Tag: certlm.msc

Assume the following scenario:

• You try to request a certificate via a Certificate Enrollment Policy Web Service (CEP) from an Active Directory-integrated certification authority (Enterprise Certification Authority).
• To do this, you use the Microsoft Management Console (MMC), either for the logged-on user (certmgr.msc) or for the computer (certlm.msc).
• However, the list of available certificate templates within the MMC is completely empty.
• In the list of available certificate templates within the MMC, you choose to show all certificate templates. All desired certificate templates show:

Cannot find Object or property.
A valid certification authority (CA) configured to issue certificates based on this template cannot be located, or the CA does not support this operation, or the CA is not trusted. 

Continue reading "Requesting certificates via the Certificate Enrollment Policy Web Service (CEP) fails with error message "A valid certification authority (CA) configured to issue certificates based on this template cannot be located, or the CA does not support this operation, or the CA is not trusted.""

The following describes how to install the Certificate Enrollment Policy Web Service (CEP).

Continue reading "Installing a Certificate Enrollment Policy Web Service (CEP)"

The following describes the process that runs in the background when certificates are requested manually or automatically in order to achieve the highest possible level of automation.

Continue reading "Basics: Manual and automatic certificate requests via Lightweight Directory Access Protocol (LDAP) and Remote Procedure Call / Distributed Common Object Model (RPC/DCOM) with the MS-WCCE protocol"

Once NDES has been in operation for some time (typically two years), one is faced with the challenge of renewing the Registration Authority (RA) certificates. Unfortunately, this process is not necessarily solved intuitively and is therefore described in more detail in this article.

Continue reading "Renew the Registration Authority (RA) certificates for the Network Device Enrollment Service (NDES)"

With the Chromium project and products based on it such as Google Chrome and Microsoft Edge, Google has moved to enforcing RFC 2818 , which was adopted in 2000, and to no longer trusting certificates that no longer fulfill the RFC.

For us, the following sentence is highly significant:

If a subjectAltName extension of type dNSName is present, that MUST be used as the identity. Otherwise, the (most specific) Common Name field in the Subject field of the certificate MUST be used. Although the use of the Common Name is existing practice, it is deprecated and Certification Authorities are encouraged to use the dNSName instead

— https://tools.ietf.org/html/rfc2818

Continue reading "Generating an RFC 2818 compliant certificate request for SSL certificates"

Assume the following scenario:

• One installs a Network Device Enrollment Service (NDES) server.
• The role configuration fails with the following error message:

Insufficient access rights to perform this operation. 0x80072098 (WIN32: 8344 ERROR_DS_INSUFF_ACCESS_RIGHTS

Typically, the NDES role configuration requires that the installing user is a member of the Enterprise Admins group . However, this is not technically necessary and contradicts Microsoft's security hardening recommendations, since NDES is not (necessarily) a system that is assigned to the highest security layer (Tier-0).

Below is a way to configure the NDES role even without the required permissions.

Continue reading "Installing the Network Device Enrollment Service (NDES) without Enterprise Administrator permissions"

The Network Device Enrollment Service (NDES) uses two certificate templates for its internal function to make it act as a Registration Authority (RA). These are published during role configuration of the NDES service on the configured certification authority and certificates are requested:

• CEP Encryption
• Exchange Enrollment Agent (Offline Request)

These certificate templates are standard templates from the Windows 2000 world (version 1 templates), i.e. they cannot be edited. In addition, the Exchange Enrollment Agent (Offline Request) template is marked as a user template, i.e. during NDES role configuration the certificate is requested in the context of the installing user and then imported into the machine store. At the latest when the certificates are to be renewed after two years, things get complicated here.

It is therefore a good idea to use your own certificate templates for NDES. These can be adapted in terms of their key length, for example. The use of hardware security modules (HSM) is also possible in this way. Even automatic renewal can be configured.

Continue reading "Using custom Registration Authority (RA) certificate templates for the Network Device Enrollment Service (NDES)"

Assume the following scenario:

• You try to request a certificate from an Active Directory integrated certification authority (enterprise CA).
• To do this, you use the Microsoft Management Console (MMC), either for the logged-on user (certmgr.msc) or for the computer (certlm.msc).
• However, the desired certificate template is not offered for selection, even though it has been correctly published on the certification authority.
• The logged-on user (or computer) also has the necessary permissions to request certificates from the certificate template in question (Enroll).
• In the list of available certificate templates within the MMC, you have all certificate templates displayed. The desired certificate template shows:

A valid certification authority (CA) configured to issue certificates based on this template cannot be located, or the CA does not support this operation, or the CA is not trusted.

Continue reading "Requesting a certificate fails with the error message "A valid certification authority (CA) configured to issue certificates based on this template cannot be located, or the CA does not support this operation, or the CA is not trusted.""