Tag: Post-quantum cryptography

Requesting Certificates with ML-DSA-Based Keys Through the Network Device Enrollment Service (NDES)

With the May 2026 security update, Microsoft has added support for the ML-DSA algorithm in Active Directory Certificate Services.

In their documentation, they do write that NDES is not compatible with ML-DSA :

You can enroll ML-DSA certificates through the Certificates Microsoft Management Console (MMC) snap-in and certreq.exe. Enrollment through the Network Device Enrollment Service (NDES) isn't currently available.

But that's not entirely true…

Continue reading "Requesting Certificates with ML-DSA-Based Keys Through the Network Device Enrollment Service (NDES)"

Configuring an SSL certificate binding for Microsoft Internet Information Server (IIS) fails with an error message when using ML-DSA-based keys

Assume the following scenario:

  • A web server certificate was generated using an ML-DSA-based key pair.
  • We would like to bind it to Internet Information Services (IIS).
  • The configuration fails with the following error message:
There was an error while performing this operation.

Details: 

A specified logon session does not exist. It may already have been terminated. (Exception from HRESULT: 0x80070520)

Continue reading "Configuring an SSL certificate binding for Microsoft Internet Information Server (IIS) fails with an error message when using ML-DSA-based keys"

Requests for certificates using ML-DSA-based keys fail with the error message "The parameter is incorrect. 0x80070057 (WIN32: 87 ERROR_INVALID_PARAMETER)"

Assume the following scenario:

  • You try to request certificates using the ML-DSA algorithm.
  • The request fails with the following error message:
The parameter is incorrect. 0x80070057 (WIN32: 87 ERROR_INVALID_PARAMETER)

Continue reading "Requests for certificates using ML-DSA-based keys fail with the error message "The parameter is incorrect. 0x80070057 (WIN32: 87 ERROR_INVALID_PARAMETER)""

How many Subject Alternative Names (SAN) do the Active Directory Certificate Services support?

Like any software Microsoft Active Directory Certificate Services are also subject to certain limits imposed by their design.

What is not so obvious is the question of how many subject alternative names (SAN) can be issued with the Microsoft certification authority.

The IETF RFC 5280 describes the structure for Subject Alternative Names as follows:

SubjectAltName ::= GeneralNames

Continue reading "How many Subject Alternative Names (SAN) do the Active Directory Certificate Services support?"

Details of the event with ID 33 of the source Microsoft-Windows-OnlineResponder

Event Source:Microsoft-Windows-OnlineResponder
Event ID:33 (0x21)
Event log:Application
Event type:Error
Symbolic Name:MSG_E_CACONFIG_CREATE_ENROLLMENT_REQUEST_FAILED
Event text (English):The Online Responder Service failed to create an enrollment request for the signing certificate template %2 for configuration %1.(%3)
Event text (German):Der Online-Responder-Dienst konnte keine Registrierungsanforderungen für die Signaturzertifikatvorlage "%2" für die Konfiguration %1 erstellen.(%3)

Continue reading "Details of the event with ID 33 of the source Microsoft-Windows-OnlineResponder"