Tag: ML-DSA

Requesting Certificates with ML-DSA-Based Keys Through the Network Device Enrollment Service (NDES)

With the May 2026 security update, Microsoft has added support for the ML-DSA algorithm in Active Directory Certificate Services.

In their documentation, they do write that NDES is not compatible with ML-DSA :

You can enroll ML-DSA certificates through the Certificates Microsoft Management Console (MMC) snap-in and certreq.exe. Enrollment through the Network Device Enrollment Service (NDES) isn't currently available.

But that's not entirely true…

Continue reading "Requesting Certificates with ML-DSA-Based Keys Through the Network Device Enrollment Service (NDES)"

Configuring an SSL certificate binding for Microsoft Internet Information Server (IIS) fails with an error message when using ML-DSA-based keys

Assume the following scenario:

  • A web server certificate was generated using an ML-DSA-based key pair.
  • We would like to bind it to Internet Information Services (IIS).
  • The configuration fails with the following error message:
There was an error while performing this operation.

Details: 

A specified logon session does not exist. It may already have been terminated. (Exception from HRESULT: 0x80070520)

Continue reading "Configuring an SSL certificate binding for Microsoft Internet Information Server (IIS) fails with an error message when using ML-DSA-based keys"

Requests for certificates using ML-DSA-based keys fail with the error message "The parameter is incorrect. 0x80070057 (WIN32: 87 ERROR_INVALID_PARAMETER)"

Assume the following scenario:

  • You try to request certificates using the ML-DSA algorithm.
  • The request fails with the following error message:
The parameter is incorrect. 0x80070057 (WIN32: 87 ERROR_INVALID_PARAMETER)

Continue reading "Requests for certificates using ML-DSA-based keys fail with the error message "The parameter is incorrect. 0x80070057 (WIN32: 87 ERROR_INVALID_PARAMETER)""

Details of the event with ID 13 of the source Microsoft-Windows-CertificateServicesClient-CertEnroll

Event Source:Microsoft-Windows-CertificateServicesClient-CertEnroll
Event ID:13 (0xC25A000D)
Event log:Application
Event type:Error
Event text (English):Certificate enrollment for %1 failed to enroll for a %2 certificate with request ID %4 from %3 (%5).
Event text (German):Die Zertifikatregistrierung für %1 konnte sich nicht für ein Zertifikat %2 mit der Anforderungs-ID %4 von %3 (%5) registrieren.

Continue reading "Details of the event with ID 13 of the source Microsoft-Windows-CertificateServicesClient-CertEnroll"

Details of the event with ID 33 of the source Microsoft-Windows-OnlineResponder

Event Source:Microsoft-Windows-OnlineResponder
Event ID:33 (0x21)
Event log:Application
Event type:Error
Symbolic Name:MSG_E_CACONFIG_CREATE_ENROLLMENT_REQUEST_FAILED
Event text (English):The Online Responder Service failed to create an enrollment request for the signing certificate template %2 for configuration %1.(%3)
Event text (German):Der Online-Responder-Dienst konnte keine Registrierungsanforderungen für die Signaturzertifikatvorlage "%2" für die Konfiguration %1 erstellen.(%3)

Continue reading "Details of the event with ID 33 of the source Microsoft-Windows-OnlineResponder"