Tag: NTAuthCertificates

Assume the following scenario:

• The company would like to use smart card logon.
• The domain controllers are equipped with certificates that can be used for smart card logon .
• The users are equipped with certificates that can be used for smart card logon.
• Logon to the domain via smart card fails with the following error message:

A certification chain processed correctly, but one of the CA certificates is not trusted by the policy provider. 0x800b0112 (-2146762478 CERT_E_UNTRUSTEDCA)

Continue reading "Smart card logon fails with error message "A certification chain processed correctly, but one of the CA certificates is not trusted by the policy provider. 0x800b0112 (-2146762478 CERT_E_UNTRUSTEDCA)""

Assume the following scenario:

• A certificate is requested through the Network Device Enrollment Service (NDES).
• Renewal mode is used here, i.e. the certificate request is signed with an existing certificate.
• The request for the new certificate fails with the following error message:

A certification chain processed correctly, but one of the CA
certificates is not trusted by the policy provider. 0x800b0112 (-2146762478 CERT_E_UNTRUSTEDCA)

Continue reading "Renewal of a certificate via the Network Device Enrollment Service (NDES) fails with error code CERT_E_UNTRUSTEDCA"

• A certificate is requested for a user from a certification authority via the certificate management console (certmgr.msc).
• This uses the Enroll on Behalf of (EOBO) mechanism.
• The certificate request fails with the following error message:

A certification chain processed correctly, but one of the CA certificates is not trusted by the policy provider. 0x800b0112 (-2146762478 CERT_E_UNTRUSTEDCA)

Continue reading "Requesting certificates via Enroll on Behalf of (EOBO) fails with the error message "A certification chain processed correctly, but one of the CA certificates is not trusted by the policy provider. 0x800b0112 (-2146762478 CERT_E_UNTRUSTEDCA)""

Time and again in discussions about the security of a certification authority, it comes up that abuse of the certification authority could be contained by its security settings.

However, the fact that the integrity of a certification authority is directly tied to its key material and can therefore also be compromised through it is not obvious at first glance.

One has to think of the certification authority software as a kind of management around the key material. For example, the software provides an online interface for certificate enrollment , takes care of the authentication of the enrollees, the automated execution of signature operations (issuing certificates and certificate revocation lists ) and their logging (certification authority database , audit log , event log ).

However, signature operations require nothing more than the private key of the certification authority. The following example shows how an attacker, given access to the certification authority's private key, can generate and issue certificates without the certification authority software and its security mechanisms noticing.

With such a certificate, it would in the worst case even be possible to take over the Active Directory forest undetected .

Continue reading "Signing certificates bypassing the certification authority"

The Network Device Enrollment Service (NDES) has two Registration Authority certificates. The Enrollment Agent certificate is used to sign certificate requests, and one can configure the NDES device template accordingly, so that certificates are only issued if the submitted certificate requests also have a corresponding signature .

If you plan to remove the certification authority connected to NDES from the NTAuthCertificates object , the question may arise as to whether mutual dependencies need to be taken into account here - after all, Enroll on Behalf Of (EOBO) requires the presence of the certification authority certificate in NTAuthCertificates.

Continue reading "Is there a dependency of the Network Device Enrollment Service (NDES) on the NTAuthCertificates object?"

Continue reading "Details of the event with ID 94 of the source Microsoft-Windows-CertificationAuthority"

Installing Active Directory Certificate Services in the default configuration automatically configures the environment so that smart card logons are accepted by the domain controllers.

Therefore, if the use of smart card logons is not desired, it makes sense to disable the functionality in order not to jeopardize Active Directory in the event the certification authority is compromised.

Continue reading "Prevent smart card logon to the network"

In the default configuration, all certification authority certificates of Active Directory integrated certification authorities (enterprise CAs) are located in an object of type CertificationAuthority named NTAuthCertificates within the Configuration Partition of the Active Directory forest.

Continue reading "Editing the NTAuthCertificates object in Active Directory"

Here's the scenario:

• A user requests a certificate from an Active Directory integrated certification authority (enterprise CA).
• The certificate of the certification authority is trusted, i.e. it is located in the Trusted Root Certification Authorities store.
• The certificate request fails with the following error message:

A certification chain processed correctly, but one of the CA certificates is not trusted by the policy provider. 0x800b0112 (-2146762478 CERT_E_UNTRUSTEDCA)

Continue reading "Requesting a certificate fails with the error message "A certification chain processed correctly, but one of the CA certificates is not trusted by the policy provider. 0x800b0112 (-2146762478 CERT_E_UNTRUSTEDCA)""