Tag: PKCS#7

The Simple Certificate Enrollment Protocol (SCEP) is an ancient protocol from the early 2000s. It does not use Transport Layer Security (TLS). Therefore, the protocol messages are encrypted at the transport layer.

When sending the certificate request to the NDES server, the client will encrypt the certificate request with the NDES server's CEP Encryption certificate (which was previously communicated to it via the GetCACert message).

When the issued certificate is received, the NDES server will encrypt the response with a self-signed certificate temporarily created by the SCEP client.

In both cases, a symmetric encryption algorithm is used.

Continue reading "Cryptographic Hardening of SCEP Transactions for the Network Device Enrollment Service (NDES)"

Recently, together with B-I-T GmbH Informationen und Prozesse from Hanover, I worked on implementing the electronic data exchange with the statutory health insurance funds and the pension insurance from within an application.

Here, a combination of authenticated data transmission of both signed and encrypted messages is used. PKI technologies are used in all these cases.

Continue reading "Electronic data exchange with the German Pension Insurance"

Assume the following scenario:

• An Online Responder (OCSP) is set up in the network.
• The certification authorities report at irregular intervals that certificate requests for the OCSP response signing certificates fail with the following error message:

The revocation function was unable to check revocation for the certificate. 0x80092012 (-2146885614 CRYPT_E_NO_REVOCATION_CHECK).

Continue reading "Certificate requests for the Online Responder (OCSP) fail sporadically with error message "The revocation function was unable to check revocation for the certificate. 0x80092012 (-2146885614 CRYPT_E_NO_REVOCATION_CHECK)""

The following is a description of the Enroll on Behalf Of function and how it differs from other methods of requesting certificates.

Continue reading "Basics: Enroll on Behalf of (EOBO)"

Assume the following scenario:

• A certificate request is made on a Linux system (for example, a thin client) by means of SSCEP against a Network Device Enrollment Service (NDES) .
• The certificate request fails with the following error message:

sscep: Subject of our request does not match that of the returned Certificate!

Continue reading "SSCEP: Subject of our request does not match that of the returned Certificate!"

If you want to equip a large number of systems with certificates, a manual request and renewal of the certificates is not an option. The only viable path is automation.

For systems that are not members of the Active Directory forest, an automatic certificate request via RPC/DCOM is not an option.

For certain use cases, the Simple Certificate Enrollment Protocol (SCEP) is an interesting alternative. For this protocol, there are clients not only for Windows but, with SSCEP, also for Linux. SSCEP is used, among others, by thin clients with the eLux operating system .

The following describes how to set up the SSCEP client on a Debian Buster Linux system - either to use it to manage servers or to be able to test the client-side behavior.

Continue reading "Install SSCEP for Linux (Debian Buster) and request certificates via the Network Device Enrollment Service (NDES)"

The Simple Certificate Enrollment Protocol (SCEP) was developed by Verisign for Cisco in the early 2000s to provide a simplified method for requesting certificates. Previously, network devices required manually generating a certificate request on each device, submitting it to a certification authority, and then manually installing the issued certificate on the corresponding device again.

Continue reading "Basics: Network Device Enrollment Service (NDES)"

X.509 certificates are always encoded in the Distinguished Encoding Rules (DER) format. This is a binary, machine-readable format.

DER-encoded certificates can, however, also be converted into a text-based format using the BASE64 process so that they can be transmitted in an e-mail body, for example. BASE64 encloses the DER-encoded format, i.e. the certificate is and remains DER-encoded in any case.

Continue reading "Description of the different certificate formats"

Continue reading "Details of the event with ID 18 of the source Microsoft-Windows-NetworkDeviceEnrollmentService"

The Network Device Enrollment Service (NDES) is Microsoft's implementation of the Simple Certificate Enrollment Protocol (SCEP) developed by Cisco in the early 2000s. The first implementation was released with Windows Server 2003.

It may come as a surprise that NDES does not use Secure Socket Layer (SSL) for the HTTP connections in the default setting to this day. This fact is explained and evaluated in more detail below.

Continue reading "Should HTTPS be used for the Network Device Enrollment Service (NDES)?"