Tag: Smart card logon

In simple terms, public key cryptography can be reduced to the assumption that the private part of each key pair is known only to its owner.

A certification authority is responsible for the correct identification of users, computers or resources. Its issued certificates are therefore granted a trust status because all participants assume that its private key is known only to it.

If an attacker succeeds in gaining knowledge of a certification authority's private key, or at least to perform signatures using the private key , the integrity of the certification authority is no longer guaranteed.

Continue reading "Attack vector on Active Directory directory service via smart card logon mechanism"

Anyone who wants to use the smart card logon feature in their company would be well advised to ensure that their certification authority has the strongest possible security hardening. This includes some essential measures:

• Removing all unnecessary certification authority certificates from the NTAuthCertificates object in Active Directory : Each certification authority located in this store is authorized to issue smart card logon certificates in Active Directory for the complete forest.
• Use qualified subordination : Restricting the certification authority certificates so that they are only trusted for the Extended Key Usages actually issued. In the event of a compromise of the certification authority, the damage is then limited to these Extended Key Usages. The "Smart Card Logon" Extended Key Usage would then only be present in the certification authority certificate of the certification authority that actually issues such certificates.

What is interesting about these thoughts, however, is that the domain controllers do not check the Extended Key Usages at all when logging on via smart card.

Continue reading "Domain controllers do not check Extended Key Usage on smart card logon"

Unfortunately, far too many instructions are circulating online (the big players are not exempt from this either, not even Microsoft itself or the grand master Komar ), which fatally recommend setting the EDITF_ATTRIBUTESUBJECTALTNAME2 flag on the certification authority - supposedly so that one would be able to issue certificates with a Subject Alternative Name (SAN) extension for manually submitted certificate requests.

Unfortunately, this approach is not only unnecessary, it also has some unpleasant side effects, which in the worst case can help an attacker to take over the entire Active Directory forest.

Continue reading "Active Directory forest compromised by EDITF_ATTRIBUTESUBJECTALTNAME2 flag"

Over the generations of Windows operating systems, various certificate templates for domain controllers have been established. In a current Active Directory directory service, one will find three different templates for this purpose.

• Domain Controller
• Domain Controller Authentication
• Kerberos Authentication

Below is a description of each template and a recommendation for configuring domain controller certificate templates.

Continue reading "Overview of the different generations of domain controller certificates"

Assume the following scenario:

• Domain controllers have certificates for LDAP over SSL.
• The certificates do not include the Extended Key Usage "Smart Card Logon" or "Kerberos Authentication".
• If you run certutil -dcinfo, the command reports the following error message:

0 KDC certificates for DC01
No KDC Certificate in MY store
KDC certificates: Cannot find object or property. 0x80092004 (-2146885628 CRYPT_E_NOT_FOUND) 

Continue reading "certutil -dcinfo fails with error message "KDC certificates: Cannot find object or property. 0x80092004 (-2146885628 CRYPT_E_NOT_FOUND)""

There are cases where you cannot or do not want to obtain domain controller certificates from a certification authority in your own Active Directory forest.

In this case, the use of certificate templates is not possible, and one must manually create a Certificate Signing Request (CSR).

Continue reading "Manually requesting a domain controller certificate"

Here's the scenario:

• A user requests a certificate from an Active Directory integrated certification authority (enterprise CA).
• The certificate of the certification authority is trusted, i.e. it is located in the Trusted Root Certification Authorities store.
• The certificate request fails with the following error message:

A certification chain processed correctly, but one of the CA certificates is not trusted by the policy provider. 0x800b0112 (-2146762478 CERT_E_UNTRUSTEDCA)

Continue reading "Requesting a certificate fails with the error message "A certification chain processed correctly, but one of the CA certificates is not trusted by the policy provider. 0x800b0112 (-2146762478 CERT_E_UNTRUSTEDCA)""