Tag: Key storage provider (KSP)

Assume the following scenario:

• A web server certificate was generated using an ML-DSA-based key pair.
• We would like to bind it to Internet Information Services (IIS).
• The configuration fails with the following error message:

There was an error while performing this operation.

Details: 

A specified logon session does not exist. It may already have been terminated. (Exception from HRESULT: 0x80070520)

Continue reading "Configuring an SSL certificate binding for Microsoft Internet Information Server (IIS) fails with an error message when using ML-DSA-based keys"

The Simple Certificate Enrollment Protocol (SCEP) is an ancient protocol from the early 2000s. It does not use Transport Layer Security (TLS). Therefore, the protocol messages are encrypted at the transport layer.

When sending the certificate request to the NDES server, the client will encrypt the certificate request with the NDES server's CEP Encryption certificate (which was previously communicated to it via the GetCACert message).

When the issued certificate is received, the NDES server will encrypt the response with a self-signed certificate temporarily created by the SCEP client.

In both cases, a symmetric encryption algorithm is used.

Continue reading "Cryptographic Hardening of SCEP Transactions for the Network Device Enrollment Service (NDES)"

To use the Online Certificate Status Protocol (OCSP), it is necessary to configure an appropriate certificate template.

Continue reading "Configuring a Certificate Template for Online Responder (OCSP) Response Signing Certificates"

As computing power becomes increasingly available, the need to use stronger cryptographic keys also increases. In this course, there is often a need (for example, because the keys have to be protected by a Trusted Platform Module) to use keys based on elliptic curves (ECC) . For their use, it is essential that compatibility with the intended use cases is ensured.

Below is a list of use cases for which I know the compatibility.

Continue reading "List of certificate use cases for which compatibility with elliptic curve (ECC)-based keys is known"

Assume the following scenario:

• A certification authority uses a hardware security module (HSM) .
• The partition of the hardware security module fills up with more and more keys over the lifetime of the certification authority.
• With SafeNet hardware security modules, this can even cause the partition to run full. As a result, the events 86 and 88 are logged by the certification authority.

Continue reading "The partition of the hardware security module (HSM) fills up"

Assume the following scenario:

• A certificate template is configured to use keys based on elliptic curves .
• In addition, the certificate template is configured to use the Microsoft Platform Crypto Provider to protect the private key with the Trusted Platform Module (TPM) of the device.
• The certificate request fails with the following error message:

Error: The requested operation is not supported. 0x80090029 (-2146893783 NTE_NOT_SUPPORTED)

Continue reading "Requesting certificates with elliptic curve based keys fails when using the Microsoft Platform Crypto Provider"

Assume the following scenario:

• A certification authority is migrated to another server or restored from backup .
• A Thales (nCipher) hardware security module (HSM) is used to protect the private key of the certification authority certificate. Security World is configured with Operator Card Set (OCS) Protection.
• The certification authority certificate was successfully restored and associated with the private key stored on the HSM .
• When installing the certification authority role, the restored certification authority certificate cannot be selected.

Continue reading "When restoring a certification authority, the certification authority certificate is not selectable during role installation"

Assume the following scenario:

• A certification authority is migrated to another server or restored from backup .
• A hardware security module (HSM) is used to protect the private key of the certification authority certificate.
• The certification authority certificate is now to be restored on the target system and linked to the private key .
• The operation fails with the following error message:

Cannot find the certificate and private key for decryption.
CertUtil: -repairstore command FAILED: 0x80092004 (-2146885628 CRYPT_E_NOT_FOUND)
CertUtil: Cannot find object or property.

Continue reading "Reconnecting to the private key fails with error message "Cannot find object or property. 0x80092004 (-2146885628 CRYPT_E_NOT_FOUND)""

Since Windows NT 4.0, Cryptographic Service Providers (CSP) have been part of the CryptoAPI.

The idea is that an application does not have to worry about the specific implementation of key management, but can leave this to generic operating system interfaces. This also prevents cryptographic keys from being loaded into the working memory in the security context of the user/application used (a fatal security incident based precisely on this problem was the Heartbleed incident ).

For example, it makes no technical difference to the certification authority software how its private key is protected - whether in software or with a hardware security module (HSM), for example. The call of the private key is always identical for the certification authority.

With Windows Vista and the introduction of Cryptography Next Generation (CNG) as a replacement for CryptoAPI, Key Storage Providers (KSP) were introduced.

Continue reading "Basics: Cryptographic Service Provider (CSP) and Key Storage Provider (KSP)"

Continue reading "Details of the event with ID 58 of the source Microsoft-Windows-CertificateServicesClient-CertEnroll"

Assume the following scenario:

• A certification authority is implemented in the network.
• The certification authority service does not start.
• When trying to start the certification authority service, you get the following error message:

Provider DLL failed to initialize correctly. 0x8009001d (-2146893795 NTE_PROVIDER_DLL_FAIL).

Continue reading "The certification authority service does not start and throws the error message "Provider DLL failed to initialize correctly. 0x8009001d (-2146893795 NTE_PROVIDER_DLL_FAIL).""

With Windows Server 2008, together with the NSA Suite B algorithms (also known as Cryptography Next Generation, CNG), key storage providers were introduced as a new, modern interface for generating, storing, and using private keys in the Windows ecosystem.

In most cases, it does not matter which CSP or KSP is used for certificates. However, some applications will not work or will not work correctly if the wrong provider is chosen.

Below is a list of use cases I know of for certificates that only work with a specific cryptographic service provider (CSP) or key storage provider (KSP).

Continue reading "List of use cases for certificates that require specific Cryptographic Service Providers (CSP) or Key Storage Providers (KSP)"

Assume the following scenario:

• A certificate is requested from a certification authority.
• The certificate is successfully issued by the certification authority.
• However, when installing the certificate on the target system, the following error message occurs:

A certificate issued by the certification authority cannot be installed. Contact your administrator.
Cannot find object or property. 0x80092004 (-2146885628 CRYPT_E_NOT_FOUND)

Continue reading "Certificate request fails with error message "A certificate issued by the certification authority cannot be installed. Cannot find object or property. 0x80092004 (-2146885628 CRYPT_E_NOT_FOUND)""

Since Windows 8, it is possible to protect private keys for certificates with a Trusted Platform Module (TPM), if one is available . This makes the key non-exportable - even with tools like mimikatz.

However, it is not obvious at first glance that it cannot be guaranteed that a TPM is really used. Admittedly, no request via the Microsoft Management Console or autoenrollment will be possible if the computer does not have a TPM.

However, the configuration in the certificate template is merely a default setting for the client. The certification authority will not explicitly check whether a trusted platform module has actually been used when a request is made.

Thus - if the certificate request is done away from the MMC - arbitrary parameters can be used for the private key.

Continue reading "Requesting a certificate protected by a Trusted Platform Module (TPM) - without owning a TPM"

Assume the following scenario:

• A certificate is requested for a user or a computer from a certification authority via the certificate management console (certlm.msc or certmgr.msc).
• Autoenrollment does not request a certificate from the desired certificate template, although it is enabled and the permissions are set accordingly.
• The desired certificate template is not displayed when requesting manually via the Microsoft Management Console (MMC). If the "Show all templates" check box is selected, the following error message is displayed for the desired certificate template:

Cannot find object or property.
Can not find a valid CSP in the local machine.

Continue reading "Requesting a certificate is not possible because the certificate template is not displayed. The error message is "Can not find a valid CSP in the local machine.""