I often hear that PKI operators would like to see a new certificate revocation list issued immediately for revoked certificates.
Below, I would like to share some thoughts on why this approach is not ideal and propose a more elegant solution.
Like any software Microsoft Active Directory Certificate Services are also subject to certain limits imposed by their design.
What is not so obvious is the question of how many subject alternative names (SAN) can be issued with the Microsoft certification authority.
The IETF RFC 5280 describes the structure for Subject Alternative Names as follows:
SubjectAltName ::= GeneralNamesAssume the following scenario:
Set-WMIInstance : Invalid parameter
At line:1 char:1
Set-WMIInstance -path $TerminalServicesConfig.__path -argument @{SSLC …
~~~~~~~~~~~~~~~~~ CategoryInfo : InvalidOperation: (:) [Set-WmiInstance], ManagementException
FullyQualifiedErrorId : SetWMIManagementException,Microsoft.PowerShell.Commands.SetWmiInstance Assume the following scenario:
The user account does not have permissions to run this task.Continue reading "Programmatically trigger the autoenrollment process for the logged-on user"
Assume the following scenario:
The following is a troubleshooting guide.
Assume the following scenario:
Below is a description of the options available for executing PowerShell script files, and what is possible by signing them.
Assume the following scenario:
The Certification Authority is already installed. If you are trying to reinstall the role service, you must first uninstall it.Assume the following scenario:
Type: Microsoft CRL-based revocation status provider
The revocation provider failed with the current configuration. The object identifier does not represent a valid object. 0x800710d8 (WIN32: 4312 ERROR_OBJECT_NOT_FOUND), 0x800710d8Since Windows 8, it has been possible to protect the private keys of certificates with a Trusted Platform Module (TPM), if one is present. This ensures that the key is truly non-exportable.
The process for setting up a certificate template that uses a Trusted Platform Module is described below.
Time and again in discussions about the security of a certification authority, it comes up that abuse of the certification authority could be contained by its security settings.
However, the fact that the integrity of a certification authority is directly tied to its key material and can therefore also be compromised through it is not obvious at first glance.
One has to think of the certification authority software as a kind of management around the key material. For example, the software provides an online interface for certificate enrollment , takes care of the authentication of the enrollees, the automated execution of signature operations (issuing certificates and certificate revocation lists ) and their logging (certification authority database , audit log , event log ).
However, signature operations require nothing more than the private key of the certification authority. The following example shows how an attacker, given access to the certification authority's private key, can generate and issue certificates without the certification authority software and its security mechanisms noticing.
With such a certificate, it would in the worst case even be possible to take over the Active Directory forest undetected .
Continue reading "Signing certificates bypassing the certification authority"
Suppose you are running a Network Device Enrollment Service (NDES) that is configured to use a static password . In this case, unlike in the default configuration, the password for requesting certificates by NDES clients never changes.
However, one may aim for an intermediate way, for example, a daily change of the password. The following describes a way to automate the change of the password.
If you want to equip Windows systems with certificates that do not have the option of communicating directly with an Active Directory-integrated certification authority, or that are not even in the same Active Directory forest, the only option in most cases is to install certificates manually.
Since Windows 8.1 / Windows Server 2012 R2, however, there is an integrated client for the Simple Certificate Enrollment Protocol (SCEP) on board. On the server side, SCEP has been implemented in the Microsoft PKI via the Network Device Enrollment Service (NDES) since Windows Server 2003.
A particularly interesting feature of SCEP is that the protocol allows a certificate to be renewed by specifying an existing one. So what could be more obvious than to use this interface? What is still missing is a corresponding automation via Windows PowerShell.
Assume the following scenario:
Install-AdcsCertificationAuthority : Active Directory Certificate Services setup failed with the following error: A value for the attribute was not in the acceptable range of values. 0x80072082 (WIN32: 8322 ERROR_DS_RANGE_CONSTRAINT)Assume the following scenario:
Get-Certificate : CX509EnrollmentPolicyWebService::LoadPolicy: Access was denied by the remote endpoint. 0x803d0005 (-2143485947 WS_E_ENDPOINT_ACCESS_DENIED)