Assume the following scenario:
sscep: Subject of our request does not match that of the returned Certificate!Continue reading "SSCEP: Subject of our request does not match that of the returned Certificate!"
Sometimes it is necessary to allow Relative Distinguished Names (RDNs) in issued certificates that are not defined and therefore could not be configured in the SubjectTemplate value in the certification authority's registry either.
An example of this is the Organization Identifier with object identifier 2.5.4.97, which is required, for example, for certificates that comply with the eIDAS Regulation.
Continue reading "Use of undefined Relative Distinguished Names (RDN) in issued certificates"
Microsoft Active Directory Certificate Services does not transfer subjects from certificate requests for templates in which the enrollee is allowed to supply them 1:1 into the issued certificate.
Instead, it is defined both which Relative Distinguished Names (RDNs) are allowed and in which order they are written to issued certificates. However, this order can be changed. How this is done is explained below.
| Event Source: | Microsoft-Windows-CertificationAuthority |
| Event ID: | 53 (0x35) |
| Event log: | Application |
| Event type: | Warning |
| Symbolic Name: | MSG_DN_CERT_DENIED_WITH_INFO |
| Event text (English): | Active Directory Certificate Services denied request %1 because %2. The request was for %3. Additional information: %4 |
| Event text (German): | Die Anforderung %1 wurde abgelehnt, da %2. Die Anforderung war für %3. Weitere Informationen: %4 |
| Event Source: | Microsoft-Windows-CertificationAuthority |
| Event ID: | 22 (0x16) |
| Event log: | Application |
| Event type: | Error |
| Symbolic Name: | MSG_E_PROCESS_REQUEST_FAILED_WITH_INFO |
| Event text (English): | Active Directory Certificate Services could not process request %1 due to an error: %2. The request was for %3. Additional information: %4 |
| Event text (German): | Die Anforderung %1 konnte aufgrund eines Fehlers nicht ausgeführt werden: %2. Die Anforderung bezog sich auf %3. Weitere Informationen: %4 |
| Event Source: | Microsoft-Windows-CertificationAuthority |
| Event ID: | 19 (0x13) |
| Event log: | Application |
| Event type: | Error |
| Symbolic Name: | MSG_E_REG_BAD_SUBJECT_TEMPLATE |
| Event text (English): | Active Directory Certificate Services did not start: The Subject Name Template string in the registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CertSvc\Configuration\%1\SubjectTemplate is invalid. An example of a valid string is: CommonName OrganizationalUnit Organization Locality State Country |
| Event text (German): | Die Active Directory-Zertifikatdienste wurden nicht gestartet: Die Zeichenfolge der Antragstellernamensvorlage im Registrierungseintrag HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CertSvc\Configuration\%1\SubjectTemplate ist ungültig. Ein Beispiel eines gültigen Eintrags ist: CommonName OrganizationalUnit Organization Locality State Country |
Even with a certificate template for domain controllers that is supposedly simple to configure, there are a few things to keep in mind.
Continue reading "Configuring a Certificate Template for Domain Controllers"
In order to determine whether a certificate has been issued by a certification authority that has been classified as trustworthy, a trust chain must be built. To do this, all certificates in the chain must be determined and checked. Microsoft CryptoAPI builds all possible certificate chains and returns those with the highest quality to the requesting application.
Continue reading "Basics: Finding certificates and validating the certification path"
Internationalized Domain Names (IDNs) have been officially supported since Windows Server 2012 as part of the certification authority and its associated components.
However, if you want to use them in your certification authority certificates, there are some specifics to consider.
Continue reading "Umlauts in certification authority certificates"
Assume the following scenario
Error Parsing Request The request subject name is invalid or too long. 0x80094001 (-2146877439 CERTSRV_E_BAD_REQUESTSUBJECT)Nowadays rather a curiosity than really relevant in practice, but it does happen from time to time that you receive certificate requests that contain more than one common name in the subject. Even though it may seem surprising, this is quite possible and also RFC compliant.
Continue reading "More than one common name (CN) in the certificate"
Below is a description of the configuration settings required to ensure that a certificate hierarchy based on Active Directory Certificate Services complies with the Common PKI (formerly known as ISIS-MTT) standard.
In principle, RFC 5280 allows the use of arbitrary strings in the subject distinguished name (DN) of a certificate. Common fields are described in the X.520 standard. The length restrictions are also recommended by the ITU-T . The abbreviations commonly used today are mainly taken from RFC 4519 .
However, Microsoft Active Directory Certificate Services only allows certain RDNs by default.
The following Relative Distinguished Names (RDNs) are accepted by the Active Directory Certificate Services (AD CS) certification authority by default:
Continue reading "Allowed Relative Distinguished Names (RDNs) in the Subject of Issued Certificates"
Sometimes it is necessary to change the Subject Distinguished Name (also called Subject or Subject DN, in German also "Antragsteller" or "Betreff") of a certificate request before issuing the certificate.
Under certain circumstances, this is certainly possible, as described below.