Tokens for the CDP and AIA configuration of a certification authority

Author Uwe Gradenegger Posted on Updated on Categories Certification Authority installation, Certification Authority Tags CRL distribution point (CDP), Authority Information Access (AIA), Registry

The following is an overview of the tokens for the CDP and AIA configuration of a certification authority.

TokenNameDescription
%1ServerDNSNameThe fully qualified DNS name of the server on which the certification authority is installed.
%2ServerShortNameThe NETBIOS name of the server on which the certification authority is installed.
%3CaNameThe Common Name (CN) of the certification authority.
%4CertificateNameThe certificate index for the name of the certification authority certificate.
%6ConfigurationContainerThe path to the Configuration Container of the Active Directory forest.
%7CATruncatedNameName of the certification authority limited to 32 characters, with a checksum.
%8CRLNameSuffixThe key index for the name of the CRLs.
%9DeltaCRLAllowedReplaced by a "+" for a delta CRL.
%10CDPObjectClassPlaceholder for the cRLDistributionPoint object class in the LDAP path of the CRL Distribution Point extension.
%11CAObjectClassPlaceholder for the certificationAuthority object class in the LDAP path of the Authority Information Access (AIA) extension.

Sensible adjustments

Do you know TameMyCerts? TameMyCerts is an add-on for the Microsoft certification authority (Active Directory Certificate Services). It extends the function of the certification authority and enables the application of rule sets to realize the secure automation of certificate issuance. TameMyCerts is unique in the Microsoft ecosystem, has already proven itself in countless companies around the world and is available under a free license. It can be downloaded via GitHub and used free of charge. Professional maintenance is also offered.

Make LDAP CRL paths independent of the host name of the certification authority server

By default, the following LDAP path is configured for CRL publishing when a certification authority is installed.

ldap:///CN=%7%8,CN=%2,CN=CDP,CN=Public Key Services,CN=Services,%6%10

The ServerShortName token (%2) ensures that the LDAP path contains the NETBIOS name of the certification authority server. This can cause problems when migrating the certification authority to another server .

A simple trick to get around this is to replace the token with CaName (%3), which describes the common name of the certification authority.

ldap:///CN=%7%8,CN=%3,CN=CDP,CN=Public Key Services,CN=Services,%6%10

The setting is made in the following registry path:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CertSvc\Configuration\{Name-der-Zertifizierungsstelle>\CRLPublicationURLs

Registry Editor, "Edit Multi-String": CRLPublicationURLs with the token CN=%3 in the ldap URL marked

After this configuration adjustment has been made, the certification authority service must be restarted.

In addition, the LDAP path, which now differs from the default, must be created once by first creating a CRL and then publishing it to Active Directory as Enterprise Administrator.

certutil -f -dspublish {Sperrliste>.crl

When the CRL is created, event no. 74 is logged, since the certification authority directly tries to publish to LDAP and initially fails. However, after the CRL has been manually uploaded once, the error no longer occurs.

See also article "Publishing a certificate revocation list (CRL) to an Active Directory CRL distribution point (CDP) ".

External sources