Tag: CRL distribution point (CDP)

Sending S/MIME encrypted messages with Outlook for iOS is not possible: "There's a problem with one of your S/MIME encryption certificates."

Assume the following scenario:

There's a problem with one of your S/MIME encryption certificates. Contact your IT help desk for more info.
Es gibt ein Problem mit einem ihrer S/MIME-Verschlüsselungszertifikate. Wenden Sie sich für weitere Informationen an Ihren IT-Helpdesk.

Continue reading "Sending S/MIME encrypted messages with Outlook for iOS is not possible: "There's a problem with one of your S/MIME encryption certificates.""

Logon error with Windows Hello for Business: "Contact your system administrator and tell them that the KDC certificate could not be validated."

Assume the following scenario:

  • The company is using Windows Hello for Business.
  • Users receive the following error message when logging on to the client:
Sign-in failed. Contact your system administrator and tell them that the KDC certificate could not be validated. Additional information may be available in the system event log.

Continue reading "Logon error with Windows Hello for Business: "Contact your system administrator and tell them that the KDC certificate could not be validated.""

Details of the event with ID 75 of the source Microsoft-Windows-CertificationAuthority

Event Source:Microsoft-Windows-CertificationAuthority
Event ID:75 (0x4B)
Event log:Application
Event type:Error
Symbolic Name:MSG_E_DELTA_CRL_PUBLICATION_HOST_NAME
Event text (English):Active Directory Certificate Services could not publish a Delta CRL for key %1 to the following location on server %4: %2. %3.%5%6
Event text (German):Es konnte keine Delta-Zertifikatsperrliste für den Schlüssel %1 an folgendem Ort auf dem Server "%4" veröffentlicht werden: %2. %3.%5%6

Continue reading "Details of the event with ID 75 of the source Microsoft-Windows-CertificationAuthority"

Details of the event with ID 74 of the source Microsoft-Windows-CertificationAuthority

Event Source:Microsoft-Windows-CertificationAuthority
Event ID:74 (0x4A)
Event log:Application
Event type:Error
Symbolic Name:MSG_E_BASE_CRL_PUBLICATION_HOST_NAME
Event text (English):Active Directory Certificate Services could not publish a Base CRL for key %1 to the following location on server %4: %2. %3.%5%6
Event text (German):Es konnte keine Basis-Zertifikatsperrliste für den Schlüssel %1 an folgendem Ort auf dem Server "%4" veröffentlicht werden: %2. %3.%5%6

Continue reading "Details of the event with ID 74 of the source Microsoft-Windows-CertificationAuthority"

Details of the event with ID 66 of the source Microsoft-Windows-CertificationAuthority

Event Source:Microsoft-Windows-CertificationAuthority
Event ID:66 (0x42)
Event log:Application
Event type:Error
Symbolic Name:MSG_E_DELTA_CRL_PUBLICATION
Event text (English):Active Directory Certificate Services could not publish a Delta CRL for key %1 to the following location: %2. %3.%5%6
Event text (German):Es konnte keine Delta-Zertifikatsperrliste für den Schlüssel %1 an folgendem Ort veröffentlicht werden: %2. %3.%5%6

Continue reading "Details of the event with ID 66 of the source Microsoft-Windows-CertificationAuthority"

Details of the event with ID 65 of the source Microsoft-Windows-CertificationAuthority

Event Source:Microsoft-Windows-CertificationAuthority
Event ID:65 (0x41)
Event log:Application
Event type:Error
Symbolic Name:MSG_E_BASE_CRL_PUBLICATION
Event text (English):Active Directory Certificate Services could not publish a Base CRL for key %1 to the following location: %2. %3.%5%6
Event text (German):Es konnte keine Basis-Zertifikatsperrliste für den Schlüssel %1 an folgendem Ort veröffentlicht werden: %2. %3.%5%6

Continue reading "Details of the event with ID 65 of the source Microsoft-Windows-CertificationAuthority"

Basics: Checking the revocation status of certificates

If a valid, unexpired certificate is to be withdrawn from circulation, it must be revoked. For this purpose, the certification authorities maintain corresponding certificate revocation lists in which the digital fingerprints of the revoked certificates are listed. They must be queried during the validity check.

Continue reading "Basics: Checking the revocation status of certificates"

Using HTTP over Transport Layer Security (HTTPS) for the CRL distribution points (CDP) and the Online Responder (OCSP)

With regard to the design of the infrastructure for providing revocation information - i.e. the CRL distribution points (CDP) as well as the Online Responders (Online Certificate Status Protocol, OCSP) - the question arises whether these should be "secured" via Secure Sockets Layer (SSL) or Transport Layer Security (TLS).

Continue reading "Using HTTP over Transport Layer Security (HTTPS) for the CRL distribution points (CDP) and the Online Responder (OCSP)"

Publishing a certificate revocation list (CRL) to an Active Directory CRL distribution point (CDP)

Sometimes it is necessary for a certificate issued by a certification authority to be withdrawn from circulation even before its expiration date. To make this possible, a certification authority maintains a certificate revocation list. This is a signed file with a relatively short expiration date, which is used in combination with the certificate to check its validity.

In some cases (for example, with an offline certification authority, or if non-standard LDAP CRL distribution points have been configured), the certificate revocation list must be manually published to Active Directory.

Continue reading "Publishing a certificate revocation list (CRL) to an Active Directory CRL distribution point (CDP)"

Basics: Public Key Infrastructures (PKI)

A public key infrastructure comprises all components (hardware, software, people and processes) required for the use of digital certificates. A PKI consists of one or more certification authorities (CA). The tasks of a PKI include:

  • Ensuring the authenticity of keys, i.e. establishing a traceable link between a key and its origin to prevent misuse.
  • Revocation of certificates, i.e., ensuring that decommissioned or compromised (e.g., stolen) keys can no longer be used.
  • Ensuring accountability (non-repudiation), i.e., for example, that the owner of a key cannot deny that it belongs to him.
  • Enforcement of policies, i.e. standardized procedures for the use of certificates.

Continue reading "Basics: Public Key Infrastructures (PKI)"

Using Microsoft Network Load Balancing (NLB) for the CRL distribution points (CDP), Authority Information Access (AIA) and Online Responders (OCSP)

It is generally a good idea to ensure the availability of the CRL distribution points (CDP), Authority Information Access (AIA), and if available, Online Responders (OCSP) at all times.

Access to the revocation information is even more critical than access to the certification authority itself. If the revocation status of a certificate cannot be checked, it is possible (depending on the application) that the certificate is not considered trustworthy and the associated IT service cannot be used.

Continue reading "Using Microsoft Network Load Balancing (NLB) for the CRL distribution points (CDP), Authority Information Access (AIA) and Online Responders (OCSP)"

Transfer certificate revocation lists to CRL distribution points using SSH Secure Copy (SCP) with public key authentication (Windows Server 2019)

If the servers providing the CRL distribution points are located in a demilitarized zone (DMZ), for example, or data transfer via Server Message Block (SMB) is not possible for other reasons, the certificate revocation lists (CRLs) can be transferred to the distribution points using SSH Secure Copy (SCP). As of Windows Server 2019, the OpenSSH server and client packages are available. The following describes the setup with authentication via public keys (Public Key Authentication) instead of passwords as an example

Continue reading "Transfer certificate revocation lists to CRL distribution points using SSH Secure Copy (SCP) with public key authentication (Windows Server 2019)"