates with a private key via the Microsoft Management Console (MMC).

When exporting certificates with a private key, the certificate is exported to a PKCS#12 (.PFX) file.

Assume the following scenario:

• A certification authority is installed.
• An error occurred during installation that required a retry.
• The certification authority role was uninstalled and then the role configuration was tried again.
• The role configuration fails with the following error message:

The Certification Authority is already installed. If you are trying to reinstall the role service, you must first uninstall it.

Assume the following scenario:

• A web page is accessed using Google Chrome.
• The connection setup fails with the following error message:

Diese Website kann keine sichere Verbindung bereitstellen
test.intra.adcslabor.de hat eine ungültige Antwort gesendet.
Versuchen Sie, die Windows-Netzwerkdiagnose auszuführen.
ERR_SSL_PROTOCOL_ERROR

Assume the following scenario:

• A Windows role related to Active Directory Certificate Services (Certification Authority, Network Device Enrollment Service (NDES), Certification Authority Web Enrollment (CAWE), Certificate Enrollment Web Services (CEP, CES), or Online Responder (OCSP)) is to be installed or uninstalled.
• The installation or uninstallation fails with the following error message:

The status of the role services on the target machine cannot be determined. Please retry. The error is The WS-Management service cannot process the request. The service is configured to not accept any remote shell requests.

Certificates usually have a "CRL Distribution Points" extension that tells an application where the certificate's associated certificate revocation list (CRL) can be found.

This is like a telephone directory: It contains all the serial numbers of certificates that have been revoked by the certification authority (and are still within their validity period). Every application that checks the revocation status must download and evaluate the entire certificate revocation list.

As the size increases, this procedure becomes increasingly inefficient. As a rule of thumb, 100,000 revoked certificates already correspond to approx. 5 MB file size for the certificate revocation list.

The Online Certificate Status Protocol (OCSP) was developed for this purpose (under the leadership of ValiCert): It is similar to a directory assistance service where applications can request the revocation status for individual certificates, thus eliminating the need to download the entire CRL. OCSP is specified in RFC 6960 .

If a revocation configuration is configured for an Online Responder, there are various setting options that are discussed below.

Assume the following scenario:

• An Online Responder (OCSP) is configured on the network.
• OCSP is enabled for a certification authority and a revocation configuration is set up.
• The management console for the Online Responder displays the following status for the revocation configuration:

Type: Microsoft CRL-based revocation status provider
The revocation provider failed with the current configuration. The revocation function was unable to check revocation because the revocation server was offline. 0x80092013 (-2146885613 CRYPT_E_REVOCATION_OFFLINE), 0x80092013

Assume the following scenario:

• An Online Responder (OCSP) is configured on the network.
• OCSP is enabled for a certification authority and a revocation configuration is set up.
• The management console for the Online Responder displays the following status for the revocation configuration:

Type: Microsoft CRL-based revocation status provider
The revocation provider failed with the current configuration. The object identifier does not represent a valid object. 0x800710d8 (WIN32: 4312 ERROR_OBJECT_NOT_FOUND), 0x800710d8

Assume the following scenario:

• A certificate is revoked via the command line (certutil -revoke).
• The operation fails with the following error message:

ICertAdmin::RevokeCertificate: The data is invalid. 0x8007000d (WIN32: 13 ERROR_INVALID_DATA)

By default, the Microsoft Certification Authority removes the serial numbers of expired certificates from the revocation lists it issues.

However, there are some exceptions to this.

With Windows Server 2008, together with the NSA Suite B algorithms (also known as Cryptography Next Generation, CNG), key storage providers were introduced as a new, modern interface for generating, storing, and using private keys in the Windows ecosystem.

In most cases, it does not matter which CSP or KSP is used for certificates. However, some applications will not work or will not work correctly if the wrong provider is chosen.

Below is a list of use cases I know of for certificates that only work with a specific cryptographic service provider (CSP) or key storage provider (KSP).

Assume the following scenario:

• A certification authority is installed.
• The installation is successful, but the certification authority service does not start after the installation.
• When trying to start the certification authority service from the Certification Authority management console, you receive the following error message:

The system cannot find the file specified. 0x2 (WIN32: 2 ERROR_FILE_NOT_FOUND)
The policy module for a CA is missing or incorrectly registered. To view or change policy module settings, right-click on the CA, click Properties, and then click the Policy Module tab.

When troubleshooting, it can be very helpful to view encrypted SSL connections in order to inspect the messages within. There is a relatively simple way to do this with Wireshark.

Assume the following scenario:

• A user or application accesses a web page or web application running on an Internet Information Services (IIS) web server.
• The web server is configured to request a client certificate for the requested resource.
• Although there is a valid client certificate on the client, the error code 403 Forbidden is returned immediately. The user is not prompted (when calling the page with a browser) to select a certificate.
• The web server certificate was recently renewed and the IIS SSL binding was configured accordingly via the IIS Manager.

403 - Forbidden: Access is denied.
You do not have permission to view this directory or page using the credentials that you supplied.

Assume the following scenario:

• A user sends a certificate request to a certification authority.
• The certificate request fails with the following error message:

The request is missing required signature policy information. 0x80094809 (-2146875383 CERTSRV_E_SIGNATURE_POLICY_REQUIRED)
Denied by Policy Module

For troubleshooting e-mail messages encrypted using Secure/Multipurpose Internet Mail Extensions (S/MIME), the encrypted part of a message can be exported. See article "Microsoft Outlook: Extracting an encrypted S/MIME message from an email ".

To find out with which certificates a message has been encrypted, you can proceed as follows...

The encrypted part of an e-mail message encrypted with Secure/Multipurpose Internet Mail Extensions (S/MIME) is always contained in a file called "smime.p7m" as an attachment to the mail.

Outlook does not display this attachment, but for analysis purposes it can be extracted from the e-mail with MFCMAPI , which Microsoft provides free of charge.

The capolicy.inf contains basic settings that can or should be specified before installing a certification authority. Put simply, no certification authority should be installed without it.

Assume the following scenario:

• An attempt is made to request a certificate from a certification authority (enterprise CA) integrated into Active Directory for a user or computer.
• The certificate request fails with the following error message:

The requested certificate template is not supported by this CA. 0x80094800 (-2146875392 CERTSRV_E_UNSUPPORTED_CERT_TYPE).

Assume the following scenario:

• A user receives an e-mail message encrypted with Secure/Multipurpose Internet Mail Extensions (S/MIME).
• The message cannot be opened.
• When opening the message, the following error message is displayed:

Sorry, we're having trouble opening this item. This could be temporary, but if you see it again you might want to restart Outlook. Your digital ID name cannot be found by the underlying security system.

Assume the following scenario:

• A user has received an email message in the past.
• The message was signed with an S/MIME certificate.
• The sender's signing certificate was issued by a certification authority that is trusted by the recipient.
• Thus, the signature was recognized as valid at the time the message was received.
• The user opens the mail again some time later and finds that the signature is classified as invalid.

The following is a description of the Enroll on Behalf Of function and how it differs from other methods of requesting certificates.

• A certificate is requested for a user from a certification authority via the certificate management console (certmgr.msc).
• This uses the Enroll on Behalf of (EOBO) mechanism.
• The certificate request fails with the following error message:

The operation is denied. It can only be performed by a certificate manager that is allowed to manage certificates for the current requester.

• A certificate is requested for a user from a certification authority via the certificate management console (certmgr.msc).
• This uses the Enroll on Behalf of (EOBO) mechanism.
• The certificate request fails with the following error message:

A certification chain processed correctly, but one of the CA certificates is not trusted by the policy provider. 0x800b0112 (-2146762478 CERT_E_UNTRUSTEDCA)

Assume the following scenario:

• A certificate is requested for a user or a computer from a certification authority via the certificate management console (certlm.msc or certmgr.msc).
• The Enroll on Behalf of (EOBO) mechanism is used for this.
• The desired certificate template is not displayed.
• If you check the "Show all templates" checkbox, the following error message will be displayed for the desired certificate template:

The certificate template requires too many RA signatures. Only one RA signature is allowed. Multiple request agent signatures are not permitted on a certificate request.

The attack on the MD5 signature algorithm demonstrated in late 2008 could only be used to create a usable forged certification authority certificate because the attacked certification authority had not configured a path length constraint.

The path length constraint is described in RFC 5280 . The idea behind this is that the maximum depth of the certification authority hierarchy is stored in the "Basic Constraints" extension of a certification authority certificate.

Microsoft Active Directory Certificate Services offers the possibility to develop your own policy and exit modules to extend the functionality of the certification authority.

Below are the steps necessary to create an exit module in C# using Visual Studio 2019. The exit module will write issued certificates to a configurable directory in the file system.

Since Windows 8, it is possible to protect the private keys of certificates with a Trusted Platform Module (TPM), if one is present . This makes the key non-exportable - even with tools like mimikatz.

However, it is not obvious at first glance that it cannot be guaranteed that a TPM is really used. It is true that no request via the Microsoft Management Console or autoenrollment is possible if the computer does not have a TPM.

However, the configuration in the certificate template is only a default setting for the client. When a certificate is requested, the certification authority will not explicitly check whether a Trusted Platform Module was really used .

To ensure that the private key of a certificate request has really been protected with a Trusted Platform Module, only the TPM Key Attestation remains.

There are cases in which you cannot or do not want to obtain web server certificates directly from a certification authority in your own Active Directory forest via the Microsoft Management Console, for example if the system in question is not a domain member.

In this case, the use of certificate templates is not possible, and one must manually create a Certificate Signing Request (CSR).

Assume the following scenario:

• A certificate is requested from a certification authority.
• The certificate is successfully issued by the certification authority.
• However, when installing the certificate on the target system, the following error message occurs:

A certificate issued by the certification authority cannot be installed. Contact your administrator.
Cannot find object or property. 0x80092004 (-2146885628 CRYPT_E_NOT_FOUND)

Since Windows 8, it is possible to protect private keys for certificates with a Trusted Platform Module (TPM), if one is available . This makes the key non-exportable - even with tools like mimikatz.

However, it is not obvious at first glance that it cannot be guaranteed that a TPM is really used. Admittedly, no request via the Microsoft Management Console or autoenrollment will be possible if the computer does not have a TPM.

However, the configuration in the certificate template is merely a default setting for the client. The certification authority will not explicitly check whether a trusted platform module has actually been used when a request is made.

Thus - if the certificate request is done away from the MMC - arbitrary parameters can be used for the private key.

Assume the following scenario:

• A certificate is requested for a user or a computer from a certification authority via the certificate management console (certlm.msc or certmgr.msc).
• Autoenrollment does not request a certificate from the desired certificate template, although it is enabled and the permissions are set accordingly.
• The desired certificate template is not displayed when requesting manually via the Microsoft Management Console (MMC). If the "Show all templates" check box is selected, the following error message is displayed for the desired certificate template:

Cannot find object or property.
Can not find a valid CSP in the local machine.

Since Windows 8, it has been possible to protect the private keys of certificates with a Trusted Platform Module (TPM), if one is present. This ensures that the key is truly non-exportable.

The process for setting up a certificate template that uses a Trusted Platform Module is described below.

Assume the following scenario:

• A certificate template is configured to use the Microsoft Platform Crypto Provider, so the private key generated when the certificate is requested is protected with a Trusted Platform Module (TPM).
• However, requesting certificates fails with the following error message:

An error occurred while enrolling for a certificate.
A certificate request could not be created.
Url: CA02.intra.adcslabor.de\ADCS Labor Issuing CA 1
Error: The requested operation is not supported. 0x80090029 (-2146893783 NTE_NOT_SUPPORTED)

More and more companies are using the Google Chrome browser or the new Chromium-based Microsoft Edge (codename Anaheim ) as the default browser on the Windows platform.

When distributing one of these two browsers, it should be noted that they sometimes behave differently from other browsers in terms of certificates.

Besides the fact that Chromium, unlike Internet Explorer and the previous Edge (codename Spartan ), enforces RFC 2818 , it also behaves differently when checking revocation information .

Time and again in discussions about the security of a certification authority, it comes up that abuse of the certification authority could be contained by its security settings.

However, the fact that the integrity of a certification authority is directly tied to its key material and can therefore also be compromised through it is not obvious at first glance.

One has to think of the certification authority software as a kind of management around the key material. For example, the software provides an online interface for certificate enrollment , takes care of the authentication of the enrollees, the automated execution of signature operations (issuing certificates and certificate revocation lists ) and their logging (certification authority database , audit log , event log ).

However, signature operations require nothing more than the private key of the certification authority. The following example shows how an attacker, given access to the certification authority's private key, can generate and issue certificates without the certification authority software and its security mechanisms noticing.

With such a certificate, it would in the worst case even be possible to take over the Active Directory forest undetected .

In the operation of a certification authority, one may find that it is necessary to subsequently change the storage path for the certification authority database. For example, one may want to move the database to another partition/drive.

Below is a description of where it is possible to view which symmetric algorithm was used to encrypt an email received, and which hash algorithm was used for a signed email.

Microsoft Outlook uses (if available and required) the information in the "S/MIME Capabilities" extension of a certificate. Below is a description of how it is used and which algorithms are selected.

Among others, Microsoft Outlook evaluates the extension and uses it to determine the symmetric algorithm for an encrypted email.

However, if you take a look at the symmetric algorithms included in such a certificate, you will probably find that the list contains rather outdated algorithms - the "strongest" of these algorithms is Triple DES (3DES), which is now considered obsolete.

Secure administration of Linux systems includes avoiding SSH logons by password and instead logging on with RSA keys.

The de facto standard for SSH connections on Windows is PuTTY . Here, logon with RSA keys is implemented, but only key files can be used, which has the disadvantage that they are almost unprotected in the file system.

Surely a great option would be to use RSA keys from the Windows world, and perhaps even stored on a physical or virtual smart card.

Assume the following scenario:

• A certification authority (Enterprise Certification Authority) integrated into Active Directory is installed via Windows PowerShell.
• Delegated permissions are used to install the certification authority. Thus, the installing user is not a member of the Enterprise Administrators group.
• After running the Role Configuration Wizard, one or more of the following error messages is displayed on the command line:

Setup could not add the Certification Authority's computer account to the Pre-Windows 2000 Compatible Access security group. Certificate managers Restrictions feature will not work correctly on this Certification Authority. To fix this, an administrator must manually add the Certification's Authority's computer account to the Pre-Windows 2000 Compatible Access security group in Active Directory. Insufficient access rights to perform the operation. 0x80072098 (Win32: 8344 ERROR_DS_INSUFF_ACCESS_RIGHTS)

Warning: Setup could not add the certification authority’s computer account to the cert Publishers Security Group. This Certification Authority will not be able to publish certificates in Active Directory. To fix this, an administrator must manually add the Certification Authority’s computer account to the Cert Publishers security group in Active Directory.  Insufficient access rights to perform the operation. 0x80072098 (Win32: 8344 ERROR_DS_INSUFF_ACCESS_RIGHTS)

Assume the following scenario:

• A certification authority (Enterprise Certification Authority) integrated into Active Directory is installed.
• Delegated permissions are used to install the certification authority. Thus, the installing user is not a member of the "Enterprise Administrators" group.
• After the certification authority certificate is issued by the parent certification authority, it is installed to complete the role configuration.
• The installation of the certification authority certificate fails with the following error message:

Insufficient access rights to perform the operation. 0x80072098 (WIN32: 8344 ERROR_DS_INSUFF_ACCESS_RIGHTS)

Assume the following scenario:

• A certification authority is installed.
• The certification authority uses a Gemalto/SafeNet hardware security module (HSM) with the SafeNet Luna Key Storage Provider.
• After the certification authority certificate is issued by the parent certification authority, it is installed to complete the role configuration.
• The installation of the certification authority certificate fails with the following error message:

An error was detected while configuring Active Directory Certificate Services.
The Active Directory Certificate Services Setup Wizard will need to be rerun to complete the configuration.
The new certificate public key does not match the current outstanding request.
The wrong request may have been used to generate the new certificate: Provider DLL failed to initialize correctly.
0x8009001d (-2146893795 NTE_PROVIDER_DLL_FAIL)

Assume the following scenario:

• A certificate request is made on a Linux system (for example, a thin client) by means of SSCEP against a Network Device Enrollment Service (NDES) .
• The certificate request fails with the following error message:

sscep: Subject of our request does not match that of the returned Certificate!

Sometimes it is necessary to allow Relative Distinguished Names (RDNs) in issued certificates that are not defined and therefore could not be configured in the SubjectTemplate value in the certification authority's registry either.

An example of this is the Organization Identifier with object identifier 2.5.4.97, which is required, for example, for certificates that comply with the eIDAS Regulation.

Microsoft Active Directory Certificate Services does not transfer subjects from certificate requests for templates in which the enrollee is allowed to supply them 1:1 into the issued certificate.

Instead, it is defined both which Relative Distinguished Names (RDNs) are allowed and in which order they are written to issued certificates. However, this order can be changed. How this is done is explained below.

If you want to equip a large number of systems with certificates, a manual request and renewal of the certificates is not an option. The only viable path is automation.

For systems that are not members of the Active Directory forest, an automatic certificate request via RPC/DCOM is not an option.

For certain use cases, the Simple Certificate Enrollment Protocol (SCEP) is an interesting alternative. For this protocol, there are clients not only for Windows but, with SSCEP, also for Linux. SSCEP is used, among others, by thin clients with the eLux operating system .

The following describes how to set up the SSCEP client on a Debian Buster Linux system - either to use it to manage servers or to be able to test the client-side behavior.

Suppose you are running a Network Device Enrollment Service (NDES) that is configured to use a static password . In this case, unlike in the default configuration, the password for requesting certificates by NDES clients never changes.

However, one may aim for an intermediate way, for example, a daily change of the password. The following describes a way to automate the change of the password.

If you want to equip Windows systems with certificates that do not have the option of communicating directly with an Active Directory-integrated certification authority, or that are not even in the same Active Directory forest, the only option in most cases is to install certificates manually.

Since Windows 8.1 / Windows Server 2012 R2, however, there is an integrated client for the Simple Certificate Enrollment Protocol (SCEP) on board. On the server side, SCEP has been implemented in the Microsoft PKI via the Network Device Enrollment Service (NDES) since Windows Server 2003.

A particularly interesting feature of SCEP is that the protocol allows a certificate to be renewed by specifying an existing one. So what could be more obvious than to use this interface? What is still missing is a corresponding automation via Windows PowerShell.

The Simple Certificate Enrollment Protocol (SCEP) was developed by Verisign for Cisco in the early 2000s to provide a simplified method for requesting certificates. Previously, network devices required manually generating a certificate request on each device, submitting it to a certification authority, and then manually installing the issued certificate on the corresponding device again.

X.509 certificates are always encoded in the Distinguished Encoding Rules (DER) format. This is a binary, machine-readable format.

DER-encoded certificates can, however, also be converted into a text-based format using the BASE64 process so that they can be transmitted in an e-mail body, for example. BASE64 encloses the DER-encoded format, i.e. the certificate is and remains DER-encoded in any case.

The Network Device Enrollment Service (NDES) has the ability to authenticate with a previously issued certificate in order to request a certificate with the same content again. This is very convenient for renewal operations, as it eliminates the need to request a one-time password beforehand.

Some Windows events generated by the certification authority are only generated from a certain logging level.

The following describes how to determine and change the logging level of a certification authority.

Assume the following scenario:

• The certification authority cannot issue certificates and/or
• The certification authority cannot issue certificate revocation lists (CRLs).
• At least one of the following error messages is logged:

Event ID: 53 (Microsoft-Windows-CertificationAuthority)

Active Directory Certificate Services denied request 12345 because An attempt was made to open a Certification Authority database session, but there are already too many active sessions. The server may need to be configured to allow additional sessions. 0x8009400f (-2146877425 CERTSRV_E_NO_DB_SESSIONS). The request was for CN=Rudi Ratlos. Additional information: Denied by Policy Module

Event ID: 130 (Microsoft-Windows-CertificationAuthority)

Active Directory Certificate Services could not create a certificate revocation list. An attempt was made to open a Certification Authority database session, but there are already too many active sessions. The server may need to be configured to allow additional sessions 0x8009400f (-2146877425). This may cause applications that need to check the revocation status of certificates issued by this CA to fail. You can recreate the certificate revocation list manually by running the following command: "certutil -CRL". If the problem persists, restart Certificate Services.

Assume the following scenario:

• A certification authority is installed
• The role configuration fails with the following error message:

CCertSrvSetupProperty: The parameter is incorrect. 0x80070057 (WIN32: ERROR_INVALID_PARAMETER).

Assume the following scenario:

• One installs a Network Device Enrollment Service (NDES) server
• One has the necessary permissions to install the role (local administrator, enterprise administrator)
• The role configuration fails with the following error message:

Failed to Enroll RA certificates. The requested certificate template is not supported by this CA. 0x80094800 (-2146875392 CERTSRV_E_UNSUPPORTED_CERT_TYPE)

Often, problems with the public key infrastructure can be found in the underlying network - for example, if a firewall rule is missing from the network.

Thus, it is helpful if one is able to record network traffic in order to analyze it. Excellent tools exist for this purpose, such as Wireshark , but these require that an installation be made on the system in question, which cannot and should not be done easily on a production system.

Fortunately, the Windows Server operating system has a built-in mechanism to capture network packets. However, the resulting files are not compatible with Wireshark. Microsoft's own tool, Message Analyzer, was discontinued on Nov 25, 2019 and the download links removed .

The following therefore describes how such a recording can be generated and subsequently converted into a Wireshark-compatible format in order to be able to analyze the recording away from the server in question.

Assume the following scenario:

• For a certificate template, only the object identifier is shown, but not the display name and/or
• Queries against the certification authority database contain only the object identifier for the certificate template ("CertificateTemplate" field), but not the display name.

The Network Device Enrollment Service (NDES) has two Registration Authority certificates. The Enrollment Agent certificate is used to sign certificate requests, and one can configure the NDES device template accordingly, so that certificates are only issued if the submitted certificate requests also have a corresponding signature .

If you plan to remove the certification authority connected to NDES from the NTAuthCertificates object , the question may arise as to whether mutual dependencies need to be taken into account here - after all, Enroll on Behalf Of (EOBO) requires the presence of the certification authority certificate in NTAuthCertificates.

Assume the following scenario:

• An attempt is made to install a certification authority
• The role configuration fails with the following error message:

An error occurred when creating the new key container "ADCS Labor Issuing CA 3". Please make sure the CSP is installed correctly or select another CSP.
Bad Data. 0x80090005 (-2146893819 NTE_BAD_DATA).

Assume the following scenario:

• After installing an Online Responder (OCSP), setting up a revocation configuration and adjusting the certification authority or configuring a Group Policy that forces clients to use the Online Responder , the functional test shows that it still does not work.
• The OCSP address check reports HTTP status 404 (not found).

Assume the following scenario:

• A certification authority (Enterprise CA) integrated into Active Directory is installed using Windows PowerShell (Install-AdcsCertificationAuthority).
• The role configuration fails with the following error message:

Install-AdcsCertificationAuthority : Active Directory Certificate Services setup failed with the following error: A value for the attribute was not in the acceptable range of values. 0x80072082 (WIN32: 8322 ERROR_DS_RANGE_CONSTRAINT)

The following is an overview of the events generated on domain controllers in the Windows Event Viewer that are relevant to the public key infrastructure.

By default, Windows systems, even if an Online Responder (OCSP) is configured, will fall back to a certificate revocation list (if available) after a certain number of OCSP requests , because this is usually more efficient in such a case. However, this behavior is not always desired.

For example, if one uses smart card logons, one might want to know if logons were performed with certificates issued without authorization . In conjunction with the deterministic good of the Online Responder you can thus create an (almost) seamless audit trail for all smart card logons.

Even if an Online Responder is present in the network and the certification authority has entered its address in the Authority Information Access (AIA) extension of the issued certificates, it is not always guaranteed that the Online Responder is actually used.

One variable here is the "Magic Number", which is present on every Windows operating system. It causes the system to fall back to certificate revocation lists (if present) if requests are made too often via OCSP for the same certification authority.

The following is an overview of the audit events generated by the Online Responder in the Windows Event Viewer.

In the default configuration, the Online Responder returns the status "Good" for requested certificates that do not appear on one of the configured certificate revocation lists.

This can be problematic because the Online Responder has no knowledge of the certificates issued by the certification authorities. If an attacker succeeds in issuing a certificate with the private key of the certification authority without its knowledge, the Online Responder would not detect this, and the certificate would also show up as "Good" in the audit log .

Assume the following scenario:

• A certification authority is implemented in the network.
• The certification authority service does not start.
• When trying to start the certification authority service, you get the following error message:

The device that is required by this cryptographic provider is not ready for use. 0x80090030 (-2146893776 NTE_DEVICE_NOT_READY)