Tag: SCEP

With the May 2026 security update, Microsoft has added support for the ML-DSA algorithm in Active Directory Certificate Services.

In their documentation, they do write that NDES is not compatible with ML-DSA :

You can enroll ML-DSA certificates through the Certificates Microsoft Management Console (MMC) snap-in and certreq.exe. Enrollment through the Network Device Enrollment Service (NDES) isn't currently available.

But that's not entirely true…

Continue reading "Requesting Certificates with ML-DSA-Based Keys Through the Network Device Enrollment Service (NDES)"

The Simple Certificate Enrollment Protocol (SCEP) is an ancient protocol from the early 2000s. It does not use Transport Layer Security (TLS). Therefore, the protocol messages are encrypted at the transport layer.

When sending the certificate request to the NDES server, the client will encrypt the certificate request with the NDES server's CEP Encryption certificate (which was previously communicated to it via the GetCACert message).

When the issued certificate is received, the NDES server will encrypt the response with a self-signed certificate temporarily created by the SCEP client.

In both cases, a symmetric encryption algorithm is used.

Continue reading "Cryptographic Hardening of SCEP Transactions for the Network Device Enrollment Service (NDES)"

Dirk-jan Mollema recently presented an attack that can be used to obtain a certificate for highly privileged accounts via Intune . This can then be used to compromise the entire Active Directory environment.

The attack is similar in its basic features to what I have already described in the article "From Zero to Enterprise Administrator through Network Device Enrollment Service (NDES) - and What to Do About It " and in the article "Attack vector on Active Directory directory service via smart card logon mechanism " (generally also known as ESC1 ).

What is new, however, is to utilize the Mobile Device Management (MDM) system - in this case Microsoft Intune - accordingly.

What is not new, however, is what can be done with the TameMyCerts Policy Module for Active Directory Certificate Services to drastically reduce the attack surface...

Continue reading "Attack on the Active Directory via Microsoft Intune - and how it can be contained with TameMyCerts"

Assume the following scenario:

• A certificate is requested through the Network Device Enrollment Service (NDES).
• Renewal mode is used here, i.e. the certificate request is signed with an existing certificate.
• The request for the new certificate fails with the following error message:

A certification chain processed correctly, but one of the CA
certificates is not trusted by the policy provider. 0x800b0112 (-2146762478 CERT_E_UNTRUSTEDCA)

Continue reading "Renewal of a certificate via the Network Device Enrollment Service (NDES) fails with error code CERT_E_UNTRUSTEDCA"

Continue reading "Details of the event with ID 86 of the source Microsoft-Windows-CertificateServicesClient-CertEnroll"

Continue reading "Details of the event with ID 87 of the source Microsoft-Windows-CertificateServicesClient-CertEnroll"

In the following, I would like to present a highly dangerous PKI configuration, perhaps not necessarily known to the general public, which can probably be encountered quite frequently in this way in corporate networks.

I show how, by exploiting various unfortunate circumstances in the Windows PKI, it is possible to elevate privileges from mere network access to complete Active Directory takeover.

The initial point of attack in this example is the Network Device Enrollment Service (NDES).

Continue reading "From Zero to Enterprise Administrator through Network Device Enrollment Service (NDES) - and What to Do About It"

Assume the following scenario:

• A certificate request is made on a Linux system (for example, a thin client) by means of SSCEP against a Network Device Enrollment Service (NDES) .
• The certificate request fails with the following error message:

sscep: Subject of our request does not match that of the returned Certificate!

Continue reading "SSCEP: Subject of our request does not match that of the returned Certificate!"

If you want to equip a large number of systems with certificates, a manual request and renewal of the certificates is not an option. The only viable path is automation.

For systems that are not members of the Active Directory forest, an automatic certificate request via RPC/DCOM is not an option.

For certain use cases, the Simple Certificate Enrollment Protocol (SCEP) is an interesting alternative. For this protocol, there are clients not only for Windows but, with SSCEP, also for Linux. SSCEP is used, among others, by thin clients with the eLux operating system .

The following describes how to set up the SSCEP client on a Debian Buster Linux system - either to use it to manage servers or to be able to test the client-side behavior.

Continue reading "Install SSCEP for Linux (Debian Buster) and request certificates via the Network Device Enrollment Service (NDES)"

If you want to equip Windows systems with certificates that do not have the option of communicating directly with an Active Directory-integrated certification authority, or that are not even in the same Active Directory forest, the only option in most cases is to install certificates manually.

Since Windows 8.1 / Windows Server 2012 R2, however, there is an integrated client for the Simple Certificate Enrollment Protocol (SCEP) on board. On the server side, SCEP has been implemented in the Microsoft PKI via the Network Device Enrollment Service (NDES) since Windows Server 2003.

A particularly interesting feature of SCEP is that the protocol allows a certificate to be renewed by specifying an existing one. So what could be more obvious than to use this interface? What is still missing is a corresponding automation via Windows PowerShell.

Continue reading "Requesting a Certificate for Windows Systems Using the SCEP Protocol via the Network Device Enrollment Service (NDES) with Windows PowerShell"

The Simple Certificate Enrollment Protocol (SCEP) was developed by Verisign for Cisco in the early 2000s to provide a simplified method for requesting certificates. Previously, network devices required manually generating a certificate request on each device, submitting it to a certification authority, and then manually installing the issued certificate on the corresponding device again.

Continue reading "Basics: Network Device Enrollment Service (NDES)"

Continue reading "Details of the event with ID 37 of the source Microsoft-Windows-NetworkDeviceEnrollmentService"

Continue reading "Details of the event with ID 36 of the source Microsoft-Windows-NetworkDeviceEnrollmentService"

Continue reading "Details of the event with ID 35 of the source Microsoft-Windows-NetworkDeviceEnrollmentService"

Continue reading "Details of the event with ID 34 of the source Microsoft-Windows-NetworkDeviceEnrollmentService"