Tag: Hardware security module (HSM)

Details of the event with ID 100 of the source Microsoft-Windows-CertificationAuthority

Event Source:Microsoft-Windows-CertificationAuthority
Event ID:100 (0x64)
Event log:Application
Event type:Error
Symbolic Name:MSG_E_CA_CERT_INVALID
Event text (English):Active Directory Certificate Services did not start: Could not load or verify the current CA certificate. %1 %2.
Event text (German):Die Active Directory-Zertifikatdienste wurden nicht gestartet: Das aktuelle Zertifizierungsstellenzertifikat konnte nicht geladen bzw. verifiziert werden. %1 %2.

Continue reading "Details of the event with ID 100 of the source Microsoft-Windows-CertificationAuthority"

Details of the event with ID 53 of the source Microsoft-Windows-CertificationAuthority

Event Source:Microsoft-Windows-CertificationAuthority
Event ID:53 (0x35)
Event log:Application
Event type:Warning
Symbolic Name:MSG_DN_CERT_DENIED_WITH_INFO
Event text (English):Active Directory Certificate Services denied request %1 because %2. The request was for %3. Additional information: %4
Event text (German):Die Anforderung %1 wurde abgelehnt, da %2. Die Anforderung war für %3. Weitere Informationen: %4

Continue reading "Details of the event with ID 53 of the source Microsoft-Windows-CertificationAuthority"

Details of the event with ID 18 of the source Microsoft-Windows-NetworkDeviceEnrollmentService

Event Source:Microsoft-Windows-NetworkDeviceEnrollmentService
Event ID:18 (0x12)
Event log:Application
Event type:Error
Symbolic Name:EVENT_MSCEP_FAIL_TO_DECRYPT_INNER
Event text (English):The Network Device Enrollment Service cannot decrypt the client's PKCS7 message (%1). %2
Event text (German):Die PKCS7-Nachricht (%1) des Clients kann vom Registrierungsdienst für Netzwerkgeräte nicht entschlüsselt werden. %2

Continue reading "Details of the event with ID 18 of the source Microsoft-Windows-NetworkDeviceEnrollmentService"

Which Cryptographic Service Provider (CSP) should be used for the Network Device Enrollment Service (NDES)?

When configuring a certificate template for the Registration Authority (RA) certificates for the Network Device Enrollment Service (NDES), the question arises, especially when using hardware security modules (HSM), which Cryptographic Service Provider (CSP) of the HSM manufacturer should be used.

Continue reading "Which Cryptographic Service Provider (CSP) should be used for the Network Device Enrollment Service (NDES)?"

Certificate request fails with error message "Bad Data. 0x80090005 (-2146893819 NTE_BAD_DATA)."

Assume the following scenario:

  • A user sends a certificate request to a certification authority.
  • The certificate request fails with the following error message:
Bad Data. 0x80090005 (-2146893819 NTE_BAD_DATA).
Denied by Policy Module.

Continue reading "Certificate request fails with error message "Bad Data. 0x80090005 (-2146893819 NTE_BAD_DATA).""

Checking the connection to the private key of a certificate (e.g. when using a hardware security module)

For a functional test or during troubleshooting, it can be useful to check whether the private key of a certificate is usable. If the key is secured with a hardware security module (HSM), for example, there are significantly more dependencies and possibilities for errors than with a software key.

Continue reading "Checking the connection to the private key of a certificate (e.g. when using a hardware security module)"

Restoration of a Certification Authority Certificate with Hardware Security Module (HSM)

The following describes how to restore a CA certificate with a software key.

Restoring the certification authority certificate may be necessary for the following reasons:

Continue reading "Restoration of a Certification Authority Certificate with Hardware Security Module (HSM)"

Role configuration for Network Device Enrollment Service (NDES) fails with error message "Failed to enroll RA certificates. The endpoint is a duplicate. 0x800706cc (WIN32: 1740 RPC_S_DUPLICATE_ENDPOINT)"

Assume the following scenario:

  • One installs a Network Device Enrollment Service (NDES) server.
  • One has the necessary permissions to install the role (local administrator, enterprise administrator).
  • The role configuration fails with the following error message:
Failed to enroll RA certificates. The endpoint is a duplicate. 0x800706cc (WIN32: 1740 RPC_S_DUPLICATE_ENDPOINT)

Continue reading "Role configuration for Network Device Enrollment Service (NDES) fails with error message "Failed to enroll RA certificates. The endpoint is a duplicate. 0x800706cc (WIN32: 1740 RPC_S_DUPLICATE_ENDPOINT)""

Viewing the certificate store of the Online Responder (OCSP) and checking the signing certificates

Sometimes it is necessary to check a signing certificate of an Online Responder, for example when the connection to the hardware security module (HSM), if present, has to be checked. When the certificates are retrieved automatically from a certification authority, the Online Responder uses its own certificate store.

Continue reading "Viewing the certificate store of the Online Responder (OCSP) and checking the signing certificates"