Tag: Cache

Assume the following scenario:

• The company would like to use smart card logon.
• The domain controllers are equipped with certificates that can be used for smart card logon .
• The users are equipped with certificates that can be used for smart card logon.
• Logon to the domain via smart card fails with the following error message:

A certification chain processed correctly, but one of the CA certificates is not trusted by the policy provider. 0x800b0112 (-2146762478 CERT_E_UNTRUSTEDCA)

Continue reading "Smart card logon fails with error message "A certification chain processed correctly, but one of the CA certificates is not trusted by the policy provider. 0x800b0112 (-2146762478 CERT_E_UNTRUSTEDCA)""

Assume the following scenario:

• A certification authority hierarchy is established in the network and the root certification authority is mapped in the configuration partition of the Active Directory forest.
• Domain members are configured to run the autoenrollment process to update trusted root certification authorities from the Configuration partition.
• However, this process does not work for some clients. The root CA certificates are not automatically downloaded and entered into the local trust store.
• As a consequence certificate requests can fail because, for example, the certification authority hierarchy is not trusted.

Continue reading "The local certificate store for trusted root certification authorities is not synchronized from Active Directory"

Certificates usually have a "CRL Distribution Points" extension that tells an application where the certificate's associated certificate revocation list (CRL) can be found.

This is like a telephone directory: It contains all the serial numbers of certificates that have been revoked by the certification authority (and are still within their validity period). Every application that checks the revocation status must download and evaluate the entire certificate revocation list.

As the size increases, this procedure becomes increasingly inefficient. As a rule of thumb, 100,000 revoked certificates already correspond to approx. 5 MB file size for the certificate revocation list.

The Online Certificate Status Protocol (OCSP) was developed for this purpose (under the leadership of ValiCert): It is similar to a directory assistance service where applications can request the revocation status for individual certificates, thus eliminating the need to download the entire CRL. OCSP is specified in RFC 6960 .

Continue reading "Basics: Online Responder (Online Certificate Status Protocol, OCSP)"

If a revocation configuration is configured for an Online Responder, there are various setting options that are discussed below.

Continue reading "Overview of the setting options for revocation configurations of the Online Responder (OCSP)"

Assume the following scenario:

• A user receives an e-mail message encrypted with Secure/Multipurpose Internet Mail Extensions (S/MIME).
• The message cannot be opened.
• When opening the message, the following error message is displayed:

Sorry, we're having trouble opening this item. This could be temporary, but if you see it again you might want to restart Outlook. Your digital ID name cannot be found by the underlying security system.

Continue reading "Microsoft Outlook: Emails encrypted with S/MIME cannot be opened. The error message "Your digital ID name cannot be found by the underlying security system" appears."

Even if an Online Responder is present in the network and the certification authority has entered its address in the Authority Information Access (AIA) extension of the issued certificates, it is not always guaranteed that the Online Responder is actually used.

One variable here is the "Magic Number", which is present on every Windows operating system. It causes the system to fall back to certificate revocation lists (if present) if requests are made too often via OCSP for the same certification authority.

Continue reading "Configure the "Magic Number" for the Online Responder"

Continue reading "Details of the event with ID 33 of the source Microsoft-Windows-NetworkDeviceEnrollmentService"

If a valid, unexpired certificate is to be withdrawn from circulation, it must be revoked. For this purpose, the certification authorities maintain corresponding certificate revocation lists in which the digital fingerprints of the revoked certificates are listed. They must be queried during the validity check.

Continue reading "Basics: Checking the revocation status of certificates"

Since the Certificate Services management tools in Windows Server 2012, you can select the desired compatibility for the certification authority and certificate recipient when configuring a certificate template.

In the following, this function is described in more detail, as well as possible effects in practice.

Continue reading "How are the compatibility settings for certificate templates technically mapped?"

After installing a certification authority, after migrating to a new server, or after more extensive maintenance work, an extensive functional test should be performed to ensure that all components of the certification authority are working as desired.

Continue reading "Performing a functional test for a certification authority"

All applications that use the Microsoft Cryptographic Application Programming Interface Version 2 (Crypto API Version 2, CAPI2) have a mechanism for caching certificate revocation information (certificate revocation lists and OCSP responses).

Thus, there is no guarantee that, for example, a newly published CRL will be used by participants before the previous CRL, which is still in the cache, has expired.

The following describes how to view and influence the CRL cache.

Continue reading "View and clear the address cache for certificate revocation lists (CRL URL Cache)"

Assume the following scenario:

• You try to request a certificate via a Certificate Enrollment Policy Web Service (CEP) from an Active Directory-integrated certification authority (enterprise CA).
• The operation fails with the following error message:

The requested certificate template is not supported by this CA.

Continue reading "The request for a certificate via the Certificate Enrollment Policy Web Service (CEP) fails with the error message "The requested certificate template is not supported by this CA.""

Authentication Mechanism Assurance (AMA) is a feature designed to ensure that a user is a member of a security group only if they can be shown to have logged on using a strong authentication method (i.e., a smart card). If the user logs on via username and password instead, he or she will not have access to the requested resources.

Originally intended for access to file servers, however, AMA can also be used (with some restrictions) for administrative logon. Thus, for example, it would be conceivable for a user to be unprivileged when logging on with a username and password, and to have administrative rights when logging on with a certificate.

Continue reading "Using Authentication Mechanism Assurance (AMA) to secure the logon of administrative accounts"

After a certificate enrollment policy is configured and used by a subscriber, the results are cached locally (Enrollment Policy Cache).

If changes are now made to the infrastructure, for example by publishing or removing a new certificate template on a certification authority accessible via Certificate Enrollment Web Service (CES), these changes are not immediately visible to subscribers due to the cache.

For this reason, it may be helpful to view or clear the cache.

Continue reading "View and clear the certificate enrollment policy cache for the Certificate Enrollment Policy Web Service (CEP)"

Assume the following scenario:

• An NDES server is configured on the network.
• When calling the administration web page (certsrv/mscep_admin) the following message appears:

The password cache is full.

Continue reading "The Network Device Enrollment Service (NDES) administration web page (certsrv/mscep_admin) reports "The password cache is full.""