Some will have noticed that the certificate store for intermediate CAs usually also contains certificates for root CAs.
As a rule, this behavior is not critical. In certain cases however, this can also cause problems with applications.
If you restore a certification authority from a backup after a disaster has occurred , you will probably find that certificates were issued in the period between the last backup and the system failure with corresponding data loss.
These certificates are now not stored in the restored certification authority database, so they cannot be restored if needed.
If you are using the SMTP Exit Module, you can at least determine the serial numbers of the certificates from the sent e-mails and revoke them.
Continue reading "Restoring certificates from the SMTP Exit Module data"
Assume the following scenario:
Assume the following scenario:
The following is a troubleshooting guide.
Assume the following scenario:
Server could not be reached: The RPC server is unavailable. 0x800706ba (WIN32: 1722 RPC_S_SERVER_UNAVAILABLE) -- (31ms)
CertUtil: -ping command FAILED: 0x800706ba (WIN32: 1722 RPC_S_SERVER_UNAVAILABLE)
CertUtil: The RPC server is unavailable.Assume the following scenario:
ICertAdmin::RevokeCertificate: The data is invalid. 0x8007000d (WIN32: 13 ERROR_INVALID_DATA)For troubleshooting e-mail messages encrypted using Secure/Multipurpose Internet Mail Extensions (S/MIME), the encrypted part of a message can be exported. See article "Microsoft Outlook: Extracting an encrypted S/MIME message from an email ".
To find out with which certificates a message has been encrypted, you can proceed as follows...
Continue reading "Microsoft Outlook: Find out recipient certificates for S/MIME encrypted mails"
Below is a description of where it is possible to view which symmetric algorithm was used to encrypt an email received, and which hash algorithm was used for a signed email.
Some Windows events generated by the certification authority are only generated from a certain logging level.
The following describes how to determine and change the logging level of a certification authority.
Continue reading "Configure the logging level (log level) for the certification authority event log"
| Event Source: | Microsoft-Windows-CertificationAuthority |
| Event ID: | 74 (0x4A) |
| Event log: | Application |
| Event type: | Error |
| Symbolic Name: | MSG_E_BASE_CRL_PUBLICATION_HOST_NAME |
| Event text (English): | Active Directory Certificate Services could not publish a Base CRL for key %1 to the following location on server %4: %2. %3.%5%6 |
| Event text (German): | Es konnte keine Basis-Zertifikatsperrliste für den Schlüssel %1 an folgendem Ort auf dem Server "%4" veröffentlicht werden: %2. %3.%5%6 |
A useful hardening measure for certification authorities is to restrict the certification authority certificates so that they are only trusted for the extended key usages (Extended Key Usage) actually issued.
In the event of a compromise of the certification authority, the damage is then limited to these Extended Key Usages. The smart card logon extended key usage would then only be present in the certification authority certificate of the certification authority that actually issues such certificates.
Assume the following scenario:
certutil -ping -kerberos -config "https://{Servername}/ADPolicyProvider_CEP_Kerberos/service.svc/CEP" CEP The certutil command is incorrectly detected by Windows Defender or Windows Defender Advanced Threat Protection as Win32/Ceprolad.A.
Continue reading "Windows Defender detects certutil as malware (Win32/Ceprolad.A)"
In contrast to operational events, which are often understood under the term "monitoring", auditing for the certification authority is the configuration of logging of security-relevant events.
After installing a certification authority, after migrating to a new server, or after more extensive maintenance work, an extensive functional test should be performed to ensure that all components of the certification authority are working as desired.
Continue reading "Performing a functional test for a certification authority"
Sometimes it is necessary for a certificate issued by a certification authority to be withdrawn from circulation even before its expiration date. To make this possible, a certification authority maintains a certificate revocation list. This is a signed file with a relatively short expiration date, which is used in combination with the certificate to check its validity.
In some cases (for example, with an offline certification authority, or if non-standard LDAP CRL distribution points have been configured), the certificate revocation list must be manually published to Active Directory.