When troubleshooting, it can be very helpful to view encrypted SSL connections in order to inspect the messages within. There is a relatively simple way to do this with Wireshark.
Continue reading "Inspect TLS traffic with Wireshark (decrypt HTTPS)"
Assume the following scenario:
403 - Forbidden: Access is denied.
You do not have permission to view this directory or page using the credentials that you supplied.With regard to the design of the infrastructure for providing revocation information - i.e. the CRL distribution points (CDP) as well as the Online Responders (Online Certificate Status Protocol, OCSP) - the question arises whether these should be "secured" via Secure Sockets Layer (SSL) or Transport Layer Security (TLS).
The Network Device Enrollment Service (NDES) is Microsoft's implementation of the Simple Certificate Enrollment Protocol (SCEP) developed by Cisco in the early 2000s. The first implementation was released with Windows Server 2003.
It may come as a surprise that NDES does not use Secure Socket Layer (SSL) for the HTTP connections in the default setting to this day. This fact is explained and evaluated in more detail below.
Continue reading "Should HTTPS be used for the Network Device Enrollment Service (NDES)?"
In the default configuration, Certification Authority Web Enrollment (CAWE) accepts only unencrypted connections via HTTP. It is recommended that the CAWE be configured for HTTP over TLS (HTTPS) to make capturing the network traffic more difficult. Instructions are provided below.
With the Chromium project and products based on it such as Google Chrome and Microsoft Edge, Google has moved to enforcing RFC 2818 , which was adopted in 2000, and to no longer trusting certificates that no longer fulfill the RFC.
For us, the following sentence is highly significant:
If a subjectAltName extension of type dNSName is present, that MUST be used as the identity. Otherwise, the (most specific) Common Name field in the Subject field of the certificate MUST be used. Although the use of the Common Name is existing practice, it is deprecated and Certification Authorities are encouraged to use the dNSName instead
Continue reading "Generating an RFC 2818 compliant certificate request for SSL certificates"
In the default configuration, the Network Device Enrollment Service (NDES) only accepts unencrypted connections via HTTP. It is recommended that at least the NDES administration web page be configured for HTTP over TLS (HTTPS) to make capturing the network traffic more difficult. Instructions are provided below.
For a closer look at the need to use SSL, see the article "Should HTTPS be used for the Network Device Enrollment Service (NDES)? ".