Tag: Domain controller

Smart card logon fails with error message "A certification chain processed correctly, but one of the CA certificates is not trusted by the policy provider. 0x800b0112 (-2146762478 CERT_E_UNTRUSTEDCA)"

Assume the following scenario:

  • The company would like to use smart card logon.
  • The domain controllers are equipped with certificates that can be used for smart card logon .
  • The users are equipped with certificates that can be used for smart card logon.
  • Logon to the domain via smart card fails with the following error message:
A certification chain processed correctly, but one of the CA certificates is not trusted by the policy provider. 0x800b0112 (-2146762478 CERT_E_UNTRUSTEDCA)

Continue reading "Smart card logon fails with error message "A certification chain processed correctly, but one of the CA certificates is not trusted by the policy provider. 0x800b0112 (-2146762478 CERT_E_UNTRUSTEDCA)""

Logon error with Windows Hello for Business: "Contact your system administrator and tell them that the KDC certificate could not be validated."

Assume the following scenario:

  • The company is using Windows Hello for Business.
  • Users receive the following error message when logging on to the client:
Sign-in failed. Contact your system administrator and tell them that the KDC certificate could not be validated. Additional information may be available in the system event log.

Continue reading "Logon error with Windows Hello for Business: "Contact your system administrator and tell them that the KDC certificate could not be validated.""

About the "Build this from Active Directory information" option for certificate templates

When configuring a certificate template, one must decide on the intended certificate content, i.e., among other things, which identities are confirmed by the certificates and how they are mapped.

In the "Subject Name" tab of the certificate template configuration dialog, you can configure how the identity confirmed by the certificate is mapped.

Continue reading "About the "Build this from Active Directory information" option for certificate templates"

Details of the event with ID 75 of the source Microsoft-Windows-CertificationAuthority

Event Source:Microsoft-Windows-CertificationAuthority
Event ID:75 (0x4B)
Event log:Application
Event type:Error
Symbolic Name:MSG_E_DELTA_CRL_PUBLICATION_HOST_NAME
Event text (English):Active Directory Certificate Services could not publish a Delta CRL for key %1 to the following location on server %4: %2. %3.%5%6
Event text (German):Es konnte keine Delta-Zertifikatsperrliste für den Schlüssel %1 an folgendem Ort auf dem Server "%4" veröffentlicht werden: %2. %3.%5%6

Continue reading "Details of the event with ID 75 of the source Microsoft-Windows-CertificationAuthority"

Details of the event with ID 74 of the source Microsoft-Windows-CertificationAuthority

Event Source:Microsoft-Windows-CertificationAuthority
Event ID:74 (0x4A)
Event log:Application
Event type:Error
Symbolic Name:MSG_E_BASE_CRL_PUBLICATION_HOST_NAME
Event text (English):Active Directory Certificate Services could not publish a Base CRL for key %1 to the following location on server %4: %2. %3.%5%6
Event text (German):Es konnte keine Basis-Zertifikatsperrliste für den Schlüssel %1 an folgendem Ort auf dem Server "%4" veröffentlicht werden: %2. %3.%5%6

Continue reading "Details of the event with ID 74 of the source Microsoft-Windows-CertificationAuthority"

Details of the event with ID 66 of the source Microsoft-Windows-CertificationAuthority

Event Source:Microsoft-Windows-CertificationAuthority
Event ID:66 (0x42)
Event log:Application
Event type:Error
Symbolic Name:MSG_E_DELTA_CRL_PUBLICATION
Event text (English):Active Directory Certificate Services could not publish a Delta CRL for key %1 to the following location: %2. %3.%5%6
Event text (German):Es konnte keine Delta-Zertifikatsperrliste für den Schlüssel %1 an folgendem Ort veröffentlicht werden: %2. %3.%5%6

Continue reading "Details of the event with ID 66 of the source Microsoft-Windows-CertificationAuthority"

Details of the event with ID 65 of the source Microsoft-Windows-CertificationAuthority

Event Source:Microsoft-Windows-CertificationAuthority
Event ID:65 (0x41)
Event log:Application
Event type:Error
Symbolic Name:MSG_E_BASE_CRL_PUBLICATION
Event text (English):Active Directory Certificate Services could not publish a Base CRL for key %1 to the following location: %2. %3.%5%6
Event text (German):Es konnte keine Basis-Zertifikatsperrliste für den Schlüssel %1 an folgendem Ort veröffentlicht werden: %2. %3.%5%6

Continue reading "Details of the event with ID 65 of the source Microsoft-Windows-CertificationAuthority"

Configuring a Certificate Template for Domain Controllers

Even with a certificate template for domain controllers that is supposedly simple to configure, there are a few things to keep in mind.

Continue reading "Configuring a Certificate Template for Domain Controllers"

Prevent smart card logon to the network

Installing Active Directory Certificate Services in the default configuration automatically configures the environment so that smart card logons are accepted by the domain controllers.

Therefore, if the use of smart card logons is not desired, it makes sense to disable the functionality in order not to jeopardize Active Directory in the event the certification authority is compromised.

Continue reading "Prevent smart card logon to the network"

Certificates for domain controllers do not contain the domain name in the Subject Alternative Name (SAN)

Assume the following scenario:

  • Certificates for domain controllers are issued by an Active Directory integrated certification authority (enterprise CA)
  • The certificate template used for this purpose was created by yourself
  • The issued certificates contain in the Subject Alternative Name (SAN) only the fully qualified computer name of the respective domain controller, but not the fully qualified name and the NETBIOS name of the domain

Continue reading "Certificates for domain controllers do not contain the domain name in the Subject Alternative Name (SAN)"

Logon via smart card fails with error message "Signing in with a security device isn't supported for your account."

Assume the following scenario:

  • A user has a Smartcard Logon certificate and uses it to log on to the Active Directory domain.
  • The logon fails. The following error message is returned to the user on their computer:
Signing in with a security device isn't supported for your account. For more info, contact your administrator.

Continue reading "Logon via smart card fails with error message "Signing in with a security device isn't supported for your account.""

Logon via smart card fails with error message "The revocation status of the authentication certificate could not be determined."

Assume the following scenario:

  • A user has a Smartcard Logon certificate and uses it to log on to the Active Directory domain.
  • The logon fails. The following error message is returned to the user on their computer:
The revocation status of the authentication certificate could not be determined.

Continue reading "Logon via smart card fails with error message "The revocation status of the authentication certificate could not be determined.""

Firewall rules required for Active Directory Certificate Services

Implementing an Active Directory integrated certification authority often requires planning the firewall rules to be created on the network. The following is a list of the required firewall rules and any pitfalls.

Continue reading "Firewall rules required for Active Directory Certificate Services"

Overview of the different generations of domain controller certificates

Over the generations of Windows operating systems, various certificate templates for domain controllers have been established. In a current Active Directory directory service, one will find three different templates for this purpose.

  • Domain Controller
  • Domain Controller Authentication
  • Kerberos Authentication

Below is a description of each template and a recommendation for configuring domain controller certificate templates.

Continue reading "Overview of the different generations of domain controller certificates"