Tag: Enroll on Behalf of (EOBO)

Change the Subject Alternative Name (SAN) of a certificate before it is issued - but do it securely!

On the internet, there are unfortunately far too many instructions (the big players are not excluded from this , not even Microsoft itself or the grandmaster Komar ), which fatally recommend that the flag EDITF_ATTRIBUTESUBJECTALTNAME2 should be set on the certification authority - supposedly to be able to issue certificates with Subject Alternative Name (SAN) extension for manually submitted certificate requests.

Unfortunately, this procedure is not only unnecessary, it also has some unpleasant side effects, which in the worst case can help an attacker to take over the entire Active Directory forest .

Continue reading "Change the Subject Alternative Name (SAN) of a certificate before it is issued - but do it securely!"

Requesting certificates via Enroll on Behalf of (EOBO) fails with the error message "The operation is denied. It can only be performed by a certificate manager that is allowed to manage certificates for the current requester."

  • A certificate is requested for a user from a certification authority via the certificate management console (certmgr.msc).
  • This uses the Enroll on Behalf of (EOBO) mechanism.
  • The certificate request fails with the following error message:
The operation is denied. It can only be performed by a certificate manager that is allowed to manage certificates for the current requester.

Continue reading "Requesting certificates via Enroll on Behalf of (EOBO) fails with the error message "The operation is denied. It can only be performed by a certificate manager that is allowed to manage certificates for the current requester.""

Requesting certificates via Enroll on Behalf of (EOBO) fails with the error message "A certification chain processed correctly, but one of the CA certificates is not trusted by the policy provider. 0x800b0112 (-2146762478 CERT_E_UNTRUSTEDCA)"

  • A certificate is requested for a user from a certification authority via the certificate management console (certmgr.msc).
  • This uses the Enroll on Behalf of (EOBO) mechanism.
  • The certificate request fails with the following error message:
A certification chain processed correctly, but one of the CA certificates is not trusted by the policy provider. 0x800b0112 (-2146762478 CERT_E_UNTRUSTEDCA)

Continue reading "Requesting certificates via Enroll on Behalf of (EOBO) fails with the error message "A certification chain processed correctly, but one of the CA certificates is not trusted by the policy provider. 0x800b0112 (-2146762478 CERT_E_UNTRUSTEDCA)""

Requesting certificates via Enroll on Behalf of (EOBO) is not possible because the certificate template is not displayed. The error message is "The certificate template requires too many RA signatures."

Assume the following scenario:

  • A certificate is requested for a user or a computer from a certification authority via the certificate management console (certlm.msc or certmgr.msc).
  • The Enroll on Behalf of (EOBO) mechanism is used for this.
  • The desired certificate template is not displayed.
  • If you check the "Show all templates" checkbox, the following error message will be displayed for the desired certificate template:
The certificate template requires too many RA signatures. Only one RA signature is allowed. Multiple request agent signatures are not permitted on a certificate request.

Continue reading "Requesting certificates via Enroll on Behalf of (EOBO) is not possible because the certificate template is not displayed. The error message is "The certificate template requires too many RA signatures.""

Basics: Network Device Enrollment Service (NDES)

The Simple Certificate Enrollment Protocol (SCEP) was developed by Verisign for Cisco in the early 2000s to provide a simplified method for requesting certificates. Previously, network devices required manually generating a certificate request on each device, submitting it to a certification authority, and then manually installing the issued certificate on the corresponding device again.

Continue reading "Basics: Network Device Enrollment Service (NDES)"

Is there a dependency of the Network Device Enrollment Service (NDES) on the NTAuthCertificates object?

The Network Device Enrollment Service (NDES) has two Registration Authority certificates. The Enrollment Agent certificate is used to sign certificate requests, and one can configure the NDES device template accordingly, so that certificates are only issued if the submitted certificate requests also have a corresponding signature .

If you plan to remove the certification authority connected to NDES from the NTAuthCertificates object , the question may arise as to whether mutual dependencies need to be taken into account here - after all, Enroll on Behalf Of (EOBO) requires the presence of the certification authority certificate in NTAuthCertificates.

Continue reading "Is there a dependency of the Network Device Enrollment Service (NDES) on the NTAuthCertificates object?"

Details of the event with ID 22 of the source Microsoft-Windows-CertificationAuthority

Event Source:Microsoft-Windows-CertificationAuthority
Event ID:22 (0x16)
Event log:Application
Event type:Error
Symbolic Name:MSG_E_PROCESS_REQUEST_FAILED_WITH_INFO
Event text (English):Active Directory Certificate Services could not process request %1 due to an error: %2. The request was for %3. Additional information: %4
Event text (German):Die Anforderung %1 konnte aufgrund eines Fehlers nicht ausgeführt werden: %2. Die Anforderung bezog sich auf %3. Weitere Informationen: %4

Continue reading "Details of the event with ID 22 of the source Microsoft-Windows-CertificationAuthority"

Details of the event with ID 21 of the source Microsoft-Windows-CertificationAuthority

Event Source:Microsoft-Windows-CertificationAuthority
Event ID:21 (0x15)
Event log:Application
Event type:Error
Symbolic Name:MSG_E_PROCESS_REQUEST_FAILED
Event text (English):Active Directory Certificate Services could not process request %1 due to an error: %2. The request was for %3.
Event text (German):Die Anforderung %1 konnte aufgrund eines Fehlers nicht ausgeführt werden: %2. Die Anforderung bezog sich auf %3.

Continue reading "Details of the event with ID 21 of the source Microsoft-Windows-CertificationAuthority"