Like any software Microsoft Active Directory Certificate Services are also subject to certain limits imposed by their design.
What is not so obvious is the question of how many subject alternative names (SAN) can be issued with the Microsoft certification authority.
The IETF RFC 5280 describes the structure for Subject Alternative Names as follows:
SubjectAltName ::= GeneralNamesUsually, the encoding of characters and strings in certificates is not a topic of great interest to the users of a PKI. However, there are cases where the default settings of the certification authority do not provide the desired results.
Name constraints are part of the X.509 standard and are described in RFC 5280 . They are a tool that can be used as part of qualified subordination to control the scope of a certification authority certificate in a fine-grained manner.
Certificate extensions were introduced with version 3 of the X.509 standard. The Key Usage extension is an optional certificate extension that is defined in RFC 5280 and is used to limit the permitted uses of a key.
Continue reading "Basics: The Key Usage Certificate Extension"
The purposes for which a digital certificate may be used are controlled via the certificate extensions "Key Usage" and "Extended Key Usage".
The "Extended Key Usage" certificate extension contains the extended key usages for which the certificate may be used.
However, certificates issued by a Microsoft certification authority contain another certificate extension called "Application Policies", which also contains a list very similar to the Extended Key Usages extension.
Continue reading "The "Application Policies" certificate extension"
The capolicy.inf contains basic settings that can or should be specified before installing a certification authority. Put simply, no certification authority should be installed without it.
Continue reading "Basics: Configuration file for the certification authority (capolicy.inf)"
The attack on the MD5 signature algorithm demonstrated in late 2008 could only be used to create a usable forged certification authority certificate because the attacked certification authority had not configured a path length constraint.
The path length constraint is described in RFC 5280 . The idea behind this is that the maximum depth of the certification authority hierarchy is stored in the "Basic Constraints" extension of a certification authority certificate.
If a valid, unexpired certificate is to be withdrawn from circulation, it must be revoked. For this purpose, the certification authorities maintain corresponding certificate revocation lists in which the digital fingerprints of the revoked certificates are listed. They must be queried during the validity check.
Continue reading "Basics: Checking the revocation status of certificates"
With regard to the design of the infrastructure for providing revocation information - i.e. the CRL distribution points (CDP) as well as the Online Responders (Online Certificate Status Protocol, OCSP) - the question arises whether these should be "secured" via Secure Sockets Layer (SSL) or Transport Layer Security (TLS).
Nowadays rather a curiosity than really relevant in practice, but it does happen from time to time that you receive certificate requests that contain more than one common name in the subject. Even though it may seem surprising, this is quite possible and also RFC compliant.
Continue reading "More than one common name (CN) in the certificate"
Below is a description of the configuration settings required to ensure that a certificate hierarchy based on Active Directory Certificate Services complies with the Common PKI (formerly known as ISIS-MTT) standard.
In principle, RFC 5280 allows the use of arbitrary strings in the subject distinguished name (DN) of a certificate. Common fields are described in the X.520 standard. The length restrictions are also recommended by the ITU-T . The abbreviations commonly used today are mainly taken from RFC 4519 .
However, Microsoft Active Directory Certificate Services only allows certain RDNs by default.
The following Relative Distinguished Names (RDNs) are accepted by the Active Directory Certificate Services (AD CS) certification authority by default:
Continue reading "Allowed Relative Distinguished Names (RDNs) in the Subject of Issued Certificates"
If you install an issuing CA and do not explicitly request an issuance policy, the resulting CA certificate will not contain an issuance policy.
If you want to include the wildcard issuance policy (All Issuance Policies) in the certification authority certificate, proceed as follows: