Tag: Key storage provider (KSP)

Configuring a certificate template to use the Microsoft Platform Crypto Provider to enable private key protection by a Trusted Platform Module (TPM)

Since Windows 8, it has been possible to protect the private keys of certificates with a Trusted Platform Module (TPM), if one is present. This ensures that the key is truly non-exportable.

The process for setting up a certificate template that uses a Trusted Platform Module is described below.

Continue reading "Configuring a certificate template to use the Microsoft Platform Crypto Provider to enable private key protection by a Trusted Platform Module (TPM)"

Restoration of a certification authority certificate with software key

The following describes how to restore a CA certificate with a software key.

Restoring the certification authority certificate may be necessary for the following reasons:

Continue reading "Restoration of a certification authority certificate with software key"

The Network Device Enrollment Service (NDES) logs the error message "The Network Device Enrollment Service cannot retrieve one of its required certificates (0x80070057). The parameter is incorrect."

Assume the following scenario:

  • An NDES server is configured on the network.
  • HTTP error 500 (Internal Server Error) is reported when accessing the NDES request web page (mscep) and the NDES administration web page (certsrv/mscep_admin).
  • Events no. 2 and 10 are logged in the Application event log:
The Network Device Enrollment Service cannot be started (0x80070057). The parameter is incorrect.
The Network Device Enrollment Service cannot retrieve one of its required certificates (0x80070057). The parameter is incorrect.

Continue reading "The Network Device Enrollment Service (NDES) logs the error message "The Network Device Enrollment Service cannot retrieve one of its required certificates (0x80070057). The parameter is incorrect.""

How secure is the "Allow private key to be exported" setting in the certificate templates?

PKI administrators often assume that the option in the certificate template not to allow the private key to be exported is binding.

However, that is not the case.

Continue reading "How secure is the "Allow private key to be exported" setting in the certificate templates?"