Tag: Subject alternative name (SAN)

Dirk-jan Mollema recently presented an attack that can be used to obtain a certificate for highly privileged accounts via Intune . This can then be used to compromise the entire Active Directory environment.

The attack is similar in its basic features to what I have already described in the article "From Zero to Enterprise Administrator through Network Device Enrollment Service (NDES) - and What to Do About It " and in the article "Attack vector on Active Directory directory service via smart card logon mechanism " (generally also known as ESC1 ).

What is new, however, is to utilize the Mobile Device Management (MDM) system - in this case Microsoft Intune - accordingly.

What is not new, however, is what can be done with the TameMyCerts Policy Module for Active Directory Certificate Services to drastically reduce the attack surface...

Continue reading "Attack on the Active Directory via Microsoft Intune - and how it can be contained with TameMyCerts"

Like any software Microsoft Active Directory Certificate Services are also subject to certain limits imposed by their design.

What is not so obvious is the question of how many subject alternative names (SAN) can be issued with the Microsoft certification authority.

The IETF RFC 5280 describes the structure for Subject Alternative Names as follows:

SubjectAltName ::= GeneralNames

Continue reading "How many Subject Alternative Names (SAN) do the Active Directory Certificate Services support?"

Nowadays, it is essential to protect the authentication of devices on the company network and administrative interfaces. As a rule, digital certificates are used for this purpose.

Printers therefore also generally require digital certificates in order to be operated securely. From a certain number of devices, there is no getting around automatic certificate distribution.

Some printer manufacturers offer centralized management solutions for certificate distribution.

Unfortunately, it has been shown time and again that the secure handling of digital certificates requires a great deal of knowledge, experience and care, which is often not the case.

Continue reading "How securing printers can turn into a security disaster - and how the TameMyCerts Policy Module for Active Directory Certificate Services (ADCS) can prevent it"

Starting with version 58, Google has decided to remove support for the Subject Distinguished Name of web server certificates in the Chrome browser and instead only accept certificates with Subject Alternative Name.

Since then, web server certificates without a Subject Alternative Name in the form of a dNSName have been rejected by Google Chrome and other Chromium -based browsers (i.e. also Microsoft Edge ). Other browser manufacturers quickly adopted this approach, so that this problem now affects all popular browsers.

Continue reading "How the TameMyCerts Policy Module for Active Directory Certificate Services (ADCS) can repair incoming certificate requests to make them RFC compliant"

Attacks on Microsoft certification authorities can be aimed at exploiting permissions on certificate templates. In many cases, certificate templates must be configured to grant the enrollee the right to request arbitrary identities. This can lead to the attacker taking over the identities of Active Directory accounts and subsequently to privilege escalation. Attacks of this type are known in the security scene as "ESC1 ".

Continue reading "How the TameMyCerts Policy Module for Active Directory Certificate Services (ADCS) can prevent attacks against the ESC1 attack vector"

Companies use Mobile Device Management (MDM) products for managing, configuring and updating mobile devices such as smartphones, tablet computers or desktop systems via the Internet (over-the-air, OTA).

Common mobile device management products are:

• Microsoft Intune
• VMware Workspace One (previously known under the brand name AirWatch)
• Ivanti MobileIron UEM
• Jamf Pro
• Baramundi Enterprise Mobility Management
• BlackBerry Enterprise Mobility Suite
• Sophos Mobile Control
• SOTI MobiControl
• Samsung Knox
• IBM MaaS360

Continue reading "How the TameMyCerts Policy Module for Active Directory Certificate Services (ADCS) can help secure scenarios with Microsoft Intune and other Mobile Device Management (MDM) systems"

With the supposedly good intention of making it possible to issue such certificate requests with a SAN, unfortunately far too many guides advise enabling the EDITF_ATTRIBUTESUBJECTALTNAME2 flag on the certification authority.

If this flag is enabled, a very large attack surface is offered, as any enrollee can now instruct the certification authority to issue certificates with any content. This type of attack is known in the security scene as ESC6 and ESC7 .

Continue reading "How the TameMyCerts Policy Module for Active Directory Certificate Services (ADCS) can detect and prevent attacks against the ESC6 and ESC7 attack vectors"

With the Chromium project and products based on it such as Google Chrome and Microsoft Edge, Google has moved to enforce RFC 2818 , adopted in 2000, and to no longer trust certificates that no longer fulfill this requirement.

For us, the following sentence is of great significance:

If a subjectAltName extension of type dNSName is present, that MUST be used as the identity. Otherwise, the (most specific) Common Name field in the Subject field of the certificate MUST be used. Although the use of the Common Name is existing practice, it is deprecated and Certification Authorities are encouraged to use the dNSName instead

— https://tools.ietf.org/html/rfc2818

Continue reading "Automatically enter DNS names in the Subject Alternative Name (SAN) of issued certificates - with the TameMyCerts Policy Module for Microsoft Active Directory Certificate Services (AD CS)"

On the internet, there are unfortunately far too many instructions (the big players are not excluded from this , not even Microsoft itself or the grandmaster Komar ), which fatally recommend that the flag EDITF_ATTRIBUTESUBJECTALTNAME2 should be set on the certification authority - supposedly to be able to issue certificates with Subject Alternative Name (SAN) extension for manually submitted certificate requests.

Unfortunately, this procedure is not only unnecessary, it also has some unpleasant side effects, which in the worst case can help an attacker to take over the entire Active Directory forest .

Continue reading "Change the Subject Alternative Name (SAN) of a certificate before it is issued - but do it securely!"

As the operator of a certification authority, you are (among other things) responsible for the identification of the enrollees and the confirmation of the requested identities . The fact that this task is carried out conscientiously and without error is the central pillar of the trust placed in the certification authority. Well-known companies have already failed at this task , even had to file for insolvency as a result of misissuances and/or were severely punished by the big players in the market.

In many cases, we as (Microsoft) PKI operators in companies (regardless of the associated quality) are able to delegate our task of uniquely identifying an enrollee to the Active Directory. In many cases, however, we unfortunately also have to instruct our certification authority(ies) to simply issue everything that is requested.

Continue reading "A policy module to tame them all: Introducing the TameMyCerts Policy Module for Microsoft Active Directory Certificate Services"

Name constraints are part of the X.509 standard and are described in RFC 5280 . They are a tool that can be used as part of qualified subordination to control the scope of a certification authority certificate in a fine-grained manner.

Continue reading "Basics: Name Constraints"

In the following, I would like to present a highly dangerous PKI configuration, perhaps not necessarily known to the general public, which can probably be encountered quite frequently in this way in corporate networks.

I show how, by exploiting various unfortunate circumstances in the Windows PKI, it is possible to elevate privileges from mere network access to complete Active Directory takeover.

The initial point of attack in this example is the Network Device Enrollment Service (NDES).

Continue reading "From Zero to Enterprise Administrator through Network Device Enrollment Service (NDES) - and What to Do About It"

The capolicy.inf contains basic settings that can or should be specified before installing a certification authority. Put simply, no certification authority should be installed without it.

Continue reading "Basics: Configuration file for the certification authority (capolicy.inf)"

Time and again in discussions about the security of a certification authority, it comes up that abuse of the certification authority could be contained by its security settings.

However, the fact that the integrity of a certification authority is directly tied to its key material and can therefore also be compromised through it is not obvious at first glance.

One has to think of the certification authority software as a kind of management around the key material. For example, the software provides an online interface for certificate enrollment , takes care of the authentication of the enrollees, the automated execution of signature operations (issuing certificates and certificate revocation lists ) and their logging (certification authority database , audit log , event log ).

However, signature operations require nothing more than the private key of the certification authority. The following example shows how an attacker, given access to the certification authority's private key, can generate and issue certificates without the certification authority software and its security mechanisms noticing.

With such a certificate, it would in the worst case even be possible to take over the Active Directory forest undetected .

Continue reading "Signing certificates bypassing the certification authority"

If you want to equip Windows systems with certificates that do not have the option of communicating directly with an Active Directory-integrated certification authority, or that are not even in the same Active Directory forest, the only option in most cases is to install certificates manually.

Since Windows 8.1 / Windows Server 2012 R2, however, there is an integrated client for the Simple Certificate Enrollment Protocol (SCEP) on board. On the server side, SCEP has been implemented in the Microsoft PKI via the Network Device Enrollment Service (NDES) since Windows Server 2003.

A particularly interesting feature of SCEP is that the protocol allows a certificate to be renewed by specifying an existing one. So what could be more obvious than to use this interface? What is still missing is a corresponding automation via Windows PowerShell.

Continue reading "Requesting a Certificate for Windows Systems Using the SCEP Protocol via the Network Device Enrollment Service (NDES) with Windows PowerShell"