Tag: capolicy.inf

With existing public key infrastructures, you may find that the validity period of the root certification authority certificate has not proven itself. For example, it could be that it was chosen too short (the default setting of Microsoft AD CS is only five years), or even too long, which may not be optimal from a security perspective.

If you renew the certification authority certificate, you may want to achieve a different validity period.

Continue reading "Extending or shortening the validity period of root certification authority certificates"

The capolicy.inf contains basic settings that can or should be specified before installing a certification authority. Put simply, no certification authority should be installed without it.

Continue reading "Basics: Configuration file for the certification authority (capolicy.inf)"

Internationalized Domain Names (IDNs) have been officially supported since Windows Server 2012 as part of the certification authority and its associated components.

However, if you want to use them in your certification authority certificates, there are some specifics to consider.

Continue reading "Umlauts in certification authority certificates"

Assume the following scenario:

• A certification authority certificate is requested from a certification authority
• The certificate request fails with the following error message:

The certification authority's certificate contains invalid data. 0x80094005 (-2146877435 CERTSRV_E_INVALID_CA_CERTIFICATE)
Denied by Policy Module

Continue reading "Requesting a certification authority certificate fails with error message "The certification authority's certificate contains invalid data. 0x80094005 (-2146877435 CERTSRV_E_INVALID_CA_CERTIFICATE)""

For stronger control over the certificates that can be issued by a certification authority, a path length constraint can be set up so that certification authorities from a defined hierarchy level onward are no longer able to issue subordinate certification authority certificates

For an explanation of how the path length constraint works, see the article "Basics: Path Length Constraint" .

Continue reading "Configure Path Length Constraint for Certificates Issued by a Certification Authority"

Professional operation of a certification authority also includes the regular creation of backups.

The following describes which components need to be backed up and the associated procedure.

Continue reading "Create a backup of a certification authority"

Below is a description of the configuration settings required to ensure that a certificate hierarchy based on Active Directory Certificate Services complies with the Common PKI (formerly known as ISIS-MTT) standard.

Continue reading "Description of the necessary configuration settings for the "Common PKI" certificate profile"

If you install an issuing CA and do not explicitly request an issuance policy, the resulting CA certificate will not contain an issuance policy.

If you want to include the wildcard issuance policy (All Issuance Policies) in the certification authority certificate, proceed as follows:

Continue reading "Include the wildcard issuance policy (All Issuance Policies) in a certification authority certificate"

If you install an issuing CA and do not explicitly request an issuance policy, the resulting CA certificate does not contain any issuance policies.

If you want to include the issuance policies for Trusted Platform (TPM) Key Attestation in the certification authority certificate, you must proceed as follows.

Continue reading "Include the issuance policies for Trusted Platform (TPM) Key Attestation in a certification authority certificate"

A useful hardening measure for certification authorities is to restrict the certification authority certificates so that they are only trusted for the extended key usages (Extended Key Usage) that are actually issued.

In the event of a compromise of the certification authority, the damage is then (at least) limited to the defined extended key usages.

The Smart Card Logon Extended Key Usage, which is of interest for many attacks (in conjunction with the certification authority's membership in NTAuthCertificates ) would then only be present in the certification authority certificate of the certification authority that actually issues such certificates.

Continue reading "Basics: Restricting Extended Key Usage (EKU) in Certification Authority Certificates"

When using Active Directory Certificate Services, it is noticeable that there are certain extensions in the certificates of the certification authorities and the certificates they issue that are not defined in the relevant RFCs and are specific to AD CS.

Continue reading "Removing ADCS-specific extensions from certificates"