During penetration tests and also for attackers searching the network for potential targets, insights into the configuration of the certification authority are highly interesting.
In addition to possible misconfigurations, attackers can obtain information about the policy module used on the certification authority.
Assume the following scenario:
The Certificate Enrollment Web Service Setup failed because the CA "CA02.intra.adcslabor.de\ADCS Labor Issuing CA 1" cannot be contacted. Check the name, and confirm that the CA is properly configured and available. The RPC server is unavailable. 0x800706ba (WIN32: 1722 RPC_S_SERVER_UNAVAILABLE) Often, problems with the public key infrastructure can be found in the underlying network - for example, if a firewall rule is missing from the network.
Thus, it is helpful if one is able to record network traffic in order to analyze it. Excellent tools exist for this purpose, such as Wireshark , but these require that an installation be made on the system in question, which cannot and should not be done easily on a production system.
Fortunately, the Windows Server operating system has a built-in mechanism to capture network packets. However, the resulting files are not compatible with Wireshark. Microsoft's own tool, Message Analyzer, was discontinued on Nov 25, 2019 and the download links removed .
The following therefore describes how such a recording can be generated and subsequently converted into a Wireshark-compatible format in order to be able to analyze the recording away from the server in question.
Assume the following scenario:
The Network Device Enrollment Service cannot be started (0x80004005). Unspecified errorIn the default configuration, the certification authority's certificate request interface is configured to negotiate dynamic ports for the incoming RPC/DCOM connections (for more details, see the article "Firewall rules required for Active Directory Certificate Services ").
| Network protocol | Destination port | Protocol |
|---|---|---|
| TCP | 135 | RPC Endpoint Mapper |
| TCP | 49152-65535 | RPC dynamic ports |
This configuration is not feasible in every enterprise environment. Often there are restrictive firewall rules that do not allow the use of dynamic network ports.
In such a case, the certification authority must be configured to a static port.
Continue reading "Configuring the certification authority to a static port (RPC endpoint)"
In the default configuration, the certification authority's certificate request interface is configured to negotiate dynamic ports for the incoming RPC/DCOM connections (for more details, see the article "Firewall rules required for Active Directory Certificate Services ").
However, it is also possible to configure the certification authority to a static port (see article "Configuring the certification authority to a static port (RPC endpoint) ").
The following describes how to check the current configuration of the certification authority.
Continue reading "Querying the configured RPC endpoints of a certification authority"
Assume the following scenario:
There is a problem with the resource you are looking for, and it cannot be displayed.Implementing a Network Device Enrollment Service (NDES) often requires planning the firewall rules to be created on the network. The following is a list of the required firewall rules and any pitfalls.
Continue reading "Required firewall rules for the Network Device Enrollment Service (NDES)"
Implementing a Certificate Enrollment Policy Web Service (CEP) often requires planning the firewall rules to be created on the network. The following is a list of the required firewall rules and any pitfalls.
Continue reading "Required firewall rules for the Certificate Enrollment Policy Web Service (CEP)"
Implementing a Certificate Enrollment Web Service (CES) often requires planning the firewall rules to be created on the network. The following is a list of the required firewall rules and any pitfalls.
Continue reading "Required firewall rules for the Certificate Enrollment Web Service (CES)"
Implementing an Online Responder (OCSP) often requires planning the firewall rules to be created on the network. The following is a list of the required firewall rules and any pitfalls.
Continue reading "Required firewall rules for the Online Responder (OCSP)"
Assume the following scenario:
Implementing Certification Authority Web Enrollment (CAWE) often requires planning the firewall rules to be created on the network. The following is a list of the required firewall rules and any pitfalls.
Continue reading "Required firewall rules for Certification Authority Web Enrollment (CAWE)"
Assume the following scenario:
The operation timed out 0x80072ee2 (INet: 12002 ERROR_INTERNET_TIMEOUT)Assume the following scenario:
Certificate Request Processor: A connection with the server could not be established 0x80072efd (WinHttp: 12029 ERROR_WINHTTP_CANNOT_CONNECT)