Below is a description of the different generations of certificate templates (schema versions) and the innovations introduced with them.
Continue reading "Description of certificate template generations"
Authentication Mechanism Assurance (AMA) is a feature designed to ensure that a user is a member of a security group only if they can be shown to have logged on using a strong authentication method (i.e., a smart card). If the user logs on via username and password instead, he or she will not have access to the requested resources.
Originally intended for access to file servers, however, AMA can also be used (with some restrictions) for administrative logon. Thus, for example, it would be conceivable for a user to be unprivileged when logging on with a username and password, and to have administrative rights when logging on with a certificate.
The following describes the process that runs in the background when certificates are requested manually or automatically in order to achieve the highest possible level of automation.
Below is a guide to configuring a web server template with recommended settings.
Continue reading "Configuring a Secure Socket Layer (SSL) Certificate Template for Web Server"
Authentication Mechanism Assurance (AMA) provides the ability to tie membership in a security group to logon with a smart card certificate containing a specific Object Identifier (OID).
If the user does not log on with the smart card certificate, but with user name and password, he is also not a member of the security group.
The following describes how to generate a certificate template for use with Authentication Mechanism Assurance.
Continue reading "Configuring a Certificate Template for Authentication Mechanism Assurance (AMA)"
In order for domain controllers to process smart card logons, they need certificates that provide this function.
Continue reading "Domain Controller Certificate Templates and Smart Card Logon"
There may be cases where it is necessary to install the standard Microsoft certificate templates before installing the first Active Directory integrated certification authority (Enterprise Certification Authority), or to reinstall the templates, for example because they have been corrupted or otherwise modified.
Continue reading "(Re-)Installing the Microsoft Standard Certificate Templates"
Assume the following scenario:
You do not have sufficient permission to enroll with SCEP. Please contact your system administrator. By default, the Network Device Enrollment Service (NDES) requests certificates from the "IPsec (Offline Request)" template. This certificate template is from Windows 2000 times and cannot be edited. Therefore, it is recommended to change the default settings and use your own certificate templates that serve your personal requirements.
Continue reading "Configure Device Template for Network Device Enrollment Service (NDES)"
The Network Device Enrollment Service (NDES) uses two certificate templates for its internal function to make it act as a Registration Authority (RA). These are published during role configuration of the NDES service on the configured certification authority and certificates are requested:
These certificate templates are standard templates from the Windows 2000 world (version 1 templates), i.e. they cannot be edited. In addition, the Exchange Enrollment Agent (Offline Request) template is marked as a user template, i.e. during NDES role configuration the certificate is requested in the context of the installing user and then imported into the machine store. At the latest when the certificates are to be renewed after two years, things get complicated here.
It is therefore a good idea to use your own certificate templates for NDES. These can be adapted in terms of their key length, for example. The use of hardware security modules (HSM) is also possible in this way. Even automatic renewal can be configured.
In order for a smart card logon to be successful, some requirements must be met in the Active Directory environment:
When installing a subordinate certification authority, you may encounter the following behavior:
Continue reading "Description of the EDITF_ADDOLDKEYUSAGE flag"
PKI administrators often assume that the option in the certificate template not to allow the private key to be exported is binding.
However, that is not the case.
Over the generations of Windows operating systems, various certificate templates for domain controllers have been established. In a current Active Directory directory service, one will find three different templates for this purpose.
Below is a description of each template and a recommendation for configuring domain controller certificate templates.
Continue reading "Overview of the different generations of domain controller certificates"
Assume the following scenario:
Continue reading "The Online Responder (OCSP) requests new signing certificates every four hours"