Tag: certutil

After a certificate has been revoked, a new CRL must be created and published so that entities that check the revocation status are informed of the revocation. Since the CRL has a relatively short expiration date, it must be reissued at regular intervals even if the content is not changed.

Continue reading "Create and publish a certificate revocation list"

When a certificate is revoked, its serial number is placed on the CRL. Entities that check the revocation of a certificate then consider it to be no longer valid.

Continue reading "Revoking an issued certificate"

For stronger control over the certificates that can be issued by a certification authority, a path length constraint can be set up so that certification authorities from a defined hierarchy level onward are no longer able to issue subordinate certification authority certificates

For an explanation of how the path length constraint works, see the article "Basics: Path Length Constraint" .

Continue reading "Configure Path Length Constraint for Certificates Issued by a Certification Authority"

Assume the following scenario:

• An Active Directory integrated certification authority (enterprise CA) is integrated in the network.
• The certification authority was migrated to a new server (see also the article "Migration of an Active Directory integrated certification authority (Enterprise Certification Authority) to another server ").
• When publishing the certificate templates, one notices that only the default certificate templates can be selected for publication. Custom certificate templates are not displayed.

Continue reading "After installing or migrating a certification authority to a new server, you can no longer publish your own certificate templates"

After a certificate enrollment policy is configured and used by a subscriber, the results are cached locally (Enrollment Policy Cache).

If changes are now made to the infrastructure, for example by publishing or removing a new certificate template on a certification authority accessible via Certificate Enrollment Web Service (CES), these changes are not immediately visible to subscribers due to the cache.

For this reason, it may be helpful to view or clear the cache.

Continue reading "View and clear the certificate enrollment policy cache for the Certificate Enrollment Policy Web Service (CEP)"

By default, all domain members automatically replicate the Public Key Services object of the Active Directory forest through the autoenrollment process. The triggers for this are:

• When the user logs on (for computers, when the computer account logs on, i.e. at system startup).
• By timer every 8 hours.
• When updating Group Policy, assuming there has been a change.

If you do not want to wait for the autoenrollment to be triggered automatically, you can start it manually. The different ways to run the autoenrollment process are described below.

Continue reading "Manually running the autoenrollment process"

Often, before submitting a certificate request to a certification authority - or before issuing the certificate - you want to verify that it contains the desired values.

The following describes how to achieve this.

Continue reading "Inspect a certificate request (CSR)"

Sometimes it is necessary to change the Subject Distinguished Name (also called Subject or Subject DN, in German also "Antragsteller" or "Betreff") of a certificate request before issuing the certificate.

Under certain circumstances, this is certainly possible, as described below.

Continue reading "Subsequently change the Subject Distinguished Name (DN) of a certificate request (CSR)"

There may be cases where it is necessary to install the standard Microsoft certificate templates before installing the first Active Directory integrated certification authority (Enterprise Certification Authority), or to reinstall the templates, for example because they have been corrupted or otherwise modified.

Continue reading "(Re-)Installing the Microsoft Standard Certificate Templates"

Unfortunately, far too many instructions are circulating online (the big players are not exempt from this either, not even Microsoft itself or the grand master Komar ), which fatally recommend setting the EDITF_ATTRIBUTESUBJECTALTNAME2 flag on the certification authority - supposedly so that one would be able to issue certificates with a Subject Alternative Name (SAN) extension for manually submitted certificate requests.

Unfortunately, this approach is not only unnecessary, it also has some unpleasant side effects, which in the worst case can help an attacker to take over the entire Active Directory forest.

Continue reading "Active Directory forest compromised by EDITF_ATTRIBUTESUBJECTALTNAME2 flag"

When installing a subordinate certification authority, you may encounter the following behavior:

• One requests a Key Usage extension that is marked as critical, for example, or does not include DigitalSignature.
• However, the certificate issued by the parent certification authority includes DigitalSignature, and the Key Usage extension is marked as non-critical.
• The parent certification authority is a standalone certification authority, i.e. without Active Directory integration.

Continue reading "Description of the EDITF_ADDOLDKEYUSAGE flag"

PKI administrators often assume that the option in the certificate template not to allow the private key to be exported is binding.

However, that is not the case.

Continue reading "How secure is the "Allow private key to be exported" setting in the certificate templates?"

Sometimes it is necessary to import a certificate that uses a software key into a smart card.

Continue reading "Importing a certificate into a smart card"

Sometimes it happens that the database of the certification authority becomes extremely large. Perhaps a large number of certificate requests have arrived unnoticed and have been rejected, or perhaps there are many certificates in the database that have been issued twice. Before the certification authority database can be compacted , these entries must first be deleted in order to free up the storage space in the database.

Continue reading "(Mass) deletion of entries in the certification authority database (certificates, requests, CRLs)"

Sometimes it happens that the database of the certification authority becomes extremely large. Perhaps a large number of certificate requests have arrived unnoticed and have been denied, or perhaps there are many certificates in the database that have been issued twice. After the corresponding entries have been deleted from the certification authority database , the space now gained must (can) still be freed in the server's file system by compacting the database.

Continue reading "Compacting (defragmenting) the certification authority database"