Posts Tagged ‘ADCS’

ADCS on Windows server 2012 does not replace space characters in URL paths CDP and AIA extensions

October 15th, 2013 Comments off

Having a Windows Server 2012 with the certification authority role (ADCS) installed where the CA name contains space characters. When a certificate is issued from this CA, the ADCS service does not replace the space characters with “%20” in the URL paths for certificate revocation list (CRL) distribution points and authority information access extensions. This results in errors when clients accesses the URL’s.

A supported hotfix is available from Microsoft that is intended to correct the problem described above. To download the hotfix, read KB2827759


Restricting Enrollment Agents

February 10th, 2012 Comments off

Once someone has an Enrollment Agent certificate, that person can enroll for a certificate and generate a smart card on behalf of anyone in the organization, including all domain admins. The resulting smart card could then be used to log on to the network and impersonate the real user. Because of the powerful capability of the Enrollment Agent certificate, it is strongly recommended that your organization maintain very strong security policies for these certificates.

Permitting an enrollment agent to enroll only a certain type of certificate to a certain group of users was not possible before Windows 2008. In Windows Server 2003 Enterprise Edition the enterprise CA does not provide any configurable means to control enrollment agents except by enforcing the application policy extension of the enrollment agent certificate, which verifies that the credentials grant the ability to enroll on behalf of other users, including the domain admins.

In Windows Server 2008 the PKI architecture of an enterprise has the possibility to restrict enrollment agents so that enrollment is only possible for a certain certificate template and a certain group of users. By providing a technical possibility to limit the scope of enrollment agents, an enterprise can is given a better tool to control the delegation of trust and the risk associated with granting that trust.

On a Windows Server 2008 Enterprise-based certification authority (CA), the restricted enrollment agent features allow an enrollment agent to be used for one or many certificate templates. For each certificate template, you can choose which users or security groups the enrollment agent can enroll on behalf of.

Note: The feature cannot constrain an enrollment agent based on a certain Active Directory organizational unit (OU) or container; you must use security groups instead. The restricted enrollment agent is not available on a Windows Server® 2008 Standard-based CA.

By using the Certificate Services snap-in, you can create a permissions list for each enrollment agent to configure which users or security groups an enrollment agent can enroll on behalf of for each certificate template.


Enroll for a smart card certificate on behalf of other users

February 7th, 2012 Comments off

To enroll for a smart card certificate on behalf of someone, the user must have an enrollment agent certificate. The smart card enrollment agent can create smart cards on behalf of any user, including an enterprise administrator.

Follow the steps below to create an enrollment agent trusted to enroll for a smart card certificate on behalf of other users:

Create an Enrollment Agent enabled Smart Card Certificate Template:

  1. Open the Certificate Template Management console
  2. Right click the Smartcard User or Smartcard Logon template and choose Duplicate Template
    Note: If you are using a Windows 2008 CA or above you will be prompted to select the minimum CA for your new template. Select the 2003 Enterprise option.
  3. Provide a name for the smart card template and set the validity period that you desire for the environment
  4. On Request Handling tab, do the following
    • Select Signature and smartcard logon under Purpose
    • Under CSPs, select the CSP that should be used for your smart cards
  5. On Issuance Requirements tab, do the following
    • Select The number of authorized signatures: and set it to 1
    • Under Policy type required in signature, select Application Policy
    • Under Application Policy select Certificate request Agent
  6. On the Security tab, make sure the user or group that is designated as enrollment agent has Read and Enroll permissions on the template
  7. Click Apply and then OK.
  8. Close Certificate Templates console
  9. In the Certificate Authority snap-in, right click Certificate Templates folder and select New
  10. Select “Certificate Template to Issue”
  11. Select the new template and click Ok

Specify/adjust the permissions of the Enrollment Agents and publish the Enrollment Agent certifiacte template:

  1. Open the Certificate Template Management console
  2. Right-click the EnrollmentAgent template, and then click Properties
  3. On the Security tab, make sure the user or group designated as an enrollment agent has Read and Enroll permissions on the template, and then click OK
  4. In the Certificate Authority snap-in, right click Certificate Templates folder and select New
  5. Select “Certificate Template to Issue”
  6. Select the Enrollment Agent template and click Ok

Enroll the smart card enrollment agent certificate:

Note: It is recommended to store the enrollment agent certificate on a smart card to provide proper protection

  1. Log on to the domain with the Enrollment Agent account
  2. Open certmgr.msc to manage the current users certificates
  3. Open the Personal folder, right-click in the right-hand pane, and then click All Tasks.
  4. Click Request New Certificate
  5. Complete the Certificate Request Wizard and request an Enrollment Agent certificate

Create a smart card certificate for a user using the new smart card template and the enrollment agent:

  1. Log on to system that has a smart card reader with a user that has an Enrollment Agent certificate
  2. Open certmgr.msc
  3. Expand Personal, and then right-click on the Certificates folder
  4. Select All Tasks > Advanced Operations > Enroll on behalf of from the context menu
  5. Click Next
  6. When prompted, browse to the signing certificate for the enrollment agent. Click Next
  7. Select the certificate template you created, and click Next
  8. Browse and select the user name (This will be the subject of the smartcard certificate) Click Enroll


Certificate Selection & Certificate Friendly Name Tool

November 4th, 2011 Comments off

The certificate selection user interface in Windows supports filtering logic to provide a simplified user experience when an application presents multiple certificates. But some applications are not designed to use filtering logic (developers not aware of functionality…) or uses filters that does not provide efficient reduction of the number of certificates presented to the user making it almost impossible for a user to know witch certificate to choose unless opening the certificate and looking at the details of template name, EKU, etc.

This is particularly true when all certificates has been automatically enrolled using the same user DN/CN attribute based on the users Active Directory user object attributes. In addition to that, Autoenrollment does not support variations in certificate subject name unless using some third party policy module installed on the Active Directory Certificates Services.

Knowing that the certificate selection UI supports certificate friendly names. Setting the certificate friendly name to include information about the certificate template can simplify the users task to select the correct certificate.

Friendly names are properties in the X.509 certificate store in Windows that can be set at any time after the certificate has been created/installed in the store.

One way to set the friendly name is through the certificate MMC SnapIn. Alternatively certutil.exe can be used in the following way:

Create a text file containing the following information:

Signature = “$Windows NT$”
11 = “{text}My Friendly Name”

Save the file as friendlyname.inf

Determine the serialnumber of the certificate where the friendly name should be changed.

Run the following command at a command-line:
certutil –repairstore –user my {SerialNumber} FriendlyName.inf

Automating the friendly name can be achieved by either automating/scripting the steps above alternatively by creating a tool that enumerates all certificates in the personal store and assign the friendly name.

A proof of concept CertFN.exe tool was created to automate the above. The tool receives a parameter for the template name to use when filtering the user store, it then sets the friendly name based on the schema “Template Name – Certificate Subject Name”

  CertFN - Certificate Friendly Name Tool download:(39.3 KiB, 2,084)

  CertFN - Certificate Friendly Name Tool - The Powershell Edition download:(1.1 KiB, 3,725)

The Active Directory Certificate Services Ultimate Guide – Part 1

October 14th, 2011 Comments off

The Basics of PKI

Public Key Infrastructure (PKI) refers to the set of hardware, software, people, policies, and procedures necessary to create, manage, store, distribute, and revoke certificates based on public key cryptography. The characteristic operation of PKI is known as certification (the issuance of certificates). PKI certification provides a framework for the security feature known as authentication (proof of identification).

Understanding the role of PKI in identity management involves the following basic terms:

  • The Public/Private Key Pair – The mathematics of public/private key pairs is beyond the scope of this guide, but it is important to note the functional relationship between a public and a private key. PKI cryptographic algorithms use the public key of the receiver of an encrypted message to encrypt data, and the related private key and only the related private key to decrypt the encrypted message.
  • Digital Signature – A digital signature of a message is created with the signer’s private key. The corresponding public key, which is available to everyone, is then used to verify this signature. The secrecy of the private key must be maintained because the framework falls apart after the private key is compromised.
  • Certification Authority (CA) – An authority that trusted to create and issue certificates that contain public keys acting as a trust in a public key infrastructure and providing services that authenticate the identity of individuals, computers, and other entities in a network.
  • Certificate – A data structure containing an entities public key and related identification information, which is digitally signed with the private key of the CA that issued it. The certificate securely binds together the information that it contains; any attempt to tamper with it will be detected at the time of use.
  • Self-signed – In a self-signed certificate, the public key in the certificate and the key used to verify the certificate are the same. Some self-signed certificates are designated as Root CAs.
  • Root CA – A root CA is a special class of CA, which is trusted unconditionally by a client and is at the top of a certification hierarchy. All certificate chains terminate at a root CA. The root authority must sign its own certificate because there is no higher certifying authority in the certification hierarchy.
  • Subordinate CA / Intermediate CA / Cross CA / Bridge CA – A CA that has been certified by another CA. Subordination creates a managed trust between separate certification authorities resulting in CA hierarchies.
  • Certificate policy and practice statements –  The two documents that outline how the CA and its certificates are to be used, the degree of trust that can be placed in these certificates, legal liabilities if the trust is broken, and so on.
  • Public key standards – Standards are developed to describe the syntax for digital signing and encrypting of messages and to ensure that a user has an appropriate private key. Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile, as specified in RFC5280 is one part of a family of standards for the X.509 Public Key Infrastructure (PKI) for the Internet.
  • Revocation and Expiration – Certificates are issued with a planned lifetime, which is defined through a validity start time and an explicit expiration date. Once issued, a certificate becomes valid when its validity time has been reached, and it is considered valid until its expiration date. However, various circumstances may cause a certificate to become invalid prior to the expiration of the validity period. Such circumstances include change of name, change of association between subject and CA, and compromise or suspected compromise of the corresponding private key. Under such circumstances, the issuing CA needs to revoke the certificate.
  • Registration Authority (RA) – A Registration Authority vouches to a CA for the binding between public keys and the identity and attributes of a prospective certificate holder. Essentially, using the RA is a form of administrative delegation—the CA delegates to the RA the task of verifying the binding of a public key to an entity.
  • Certificate Chains – A certificate chain consists of all the certificates needed to certify the subject identified by the end certificate. In practice this includes the end certificate, the certificates of intermediate CAs, and the certificate of a root CA trusted by all parties in the chain. Every intermediate CA in the chain holds a certificate issued by the CA one level above it in the trust hierarchy.

Public Key Infrastructure at Microsoft – 2008 R2 Edition

October 3rd, 2011 Comments off

Microsoft IT has released an updated version of the “Public Key Infrastructure at Microsoft” whitepaper found at or here Public Key Infrastructure at Microsoft 1750_PKI_TWP

The update deals with changes to the Microsoft internal PKI structure as part of the Windows Server 2008 R2 migration. There are many good “lessons learned and best practicess” outlined by Microsoft IT as a result of the migration/upgrade process that was performed.

Some of my favorites are the way they use CRL Overlap to provide higher availablity of CRLs and the simplified two tier structure together with Cross Forest Enrollment and the discussions about virtualisation of CAs

Some of the highlighted features in the document are:

Windows Server 2008:

  • Improved enrollment capabilities that enable delegated enrollment agents to be assigned on a per-template basis
  • Enhanced performance monitoring with the addition of new performance counters
  • Scalable, high-speed revocation status response services that combine CRLs and integrated Online Responder services
  • Support for Cryptography Next Generation (CNG) to enable the use of Suite B algorithms
  • Enhanced service monitoring with the introduction of the Windows Server 2008 AD CS Management Pack for Microsoft Operations Manager 2005
  • More detailed server administration with restricted certificate managers
  • Failover cluster support

Windows Server 2008 R2:

  • Cross-forest enrollment capability that allows for consolidation of existing hardware
  • Databaseless CA feature to avoid storing unnecessary certificate records
  • Best Practice Analyzer for improved configuration practices
  • Web-based certificate enrollment protocol to allow enrollment over the Internet