Tag: Hardware security module (HSM)

Cryptographic Hardening of SCEP Transactions for the Network Device Enrollment Service (NDES)

The Simple Certificate Enrollment Protocol (SCEP) is an ancient protocol from the early 2000s. It does not use Transport Layer Security (TLS). Therefore, the protocol messages are encrypted at the transport layer.

When sending the certificate request to the NDES server, the client will encrypt the certificate request with the NDES server's CEP Encryption certificate (which was previously communicated to it via the GetCACert message).

When the issued certificate is received, the NDES server will encrypt the response with a self-signed certificate temporarily created by the SCEP client.

In both cases, a symmetric encryption algorithm is used.

Continue reading "Cryptographic Hardening of SCEP Transactions for the Network Device Enrollment Service (NDES)"

The partition of the hardware security module (HSM) fills up

Assume the following scenario:

  • A certification authority uses a hardware security module (HSM) .
  • The partition of the hardware security module fills up with more and more keys over the lifetime of the certification authority.
  • With SafeNet hardware security modules, this can even cause the partition to run full. As a result, the events 86 and 88 are logged by the certification authority.

Continue reading "The partition of the hardware security module (HSM) fills up"

When restoring a certification authority, the certification authority certificate is not selectable during role installation

Assume the following scenario:

Continue reading "When restoring a certification authority, the certification authority certificate is not selectable during role installation"

Installation of a certification authority certificate fails with error message "Object was not found. 0x80090011 (-2146893807 NTE_NOT_FOUND)"

Assume the following scenario:

  • A new certification authority is installed.
  • After configuring the certification authority role and issuing the certification authority certificate, it should now be installed on the certification authority.
  • A hardware security module (HSM) is used to protect the private key of the certification authority certificate.
  • The installation of the certification authority certificate fails with the following error message:
An error was detected while configuring Active Directory Certificate Services.
The Active Directory Certificate Services Setup Wizard will need to be rerun to complete the configuration.
The new certificate public key does not match the current outstanding request.
The wrong request may have been used to generate the new certificate:  Object was not found. 0x80090011 (-2146893807 NTE_NOT_FOUND)

Continue reading "Installation of a certification authority certificate fails with error message "Object was not found. 0x80090011 (-2146893807 NTE_NOT_FOUND)""

Reconnecting to the private key fails with error message "Cannot find object or property. 0x80092004 (-2146885628 CRYPT_E_NOT_FOUND)"

Assume the following scenario:

Cannot find the certificate and private key for decryption.
CertUtil: -repairstore command FAILED: 0x80092004 (-2146885628 CRYPT_E_NOT_FOUND)
CertUtil: Cannot find object or property.

Continue reading "Reconnecting to the private key fails with error message "Cannot find object or property. 0x80092004 (-2146885628 CRYPT_E_NOT_FOUND)""

Details of the event with ID 55 of the source Microsoft-Windows-CertificateServicesClient-CertEnroll

Event Source:Microsoft-Windows-CertificateServicesClient-CertEnroll
Event ID:55 (0x825A0037)
Event log:Application
Event type:Warning
Event text (English):Certificate enrollment for %1 for the %2 template could not find specified CSPs on the local machine. Enrollment will not be performed.
Event text (German):Es konnten von der Zertifikatsregistrierung für %1 für die Vorlage %2 keine angegebenen CSPs gefunden werden. Die Registrierung wird nicht durchgeführt.

Continue reading "Details of the event with ID 55 of the source Microsoft-Windows-CertificateServicesClient-CertEnroll"

The certification authority service does not start and throws the error message "Provider DLL failed to initialize correctly. 0x8009001d (-2146893795 NTE_PROVIDER_DLL_FAIL)."

Assume the following scenario:

  • A certification authority is implemented in the network.
  • The certification authority service does not start.
  • When trying to start the certification authority service, you get the following error message:
Provider DLL failed to initialize correctly. 0x8009001d (-2146893795 NTE_PROVIDER_DLL_FAIL).

Continue reading "The certification authority service does not start and throws the error message "Provider DLL failed to initialize correctly. 0x8009001d (-2146893795 NTE_PROVIDER_DLL_FAIL).""

The certification authority service does not start and throws the error message "The system cannot find the file specified. 0x2 (WIN32: 2 ERROR_FILE_NOT_FOUND)"

Assume the following scenario:

  • A certification authority is installed.
  • The installation is successful, but the certification authority service does not start after the installation.
  • When trying to start the certification authority service from the Certification Authority management console, you receive the following error message:
The system cannot find the file specified. 0x2 (WIN32: 2 ERROR_FILE_NOT_FOUND)
The policy module for a CA is missing or incorrectly registered. To view or change policy module settings, right-click on the CA, click Properties, and then click the Policy Module tab.

Continue reading "The certification authority service does not start and throws the error message "The system cannot find the file specified. 0x2 (WIN32: 2 ERROR_FILE_NOT_FOUND)""

Certificate request fails with error message "A certificate issued by the certification authority cannot be installed. Cannot find object or property. 0x80092004 (-2146885628 CRYPT_E_NOT_FOUND)"

Assume the following scenario:

  • A certificate is requested from a certification authority.
  • The certificate is successfully issued by the certification authority.
  • However, when installing the certificate on the target system, the following error message occurs:
A certificate issued by the certification authority cannot be installed. Contact your administrator.
Cannot find object or property. 0x80092004 (-2146885628 CRYPT_E_NOT_FOUND)

Continue reading "Certificate request fails with error message "A certificate issued by the certification authority cannot be installed. Cannot find object or property. 0x80092004 (-2146885628 CRYPT_E_NOT_FOUND)""

Signing certificates bypassing the certification authority

Time and again in discussions about the security of a certification authority, it comes up that abuse of the certification authority could be contained by its security settings.

However, the fact that the integrity of a certification authority is directly tied to its key material and can therefore also be compromised through it is not obvious at first glance.

One has to think of the certification authority software as a kind of management around the key material. For example, the software provides an online interface for certificate enrollment , takes care of the authentication of the enrollees, the automated execution of signature operations (issuing certificates and certificate revocation lists ) and their logging (certification authority database , audit log , event log ).

However, signature operations require nothing more than the private key of the certification authority. The following example shows how an attacker, given access to the certification authority's private key, can generate and issue certificates without the certification authority software and its security mechanisms noticing.

With such a certificate, it would in the worst case even be possible to take over the Active Directory forest undetected .

Continue reading "Signing certificates bypassing the certification authority"

The installation of a certification authority certificate fails with error code "NTE_PROVIDER_DLL_FAIL"

Assume the following scenario:

  • A certification authority is installed.
  • The certification authority uses a Gemalto/SafeNet hardware security module (HSM) with the SafeNet Luna Key Storage Provider.
  • After the certification authority certificate is issued by the parent certification authority, it is installed to complete the role configuration.
  • The installation of the certification authority certificate fails with the following error message:
An error was detected while configuring Active Directory Certificate Services.
The Active Directory Certificate Services Setup Wizard will need to be rerun to complete the configuration.
The new certificate public key does not match the current outstanding request.
The wrong request may have been used to generate the new certificate: Provider DLL failed to initialize correctly.
0x8009001d (-2146893795 NTE_PROVIDER_DLL_FAIL)

Continue reading "The installation of a certification authority certificate fails with error code "NTE_PROVIDER_DLL_FAIL""

Installation of a certification authority fails with error code ERROR_INVALID_PARAMETER

Assume the following scenario:

  • A certification authority is installed
  • The role configuration fails with the following error message:
CCertSrvSetupProperty: The parameter is incorrect. 0x80070057 (WIN32: ERROR_INVALID_PARAMETER).

Continue reading "Installation of a certification authority fails with error code ERROR_INVALID_PARAMETER"

Installation of a certification authority fails with error code "Bad Data. 0x80090005 (-2146893819 NTE_BAD_DATA)."

Assume the following scenario:

  • An attempt is made to install a certification authority
  • The role configuration fails with the following error message:
An error occurred when creating the new key container "ADCS Labor Issuing CA 3". Please make sure the CSP is installed correctly or select another CSP.
Bad Data. 0x80090005 (-2146893819 NTE_BAD_DATA).

Continue reading "Installation of a certification authority fails with error code "Bad Data. 0x80090005 (-2146893819 NTE_BAD_DATA).""

Details of the event with ID 4880 of the source Microsoft-Windows-Security-Auditing

Event Source:Microsoft-Windows-Security-Auditing
Event ID:4880 (0x1310)
Event log:Security
Event type:Information
Event text (English):Certificate Services started. Certificate Database Hash: %1 Private Key Usage Count: %2 CA Certificate Hash: %3 CA Public Key Hash: %4
Event text (German):Die Zertifikatdienste wurden gestartet. Zertifikatdatenbankhash: %1 Verwendungsanzahl des privaten Schlüssels: %2 Zertifizierungshash der Zertifizierungsstelle: %3 Hash für öffentliche Schlüssel der Zertifizierungsstelle: %4

Continue reading "Details of the event with ID 4880 of the source Microsoft-Windows-Security-Auditing"

Details of the event with ID 130 of the source Microsoft-Windows-CertificationAuthority

Event Source:Microsoft-Windows-CertificationAuthority
Event ID:130 (0x82)
Event log:Application
Event type:Error
Symbolic Name:MSG_E_CRL_CREATION
Event text (English):Active Directory Certificate Services could not create a certificate revocation list. %1. This may cause applications that need to check the revocation status of certificates issued by this CA to fail. You can recreate the certificate revocation list manually by running the following command: "certutil -CRL". If the problem persists, restart Certificate Services.
Event text (German):Von den Active Directory-Zertifikatdiensten konnte keine Zertifikatssperrliste erstellt werden. %1. Dies kann dazu führen, dass bei Anwendungen, bei denen eine Überprüfung des Sperrstatus der von dieser Zertifizierungsstelle ausgestellten Zertifikate erforderlich ist, ein Fehler auftritt. Durch Ausführen des folgenden Befehls kann die Zertifikatssperrliste manuell neu erstellt werden: "certutil -CRL". Sollte das Problem bestehen bleiben, führen Sie einen Neustart der Zertifikatdienste durch.

Continue reading "Details of the event with ID 130 of the source Microsoft-Windows-CertificationAuthority"