Tag: Subject alternative name (SAN)

Continue reading "Details of the event with ID 53 of the source Microsoft-Windows-CertificationAuthority"

Continue reading "Details of the event with ID 22 of the source Microsoft-Windows-CertificationAuthority"

Continue reading "Details of the event with ID 30 of the source Microsoft-Windows-NetworkDeviceEnrollmentService"

Continue reading "Details of the event with ID 21 of the source Microsoft-Windows-Kerberos-Key-Distribution-Center"

Even with a certificate template for domain controllers that is supposedly simple to configure, there are a few things to keep in mind.

Continue reading "Configuring a Certificate Template for Domain Controllers"

The following describes the steps required to configure the Network Device Enrollment Service (NDES) for use with an alias.

Continue reading "Configuring the Network Device Enrollment Service (NDES) for use with an alias"

There are cases in which you cannot or do not want to obtain Remote Desktop certificates from a certification authority in your own Active Directory forest, for example, if the system in question is not a domain member.

In this case, the use of certificate templates is not possible, and one must manually create a Certificate Signing Request (CSR).

Continue reading "Manually requesting a Remote Desktop (RDP) certificate"

Assume the following scenario:

• Certificates for domain controllers are issued by an Active Directory integrated certification authority (enterprise CA)
• The certificate template used for this purpose was created by yourself
• The issued certificates contain in the Subject Alternative Name (SAN) only the fully qualified computer name of the respective domain controller, but not the fully qualified name and the NETBIOS name of the domain

Continue reading "Certificates for domain controllers do not contain the domain name in the Subject Alternative Name (SAN)"

In principle, RFC 5280 allows the use of arbitrary strings in the subject distinguished name (DN) of a certificate. Common fields are described in the X.520 standard. The length restrictions are also recommended by the ITU-T . The abbreviations commonly used today are mainly taken from RFC 4519 .

However, Microsoft Active Directory Certificate Services only allows certain RDNs by default.

The following Relative Distinguished Names (RDNs) are accepted by the Active Directory Certificate Services (AD CS) certification authority by default:

Continue reading "Allowed Relative Distinguished Names (RDNs) in the Subject of Issued Certificates"

Often, before submitting a certificate request to a certification authority - or before issuing the certificate - you want to verify that it contains the desired values.

The following describes how to achieve this.

Continue reading "Inspect a certificate request (CSR)"

In simple terms, public key cryptography can be reduced to the assumption that the private part of each key pair is known only to its owner.

A certification authority is responsible for the correct identification of users, computers or resources. Its issued certificates are therefore granted a trust status because all participants assume that its private key is known only to it.

If an attacker succeeds in gaining knowledge of a certification authority's private key, or at least to perform signatures using the private key , the integrity of the certification authority is no longer guaranteed.

Continue reading "Attack vector on Active Directory directory service via smart card logon mechanism"

With the Chromium project and products based on it such as Google Chrome and Microsoft Edge, Google has moved to enforcing RFC 2818 , which was adopted in 2000, and to no longer trusting certificates that no longer fulfill the RFC.

For us, the following sentence is highly significant:

If a subjectAltName extension of type dNSName is present, that MUST be used as the identity. Otherwise, the (most specific) Common Name field in the Subject field of the certificate MUST be used. Although the use of the Common Name is existing practice, it is deprecated and Certification Authorities are encouraged to use the dNSName instead

— https://tools.ietf.org/html/rfc2818

Continue reading "Generating an RFC 2818 compliant certificate request for SSL certificates"

Unfortunately, far too many instructions are circulating online (the big players are not exempt from this either, not even Microsoft itself or the grand master Komar ), which fatally recommend setting the EDITF_ATTRIBUTESUBJECTALTNAME2 flag on the certification authority - supposedly so that one would be able to issue certificates with a Subject Alternative Name (SAN) extension for manually submitted certificate requests.

Unfortunately, this approach is not only unnecessary, it also has some unpleasant side effects, which in the worst case can help an attacker to take over the entire Active Directory forest.

Continue reading "Active Directory forest compromised by EDITF_ATTRIBUTESUBJECTALTNAME2 flag"

There are cases where you cannot or do not want to obtain domain controller certificates from a certification authority in your own Active Directory forest.

In this case, the use of certificate templates is not possible, and one must manually create a Certificate Signing Request (CSR).

Continue reading "Manually requesting a domain controller certificate"