Tag: Internet Information Services (IIS)

Assume the following scenario:

• A web server certificate was generated using an ML-DSA-based key pair.
• We would like to bind it to Internet Information Services (IIS).
• The configuration fails with the following error message:

There was an error while performing this operation.

Details: 

A specified logon session does not exist. It may already have been terminated. (Exception from HRESULT: 0x80070520)

Continue reading "Configuring an SSL certificate binding for Microsoft Internet Information Server (IIS) fails with an error message when using ML-DSA-based keys"

The Active Directory Certificate Services offer a number of web-based add-on interfaces (Network Device Enrollment Service (NDES) , Certificate Enrollment Policy Web Service (CEP) , Certificate Enrollment Web Service (CES) , Certification Authority Web Enrollment (CAWE) .

The Microsoft Internet Information Services (IIS) are thus almost indispensable for a Microsoft PKI. Each of the web-based interfaces (and also in-house developments) bring their own unique challenges in terms of authentication procedures and their implementation.

The following article should bring a little clarity to the topic.

Continue reading "Basics: Authentication procedures for the Internet Information Services (IIS)"

If the Network Device Enrollment Service (NDES) is newly installed (preferably without Enterprise Administrator permissions ), only the Windows-integrated authentication for the administration web page is activated at first. With this (via NT LAN Manager, NTLM) protocol, authentication via user name and password is also possible. However, not all client applications support this.

Likewise, a company might want to disable NTLM where possible and enforce Kerberos for logon . Enforcing Kerberos removes the ability to log on to the Network Device Enrollment Service administration page via username and password (since this is done with NTLM credentials). However, Basic Authentication can be retrofitted to provide an option here again.

One way out of this dilemma can be Basic Authentication, the setup of which will be explained below.

Continue reading "Enabling Basic Authentication for the Network Device Enrollment Service (NDES)"

Many companies pursue the strategy of (largely) disabling the NT LAN Manager (NTLM) authentication protocol in their networks.

This is also possible for the administration web page of the Network Device Enrollment Service (NDES). How exactly this is implemented and how this may change the application behavior is explained below.

Continue reading "Disabling NTLM and enforcing Kerberos at the Network Device Enrollment Service (NDES) administration web page"

With the May 10, 2022 patch, Microsoft is attempting to close a vulnerability in Active Directory that affects certificate-based logon (commonly known as PKINIT or also smart card logon ).

The update changes both the behavior of the certification authority as well as the behavior of Active Directory when processing certificate-based logons.

Continue reading "Changes to Certificate Issuance and Certificate-Based Logon to Active Directory with the May 10, 2022 Patch for Windows Server (KB5014754)"

If one installs a Network Device Enrollment Service (NDES), one is faced with the question under which identity the IIS application pool should be operated. In the following, the individual options are examined in more detail in order to facilitate a selection.

Continue reading "Selecting the identity for the IIS application pool of the Network Device Enrollment Service (NDES)"

When troubleshooting, it can be very helpful to view encrypted SSL connections in order to inspect the messages within. There is a relatively simple way to do this with Wireshark.

Continue reading "Inspect TLS traffic with Wireshark (decrypt HTTPS)"

Assume the following scenario:

• A user or application accesses a web page or web application running on an Internet Information Services (IIS) web server.
• The web server is configured to request a client certificate for the requested resource.
• Although there is a valid client certificate on the client, the error code 403 Forbidden is returned immediately. The user is not prompted (when calling the page with a browser) to select a certificate.
• The web server certificate was recently renewed and the IIS SSL binding was configured accordingly via the IIS Manager.

403 - Forbidden: Access is denied.
You do not have permission to view this directory or page using the credentials that you supplied.

Continue reading "HTTP error code 403 when logging on to Internet Information Services (IIS) using client certificate after renewing web server certificate"

After installing and configuring Certification Authority Web Enrollment (CAWE), it is essential to test the component extensively before releasing it to users. Below are instructions for a detailed functional test.

Continue reading "Performing a functional test for Certification Authority Web Enrollment (CAWE)"

Assume the following scenario:

• You try to request a certificate via a Certificate Enrollment Web Service (CES) from an Active Directory-integrated certification authority (Enterprise Certification Authority).
• The operation fails with the following error message:

The operation timed out 0x80072ee2 (INet: 12002 ERROR_INTERNET_TIMEOUT)

Continue reading "Requesting certificates via the Certificate Enrollment Web Service (CES) fails with error code "ERROR_INTERNET_TIMEOUT""

If the servers providing the CRL distribution points are located in a demilitarized zone (DMZ), for example, or data transfer via Server Message Block (SMB) is not possible for other reasons, the certificate revocation lists (CRLs) can be transferred to the distribution points using SSH Secure Copy (SCP). As of Windows Server 2019, the OpenSSH server and client packages are available. The following describes the setup with authentication via public keys (Public Key Authentication) instead of passwords as an example

Continue reading "Transfer certificate revocation lists to CRL distribution points using SSH Secure Copy (SCP) with public key authentication (Windows Server 2019)"