Tag: Enrollment Agent

Change the Subject Alternative Name (SAN) of a certificate before it is issued - but do it securely!

On the internet, there are unfortunately far too many instructions (the big players are not excluded from this , not even Microsoft itself or the grandmaster Komar ), which fatally recommend that the flag EDITF_ATTRIBUTESUBJECTALTNAME2 should be set on the certification authority - supposedly to be able to issue certificates with Subject Alternative Name (SAN) extension for manually submitted certificate requests.

Unfortunately, this procedure is not only unnecessary, it also has some unpleasant side effects, which in the worst case can help an attacker to take over the entire Active Directory forest .

Continue reading "Change the Subject Alternative Name (SAN) of a certificate before it is issued - but do it securely!"

Certificate request fails with error message "The request is missing required signature policy information. 0x80094809 (-2146875383 CERTSRV_E_SIGNATURE_POLICY_REQUIRED)".

Assume the following scenario:

  • A user sends a certificate request to a certification authority.
  • The certificate request fails with the following error message:
The request is missing required signature policy information. 0x80094809 (-2146875383 CERTSRV_E_SIGNATURE_POLICY_REQUIRED)
Denied by Policy Module

Continue reading "Certificate request fails with error message "The request is missing required signature policy information. 0x80094809 (-2146875383 CERTSRV_E_SIGNATURE_POLICY_REQUIRED)"."

Requesting certificates via Enroll on Behalf of (EOBO) is not possible because the certificate template is not displayed. The error message is "The certificate template requires too many RA signatures."

Assume the following scenario:

  • A certificate is requested for a user or a computer from a certification authority via the certificate management console (certlm.msc or certmgr.msc).
  • The Enroll on Behalf of (EOBO) mechanism is used for this.
  • The desired certificate template is not displayed.
  • If you check the "Show all templates" checkbox, the following error message will be displayed for the desired certificate template:
The certificate template requires too many RA signatures. Only one RA signature is allowed. Multiple request agent signatures are not permitted on a certificate request.

Continue reading "Requesting certificates via Enroll on Behalf of (EOBO) is not possible because the certificate template is not displayed. The error message is "The certificate template requires too many RA signatures.""

Basics: Network Device Enrollment Service (NDES)

The Simple Certificate Enrollment Protocol (SCEP) was developed by Verisign for Cisco in the early 2000s to provide a simplified method for requesting certificates. Previously, network devices required manually generating a certificate request on each device, submitting it to a certification authority, and then manually installing the issued certificate on the corresponding device again.

Continue reading "Basics: Network Device Enrollment Service (NDES)"

Subsequently change the Subject Distinguished Name (DN) of a certificate request (CSR)

Sometimes it is necessary to change the Subject Distinguished Name (also called Subject or Subject DN, in German also "Antragsteller" or "Betreff") of a certificate request before issuing the certificate.

Under certain circumstances, this is certainly possible, as described below.

Continue reading "Subsequently change the Subject Distinguished Name (DN) of a certificate request (CSR)"

Configuring the Network Device Enrollment Service (NDES) to work with a Group Managed Service Account (gMSA)

For security reasons, it may make sense to operate NDES with a Group Managed Service Account (gMSA) instead of a normal domain account. This option offers the charming advantage that the password of the account is changed automatically, and thus this step does not have to be done manually, which is unfortunately forgotten far too often.

Continue reading "Configuring the Network Device Enrollment Service (NDES) to work with a Group Managed Service Account (gMSA)"

Renew the Registration Authority (RA) certificates for the Network Device Enrollment Service (NDES)

Once NDES has been in operation for some time (typically two years), one is faced with the challenge of renewing the Registration Authority (RA) certificates. Unfortunately, this process is not necessarily solved intuitively and is therefore described in more detail in this article.

Continue reading "Renew the Registration Authority (RA) certificates for the Network Device Enrollment Service (NDES)"

Using custom Registration Authority (RA) certificate templates for the Network Device Enrollment Service (NDES)

The Network Device Enrollment Service (NDES) uses two certificate templates for its internal function to make it act as a Registration Authority (RA). These are published during role configuration of the NDES service on the configured certification authority and certificates are requested:

  • CEP Encryption
  • Exchange Enrollment Agent (Offline Request)

These certificate templates are standard templates from the Windows 2000 world (version 1 templates), i.e. they cannot be edited. In addition, the Exchange Enrollment Agent (Offline Request) template is marked as a user template, i.e. during NDES role configuration the certificate is requested in the context of the installing user and then imported into the machine store. At the latest when the certificates are to be renewed after two years, things get complicated here.

It is therefore a good idea to use your own certificate templates for NDES. These can be adapted in terms of their key length, for example. The use of hardware security modules (HSM) is also possible in this way. Even automatic renewal can be configured.

Continue reading "Using custom Registration Authority (RA) certificate templates for the Network Device Enrollment Service (NDES)"