Tag: Registration Authority (RA)

The Simple Certificate Enrollment Protocol (SCEP) is an ancient protocol from the early 2000s. It does not use Transport Layer Security (TLS). Therefore, the protocol messages are encrypted at the transport layer.

When sending the certificate request to the NDES server, the client will encrypt the certificate request with the NDES server's CEP Encryption certificate (which was previously communicated to it via the GetCACert message).

When the issued certificate is received, the NDES server will encrypt the response with a self-signed certificate temporarily created by the SCEP client.

In both cases, a symmetric encryption algorithm is used.

Continue reading "Cryptographic Hardening of SCEP Transactions for the Network Device Enrollment Service (NDES)"

Understanding the roles involved is essential for designing a public key infrastructure.

The term "public key infrastructure" encompasses much more than the technical components and is often used in a misleading way.

In summary, a public key infrastructure is both an authentication technology and the totality of all the components involved.

Continue reading "Roles in a public key infrastructure"

If one installs a Network Device Enrollment Service (NDES), one is faced with the question under which identity the IIS application pool should be operated. In the following, the individual options are examined in more detail in order to facilitate a selection.

Continue reading "Selecting the identity for the IIS application pool of the Network Device Enrollment Service (NDES)"

The following is a description of the Enroll on Behalf Of function and how it differs from other methods of requesting certificates.

Continue reading "Basics: Enroll on Behalf of (EOBO)"

Assume the following scenario:

• A certificate is requested for a user or a computer from a certification authority via the certificate management console (certlm.msc or certmgr.msc).
• The Enroll on Behalf of (EOBO) mechanism is used for this.
• The desired certificate template is not displayed.
• If you check the "Show all templates" checkbox, the following error message will be displayed for the desired certificate template:

The certificate template requires too many RA signatures. Only one RA signature is allowed. Multiple request agent signatures are not permitted on a certificate request.

Continue reading "Requesting certificates via Enroll on Behalf of (EOBO) is not possible because the certificate template is not displayed. The error message is "The certificate template requires too many RA signatures.""

The Network Device Enrollment Service (NDES) has two Registration Authority certificates. The Enrollment Agent certificate is used to sign certificate requests, and one can configure the NDES device template accordingly, so that certificates are only issued if the submitted certificate requests also have a corresponding signature .

If you plan to remove the certification authority connected to NDES from the NTAuthCertificates object , the question may arise as to whether mutual dependencies need to be taken into account here - after all, Enroll on Behalf Of (EOBO) requires the presence of the certification authority certificate in NTAuthCertificates.

Continue reading "Is there a dependency of the Network Device Enrollment Service (NDES) on the NTAuthCertificates object?"

Once NDES has been in operation for some time (typically two years), one is faced with the challenge of renewing the Registration Authority (RA) certificates. Unfortunately, this process is not necessarily solved intuitively and is therefore described in more detail in this article.

Continue reading "Renew the Registration Authority (RA) certificates for the Network Device Enrollment Service (NDES)"

Assume the following scenario:

• An NDES server is configured on the network.
• HTTP error 500 (Internal Server Error) is reported when accessing the NDES request web page (mscep) and the NDES administration web page (certsrv/mscep_admin).
• Events no. 2 and 10 are logged in the Application event log:

The Network Device Enrollment Service cannot be started (0x80070057). The parameter is incorrect.

The Network Device Enrollment Service cannot retrieve one of its required certificates (0x80070057). The parameter is incorrect.

Continue reading "The Network Device Enrollment Service (NDES) logs the error message "The Network Device Enrollment Service cannot retrieve one of its required certificates (0x80070057). The parameter is incorrect.""

Assume the following scenario:

• An NDES instance is installed on the network.
• The certification authority issuing certificates to NDES is to be changed.

The official statement on this is that NDES must be reinstalled and reconfigured in this case. However, this is not necessary. The necessary steps are described below.

Continue reading "Moving Network Device Enrollment Service (NDES) to another certification authority"

The Network Device Enrollment Service (NDES) uses two certificate templates for its internal function to make it act as a Registration Authority (RA). These are published during role configuration of the NDES service on the configured certification authority and certificates are requested:

• CEP Encryption
• Exchange Enrollment Agent (Offline Request)

These certificate templates are standard templates from the Windows 2000 world (version 1 templates), i.e. they cannot be edited. In addition, the Exchange Enrollment Agent (Offline Request) template is marked as a user template, i.e. during NDES role configuration the certificate is requested in the context of the installing user and then imported into the machine store. At the latest when the certificates are to be renewed after two years, things get complicated here.

It is therefore a good idea to use your own certificate templates for NDES. These can be adapted in terms of their key length, for example. The use of hardware security modules (HSM) is also possible in this way. Even automatic renewal can be configured.

Continue reading "Using custom Registration Authority (RA) certificate templates for the Network Device Enrollment Service (NDES)"