If you want to request or renew certificates on a Windows client using the Microsoft Management Console (MMC), you have several options—all of which achieve the same result but behave differently. Below, we’ll discuss the differences.
Dirk-jan Mollema recently presented an attack that can be used to obtain a certificate for highly privileged accounts via Intune . This can then be used to compromise the entire Active Directory environment.
The attack is similar in its basic features to what I have already described in the article "From Zero to Enterprise Administrator through Network Device Enrollment Service (NDES) - and What to Do About It " and in the article "Attack vector on Active Directory directory service via smart card logon mechanism " (generally also known as ESC1 ).
What is new, however, is to utilize the Mobile Device Management (MDM) system - in this case Microsoft Intune - accordingly.
What is not new, however, is what can be done with the TameMyCerts Policy Module for Active Directory Certificate Services to drastically reduce the attack surface...
To use the Online Certificate Status Protocol (OCSP), it is necessary to configure an appropriate certificate template.
With the May 10, 2022 patch, Microsoft is attempting to close a vulnerability in Active Directory that affects certificate-based logon (commonly known as PKINIT or also smart card logon ).
The update changes both the behavior of the certification authority as well as the behavior of Active Directory when processing certificate-based logons.
If one installs a Network Device Enrollment Service (NDES), one is faced with the question under which identity the IIS application pool should be operated. In the following, the individual options are examined in more detail in order to facilitate a selection.
When configuring a certificate template, one must decide on the intended certificate content, i.e., among other things, which identities are confirmed by the certificates and how they are mapped.
In the "Subject Name" tab of the certificate template configuration dialog, you can configure how the identity confirmed by the certificate is mapped.
Assume the following scenario:
Error: The requested operation is not supported. 0x80090029 (-2146893783 NTE_NOT_SUPPORTED)On Windows Server 2016, the error message "No provider was specified for the store or object. 0x80092006 (-2146885626 CRYPT_E_NO_PROVIDER)" is issued with otherwise identical behavior.
Assume the following scenario:
The following template name has already been used: ADCSLaborBenutzerTest. Enter a unique template name.Assume the following scenario:
Windows could not install the new certificate templates. This security ID may not be assigned as the owner of this object.Sometimes it is necessary to issue certificates with a shorter validity period than configured in the certificate template. Therefore, you may not want to reconfigure the certificate template right away or create another certificate template.
Continue reading "Issue certificates with shortened validity period"
With the introduction of version 2 certificate templates along with Windows XP and Windows Server 2003, the option was introduced for a certificate template to replace one or more others.
This makes it possible to replace issued certificates with those of another certificate template, or to consolidate multiple certificate templates into a single one.
Continue reading "Basics: Replacing (Superseding) Certificate Templates"
Assume the following scenario:
The following is a troubleshooting guide.
Assuming a use case is implemented for certificates where users specify the identity contained in the certificate in the certificate request, and this requires manual intervention by the certificate managers, the question arises as to how to proceed when the certificates expire or the certificate template is moved to another certification authority in order to minimize tickets at the help desk and thus the resulting work for the certificate managers.
Certificates usually have a "CRL Distribution Points" extension that tells an application where the certificate's associated certificate revocation list (CRL) can be found.
This is like a telephone directory: It contains all the serial numbers of certificates that have been revoked by the certification authority (and are still within their validity period). Every application that checks the revocation status must download and evaluate the entire certificate revocation list.
As the size increases, this procedure becomes increasingly inefficient. As a rule of thumb, 100,000 revoked certificates already correspond to approx. 5 MB file size for the certificate revocation list.
The Online Certificate Status Protocol (OCSP) was developed for this purpose (under the leadership of ValiCert): It is similar to a directory assistance service where applications can request the revocation status for individual certificates, thus eliminating the need to download the entire CRL. OCSP is specified in RFC 6960 .
Continue reading "Basics: Online Responder (Online Certificate Status Protocol, OCSP)"
Assume the following scenario:
The requested certificate template is not supported by this CA. 0x80094800 (-2146875392 CERTSRV_E_UNSUPPORTED_CERT_TYPE).