Tag: Registry

Cryptographic Hardening of SCEP Transactions for the Network Device Enrollment Service (NDES)

The Simple Certificate Enrollment Protocol (SCEP) is an ancient protocol from the early 2000s. It does not use Transport Layer Security (TLS). Therefore, the protocol messages are encrypted at the transport layer.

When sending the certificate request to the NDES server, the client will encrypt the certificate request with the NDES server's CEP Encryption certificate (which was previously communicated to it via the GetCACert message).

When the issued certificate is received, the NDES server will encrypt the response with a self-signed certificate temporarily created by the SCEP client.

In both cases, a symmetric encryption algorithm is used.

Continue reading "Cryptographic Hardening of SCEP Transactions for the Network Device Enrollment Service (NDES)"

Prevent unprivileged accounts from reading the configuration of the certification authority

During penetration tests and also for attackers searching the network for potential targets, insights into the configuration of the certification authority are highly interesting.

In addition to possible misconfigurations, attackers can obtain information about the policy module used on the certification authority.

Continue reading "Prevent unprivileged accounts from reading the configuration of the certification authority"

Installation or uninstallation of a Windows feature fails with error message "The service is configured to not accept any remote shell requests."

Assume the following scenario:

  • A Windows role related to Active Directory Certificate Services (Certification Authority, Network Device Enrollment Service (NDES), Certification Authority Web Enrollment (CAWE), Certificate Enrollment Web Services (CEP, CES), or Online Responder (OCSP)) is to be installed or uninstalled.
  • The installation or uninstallation fails with the following error message:
The status of the role services on the target machine cannot be determined. Please retry. The error is The WS-Management service cannot process the request. The service is configured to not accept any remote shell requests.

Continue reading "Installation or uninstallation of a Windows feature fails with error message "The service is configured to not accept any remote shell requests.""

Configure the "Magic Number" for the Online Responder

Even if an Online Responder is present in the network and the certification authority has entered its address in the Authority Information Access (AIA) extension of the issued certificates, it is not always guaranteed that the Online Responder is actually used.

One variable here is the "Magic Number", which is present on every Windows operating system. It causes the system to fall back to certificate revocation lists (if present) if requests are made too often via OCSP for the same certification authority.

Continue reading "Configure the "Magic Number" for the Online Responder"

Details of the event with ID 131 of the source Microsoft-Windows-CertificationAuthority

Event Source:Microsoft-Windows-CertificationAuthority
Event ID:131 (0x83)
Event log:Application
Event type:Warning
Event text (English):An invalid OID has been detected in the EKUOIDsForPublishExpiredCertInCRL configuration setting. To resolve, run: "certutil -getreg ca\EKUOIDsForPublishExpiredCertInCRL" to identify the invalid OID and correct it. The default OIDs ("1.3.6.1.5.5.7.3.3" and "1.3.6.1.4.1.311.61.1.1") will be used.
Event text (German):In der Konfigurationseinstellung "EKUOIDsForPublishExpiredCertInCRL" wurde eine ungültige OID festgestellt. Führen Sie zum Beheben den Befehl "certutil -getreg ca\EKUOIDsForPublishExpiredCertInCRL" aus, um die ungültige OID zu ermitteln und zu korrigieren. Die Standard-OIDs ("1.3.6.1.5.5.7.3.3" und "1.3.6.1.4.1.311.61.1.1") werden verwendet.

Continue reading "Details of the event with ID 131 of the source Microsoft-Windows-CertificationAuthority"

Querying the configured RPC endpoints of a certification authority

In the default configuration, the certification authority's certificate request interface is configured to negotiate dynamic ports for the incoming RPC/DCOM connections (for more details, see the article "Firewall rules required for Active Directory Certificate Services ").

However, it is also possible to configure the certification authority to a static port (see article "Configuring the certification authority to a static port (RPC endpoint) ").

The following describes how to check the current configuration of the certification authority.

Continue reading "Querying the configured RPC endpoints of a certification authority"

Configure Path Length Constraint for Certificates Issued by a Certification Authority

For stronger control over the certificates that can be issued by a certification authority, a path length constraint can be set up so that certification authorities from a defined hierarchy level onward are no longer able to issue subordinate certification authority certificates

For an explanation of how the path length constraint works, see the article "Basics: Path Length Constraint" .

Continue reading "Configure Path Length Constraint for Certificates Issued by a Certification Authority"

Removing old certification authority certificates from the configuration of a certification authority

During the lifetime of a certification authority, certification authority certificates are renewed according to the planning for their life cycle. A new key pair can optionally be used here. The previous certification authority certificates expire or are revoked.

Expired certification authority certificates can become a problem under certain circumstances if, for example, the associated private keys are stored on old hardware security modules (HSM) and these can only be migrated to new hardware with great difficulty.

In such a case, it may be useful to remove old certification authority certificates from the certification authority configuration.

Continue reading "Removing old certification authority certificates from the configuration of a certification authority"

Deleting a Manually Configured Certificate Enrollment Policy (Enrollment Policy)

When working with Certificate Enrollment Web Services and manually entering certificate enrollment policies on client computers, one encounters the phenomenon that there is no way to edit or delete them in the Certificates management console.

Continue reading "Deleting a Manually Configured Certificate Enrollment Policy (Enrollment Policy)"

The Network Device Enrollment Service (NDES) logs the error message "The Network Device Enrollment Service cannot be started (0x80070002). The system cannot find the file specified."

Assume the following scenario:

  • An NDES server is configured on the network.
  • HTTP error 500 (Internal Server Error) is reported when accessing the NDES request web page (mscep) and the NDES administration web page (certsrv/mscep_admin).
  • Event No. 2 is logged in the application event log:
The Network Device Enrollment Service cannot be started (0x80070002). The system cannot find the file specified.

Continue reading "The Network Device Enrollment Service (NDES) logs the error message "The Network Device Enrollment Service cannot be started (0x80070002). The system cannot find the file specified.""

Configuring the Network Device Enrollment Service (NDES) to operate without a password

There are situations in which you cannot operate NDES with changing passwords. This is usually the case when there is either no management solution for the devices to be managed, or when it cannot handle changing passwords. Some solutions cannot handle a password at all.

In this case, you can configure NDES not to generate or require a password.

Continue reading "Configuring the Network Device Enrollment Service (NDES) to operate without a password"

Configuring the Network Device Enrollment Service (NDES) to work with a static password

There are situations in which you cannot operate NDES with changing passwords. This is usually the case when there is either no management solution for the devices to be managed, or when it cannot handle changing passwords.

In this case, you can configure NDES to generate a static password that will not change afterwards.

Continue reading "Configuring the Network Device Enrollment Service (NDES) to work with a static password"