Tag: certutil

Assume the following scenario:

• A web server certificate was generated using an ML-DSA-based key pair.
• We would like to bind it to Internet Information Services (IIS).
• The configuration fails with the following error message:

There was an error while performing this operation.

Details: 

A specified logon session does not exist. It may already have been terminated. (Exception from HRESULT: 0x80070520)

Continue reading "Configuring an SSL certificate binding for Microsoft Internet Information Server (IIS) fails with an error message when using ML-DSA-based keys"

During penetration tests and also for attackers searching the network for potential targets, insights into the configuration of the certification authority are highly interesting.

In addition to possible misconfigurations, attackers can obtain information about the policy module used on the certification authority.

Continue reading "Prevent unprivileged accounts from reading the configuration of the certification authority"

Assume the following scenario:

• The company would like to use smart card logon.
• The domain controllers are equipped with certificates that can be used for smart card logon .
• The users are equipped with certificates that can be used for smart card logon.
• Logon to the domain via smart card fails with the following error message:

A certification chain processed correctly, but one of the CA certificates is not trusted by the policy provider. 0x800b0112 (-2146762478 CERT_E_UNTRUSTEDCA)

Continue reading "Smart card logon fails with error message "A certification chain processed correctly, but one of the CA certificates is not trusted by the policy provider. 0x800b0112 (-2146762478 CERT_E_UNTRUSTEDCA)""

Like any software Microsoft Active Directory Certificate Services are also subject to certain limits imposed by their design.

What is not so obvious is the question of how many subject alternative names (SAN) can be issued with the Microsoft certification authority.

The IETF RFC 5280 describes the structure for Subject Alternative Names as follows:

SubjectAltName ::= GeneralNames

Continue reading "How many Subject Alternative Names (SAN) do the Active Directory Certificate Services support?"

For the encryption of email messages, companies typically use the Secure / Multipurpose Internet Message Extensions (S/MIME) standard and provide their users with appropriate certificates for this purpose.

An important aspect here is that the users' private keys should be secured centrally - in contrast to the signing certificates that are otherwise mostly used. Incoming messages are encrypted for a specific private key and can only be decrypted again by this key . Thus a backup of these keys must absolutely be available - this is also indispensable for synchronization to mobile devices . For this purpose, the Microsoft Active Directory Certificate Services offer the private key archival function.

But what if private key archival has not been set up and users have already requested corresponding certificates?

Continue reading "Subsequent archiving of private keys"

In the article "Signing certificates bypassing the certification authority " I described how an attacker with administrative rights on the certification authority can generate a logon certificate for administrative accounts of the domain by bypassing the certification authority software, i.e. by directly using the private key of the certification authority.

In the previous article I used the PSCertificateEnrollment Powershell Module to demonstrate the procedure. However, with certreq and certutil Microsoft already ships perfectly suitable pentesting tools directly with the operating system ex works.

Continue reading "Signing certificates bypassing the certification authority - solely using built-in tools"

Usually, the encoding of characters and strings in certificates is not a topic of great interest to the users of a PKI. However, there are cases where the default settings of the certification authority do not provide the desired results.

Continue reading "Character encoding in the Subject Distinguished Name of certificate requests and issued certificates"

Assume the following scenario:

• A certification authority uses a hardware security module (HSM) .
• The partition of the hardware security module fills up with more and more keys over the lifetime of the certification authority.
• With SafeNet hardware security modules, this can even cause the partition to run full. As a result, the events 86 and 88 are logged by the certification authority.

Continue reading "The partition of the hardware security module (HSM) fills up"

Assume the following scenario:

• With certutil a verification of the domain controller certificates is performed.
• The operation fails with the following error message:

0: DC01

*** Testing DC[0]: DC01
Enterprise Root store: Access is denied. 0x80070005 (WIN32: 5 ERROR_ACCESS_DENIED)
KDC certificates: Access is denied. 0x80070005 (WIN32: 5 ERROR_ACCESS_DENIED)

CertUtil: -DCInfo command FAILED: 0x80070005 (WIN32: 5 ERROR_ACCESS_DENIED)
CertUtil: Access is denied.

Continue reading "Verification of the domain controller certificates throws the error code ERROR_ACCESS_DENIED"

I recently encountered the phenomenon that due to a faulty request logic, several users had made new certificate requests at regular intervals.

The certificate template was configured to have incoming certificate requests approved by a certificate manager, i.e., certificates were not issued automatically. Certificate requests were to be checked using a separate code and then approved.

One would now expect that (since all certificate requests would eventually be approved) users would now find multiple certificates of the same type in their certificate store (and the applications that use it). However, this was not the case.

Continue reading "What happens if a user has requested multiple certificates?"

If you want to formulate queries against the certification authority database , you must first know what you want to look for.

There is a possibility to output the database schema of the certification authority database.

Continue reading "The database schema of the certification authority database"

Assume the following scenario:

• A certification authority is migrated to another server or restored from backup .
• A hardware security module (HSM) is used to protect the private key of the certification authority certificate.
• The certification authority certificate is now to be restored on the target system and linked to the private key .
• The operation fails with the following error message:

Cannot find the certificate and private key for decryption.
CertUtil: -repairstore command FAILED: 0x80092004 (-2146885628 CRYPT_E_NOT_FOUND)
CertUtil: Cannot find object or property.

Continue reading "Reconnecting to the private key fails with error message "Cannot find object or property. 0x80092004 (-2146885628 CRYPT_E_NOT_FOUND)""

Assume the following scenario:

• For the first time, a certification authority (Enterprise Certification Authority) integrated into Active Directory is to be installed in the network.
• The rights to install the certification authority have been delegated to a separate security group or account for security reasons, so no logon as Enterprise Administrator is required. Put another way: The user used is not a member of the Enterprise Administrators group in the Active Directory forest.
• Since this is the first certification authority in the network, no default certificate templates are installed in Active Directory yet. When opening the certificate template management console (certtmpl.msc), one is prompted to install them.
• The installation fails with the following error message:

Windows could not install the new certificate templates. This security ID may not be assigned as the owner of this object.

Continue reading "Installation of the default certificate templates fails with error message "This security ID may not be assigned as the owner of this object.""

Assume the following scenario:

• An Appx package is to be signed.
• For this purpose, SignTool.exe is used.
• The code signing certificate used was recently renewed.
• The signing process with the new code signing certificate fails with the following error message:

"Error: SignerSign() failed." (-2147024885/0x8007000b) 

Continue reading "Code signing of Appx packages via SignTool.exe fails with error code 0x8007000b (ERROR_BAD_FORMAT)"

Sometimes it is necessary to issue certificates with a shorter validity period than configured in the certificate template. Therefore, you may not want to reconfigure the certificate template right away or create another certificate template.

Continue reading "Issue certificates with shortened validity period"