Tag: SubjectTemplate

Use of undefined Relative Distinguished Names (RDN) in issued certificates

Sometimes it is necessary to allow Relative Distinguished Names (RDNs) in issued certificates that are not defined and therefore could not be configured in the SubjectTemplate value in the certification authority's registry either.

An example of this is the Organization Identifier with object identifier 2.5.4.97, which is required, for example, for certificates that comply with the eIDAS Regulation.

Continue reading "Use of undefined Relative Distinguished Names (RDN) in issued certificates"

Change the order of the Relative Distinguished Names (RDNs) in the Subject Distinguished Name (DN) of issued certificates

Microsoft Active Directory Certificate Services does not transfer subjects from certificate requests for templates in which the enrollee is allowed to supply them 1:1 into the issued certificate.

Instead, it is defined both which Relative Distinguished Names (RDNs) are allowed and in which order they are written to issued certificates. However, this order can be changed. How this is done is explained below.

Continue reading "Change the order of the Relative Distinguished Names (RDNs) in the Subject Distinguished Name (DN) of issued certificates"

Details of the event with ID 19 of the source Microsoft-Windows-CertificationAuthority

Event Source:Microsoft-Windows-CertificationAuthority
Event ID:19 (0x13)
Event log:Application
Event type:Error
Symbolic Name:MSG_E_REG_BAD_SUBJECT_TEMPLATE
Event text (English):Active Directory Certificate Services did not start: The Subject Name Template string in the registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CertSvc\Configuration\%1\SubjectTemplate is invalid. An example of a valid string is: CommonName OrganizationalUnit Organization Locality State Country
Event text (German):Die Active Directory-Zertifikatdienste wurden nicht gestartet: Die Zeichenfolge der Antragstellernamensvorlage im Registrierungseintrag HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CertSvc\Configuration\%1\SubjectTemplate ist ungültig. Ein Beispiel eines gültigen Eintrags ist: CommonName OrganizationalUnit Organization Locality State Country

Continue reading "Details of the event with ID 19 of the source Microsoft-Windows-CertificationAuthority"

Allowed Relative Distinguished Names (RDNs) in the Subject of Issued Certificates

In principle, RFC 5280 allows the use of arbitrary strings in the subject distinguished name (DN) of a certificate. Common fields are described in the X.520 standard. The length restrictions are also recommended by the ITU-T . The abbreviations commonly used today are mainly taken from RFC 4519 .

However, Microsoft Active Directory Certificate Services only allows certain RDNs by default.

The following Relative Distinguished Names (RDNs) are accepted by the Active Directory Certificate Services (AD CS) certification authority by default:

Continue reading "Allowed Relative Distinguished Names (RDNs) in the Subject of Issued Certificates"

Installing the Network Device Enrollment Service (NDES) without Enterprise Administrator permissions

Assume the following scenario:

  • One installs a Network Device Enrollment Service (NDES) server.
  • The role configuration fails with the following error message:
Insufficient access rights to perform this operation. 0x80072098 (WIN32: 8344 ERROR_DS_INSUFF_ACCESS_RIGHTS

Typically, the NDES role configuration requires that the installing user is a member of the Enterprise Admins group . However, this is not technically necessary and contradicts Microsoft's security hardening recommendations, since NDES is not (necessarily) a system that is assigned to the highest security layer (Tier-0).

Below is a way to configure the NDES role even without the required permissions.

Continue reading "Installing the Network Device Enrollment Service (NDES) without Enterprise Administrator permissions"