Tag: Private key archival

For the encryption of email messages, companies typically use the Secure / Multipurpose Internet Message Extensions (S/MIME) standard and provide their users with appropriate certificates for this purpose.

An important aspect here is that the users' private keys should be secured centrally - in contrast to the signing certificates that are otherwise mostly used. Incoming messages are encrypted for a specific private key and can only be decrypted again by this key . Thus a backup of these keys must absolutely be available - this is also indispensable for synchronization to mobile devices . For this purpose, the Microsoft Active Directory Certificate Services offer the private key archival function.

But what if private key archival has not been set up and users have already requested corresponding certificates?

Continue reading "Subsequent archiving of private keys"

In a modern networked world, the confidential transmission of messages in the corporate environment is essential for business success. Despite its age , it is still impossible to imagine modern corporate communications without e-mail. However, its use has changed significantly over the decades.

Nowadays, it is common to be able to read and write business e-mails on mobile devices such as smartphones and tablets. Such end devices are usually managed with Mobile Device Management (MDM) systems such as Microsoft Intune.

To encrypt e-mail messages, companies typically use the Secure / Multipurpose Internet Message Extensions (S/MIME) standard and provide their users with the corresponding certificates. How do these certificates get to the end devices of the users in a scalable way?

Continue reading "Transferring S/MIME certificates to Microsoft Intune"

Assume the following scenario:

• A user receives an e-mail message encrypted with Secure/Multipurpose Internet Mail Extensions (S/MIME).
• The message cannot be opened.
• When opening the message, the following error message is displayed:

Sorry, we're having trouble opening this item. This could be temporary, but if you see it again you might want to restart Outlook. Your digital ID name cannot be found by the underlying security system.

Continue reading "Microsoft Outlook: Emails encrypted with S/MIME cannot be opened. The error message "Your digital ID name cannot be found by the underlying security system" appears."

If private key archival has been enabled, it may be necessary to export these keys from the certification authority database and convert them to another format (PKCS#12, PFX), for example for long-term archiving.

Below is a description of the procedure for exporting individual or all archived keys and obtaining the necessary meta-information.

Continue reading "Export archived private keys from the certification authority database"

Assume the following scenario:

• A user or a computer requests a certificate from an Active Directory integrated certification authority (enterprise CA)
• The certificate request fails with the following error message:

The certificate request could not be submitted to the certification authority. Error: The RPC server is unavailable. 0x800706ba (WIN32: 1722 RPC_S_SERVER_UNAVAILABLE) 

Continue reading "Certificate request fails with error message "The certificate request could not be submitted to the certification authority. Error: The RPC server is unavailable. 0x800706ba (WIN32: 1722 RPC_S_SERVER_UNAVAILABLE)"."

Assume the following scenario:

• A user requests a certificate from an Active Directory integrated certification authority (enterprise CA).
• The certificate template is set up for archiving private keys.
• The certificate request fails with the following error message:

Cannot archive private key. The certification authority could not verify one or more key recovery certificates. 0x8009400b (-2146877429 CERTSRV_E_NO_VALID_KRA)

Continue reading "Certificate request fails with error message "Cannot archive private key. The certification authority could not verify one or more key recovery certificates. 0x8009400b (-2146877429 CERTSRV_E_NO_VALID_KRA)"."