Tag: DisableExtensionList

The "Application Policies" certificate extension

The purposes for which a digital certificate may be used are controlled via the certificate extensions "Key Usage" and "Extended Key Usage".

The "Extended Key Usage" certificate extension contains the extended key usages for which the certificate may be used.

However, certificates issued by a Microsoft certification authority contain another certificate extension called "Application Policies", which also contains a list very similar to the Extended Key Usages extension.

Continue reading "The "Application Policies" certificate extension"

New certificates are regularly requested via autoenrollment

Assume the following scenario:

  • A certificate template is configured for automatic request and issuance (autoenrollment).
  • Users or computers request new certificates at regular intervals and long before the defined renewal period.

Continue reading "New certificates are regularly requested via autoenrollment"

The "S/MIME Capabilities" certificate extension

When S/MIME certificates are issued, they usually contain a certificate extension "S/MIME Capabilities". This certificate extension is specified in RFC 4262 and can be used by compatible e-mail programs to specify the symmetric algorithms supported by the recipient of an encrypted message. The sender should then choose the strongest algorithm supported by the recipient.

Among others, Microsoft Outlook evaluates the extension and uses it to determine the symmetric algorithm for an encrypted email.

Continue reading "The "S/MIME Capabilities" certificate extension"

Removing ADCS-specific extensions from certificates

When using Active Directory Certificate Services, it is noticeable that there are certain extensions in the certificates of the certification authorities and the certificates they issue that are not defined in the relevant RFCs and are specific to AD CS.

Continue reading "Removing ADCS-specific extensions from certificates"

The Online Responder (OCSP) requests new signing certificates every four hours

Assume the following scenario:

  • The Online Responders are configured to request signing certificates using a certificate template from an Active Directory integrated certification authority.
  • The Online Responders request a new signing certificate at regular intervals (every four hours), even though the existing certificate is still valid for a sufficiently long time.

Continue reading "The Online Responder (OCSP) requests new signing certificates every four hours"