Hasain Alshakarti

Deploying the Network Device Enrollment Service NDES component, part of the Active Directory Certificate Services ADCS, is a fairly easy task.

Once the installation is completed we need to test and verify the system is working properly but there are no tools available to perform such test. The only option for many administrators is to perform a real deployment using a device that supports SCEP and wait for the results.

After doing some research I found many tools that could perform SCEP operations but almost none of the tools was designated to perform a complete SCEP operation in Windows.

I managed to build a toolbox that works in Windows to test and verify NDES/SCEP deployment. The toolbox is a combination of Openssl and sscep from the The CertNanny Project.

  SCEP Toolbox download:(1.2 MiB, 17,835)

Once you downloaded the toolbox and extracted the files, you need to follow the steps below to verify your NDES/SCEP deployment

1. Get a new SCEP Challenge Password from your SCEP/NDES server

   Direct your browser to http://172.16.1.20/certsrv/mscep_admin/

2. Generate a certificate request providing a Common Name and the Challenge Password when prompted by openssl

   openssl.exe req -config scep.cnf -new -key priv.key -out test.csr

3. Retrieve the CA and RA certificates from your SECP/NDES

   sscep.exe getca -u http://172.16.1.20/certsrv/mscep/ -c ca.crt

   Note: The getca operation will download the RA and CA certificates and save each cert in a file prefixed with a number: ca.crt-0, ca.crt-1, ca.crt-2

4. Enroll a new certificate and make sure to specify the correct RA (-c flag) & CA (-e flag) certificates

   sscep.exe enroll -u http://172.16.1.20/certsrv/mscep/ -k priv.key -r test.csr -l test.crt -c ca.crt-0 -e ca.crt-1

   Note: The requested certificate is stored in the test.crt file

Having a Windows Server 2012 with the certification authority role (ADCS) installed where the CA name contains space characters. When a certificate is issued from this CA, the ADCS service does not replace the space characters with “%20” in the URL paths for certificate revocation list (CRL) distribution points and authority information access extensions. This results in errors when clients accesses the URL’s.

A supported hotfix is available from Microsoft that is intended to correct the problem described above. To download the hotfix, read KB2827759 http://support.microsoft.com/kb/2827759.

/Hasain

I en bunker långt under Normalms gator finns “The Nerd Herd” studion, där produceras det varje vecka tunga teknikprogram med erkända experter!

Tillsammans med Johan Persson, Michael Anderberg och Fredrik ”DXter” Jonsson försöker vi under detta avsnitt ge våra synpunkter och tankar om och kring PKI i och PKI relaterade frågor och funderingar…

Avsnittet kan laddas ner här… (Du kan även prenumerera på showen i iTunes och gPodder – ge gärna en positiv review också, så att fler kan hitta showen, tack!)

Du kan givetvis följa The Nerd Herd på http://thenerdherdse.wordpress.com, DXter på hans blogg http://poweradmin.se

/Hasain

Once someone has an Enrollment Agent certificate, that person can enroll for a certificate and generate a smart card on behalf of anyone in the organization, including all domain admins. The resulting smart card could then be used to log on to the network and impersonate the real user. Because of the powerful capability of the Enrollment Agent certificate, it is strongly recommended that your organization maintain very strong security policies for these certificates.

Permitting an enrollment agent to enroll only a certain type of certificate to a certain group of users was not possible before Windows 2008. In Windows Server 2003 Enterprise Edition the enterprise CA does not provide any configurable means to control enrollment agents except by enforcing the application policy extension of the enrollment agent certificate, which verifies that the credentials grant the ability to enroll on behalf of other users, including the domain admins.

In Windows Server 2008 the PKI architecture of an enterprise has the possibility to restrict enrollment agents so that enrollment is only possible for a certain certificate template and a certain group of users. By providing a technical possibility to limit the scope of enrollment agents, an enterprise can is given a better tool to control the delegation of trust and the risk associated with granting that trust.

On a Windows Server 2008 Enterprise-based certification authority (CA), the restricted enrollment agent features allow an enrollment agent to be used for one or many certificate templates. For each certificate template, you can choose which users or security groups the enrollment agent can enroll on behalf of.

Note: The feature cannot constrain an enrollment agent based on a certain Active Directory organizational unit (OU) or container; you must use security groups instead. The restricted enrollment agent is not available on a Windows Server® 2008 Standard-based CA.

By using the Certificate Services snap-in, you can create a permissions list for each enrollment agent to configure which users or security groups an enrollment agent can enroll on behalf of for each certificate template.

To enroll for a smart card certificate on behalf of someone, the user must have an enrollment agent certificate. The smart card enrollment agent can create smart cards on behalf of any user, including an enterprise administrator.

Follow the steps below to create an enrollment agent trusted to enroll for a smart card certificate on behalf of other users:

Create an Enrollment Agent enabled Smart Card Certificate Template:

1. Open the Certificate Template Management console
2. Right click the Smartcard User or Smartcard Logon template and choose Duplicate Template
   Note: If you are using a Windows 2008 CA or above you will be prompted to select the minimum CA for your new template. Select the 2003 Enterprise option.
3. Provide a name for the smart card template and set the validity period that you desire for the environment
4. On Request Handling tab, do the following
• Select Signature and smartcard logon under Purpose
• Under CSPs, select the CSP that should be used for your smart cards
5. On Issuance Requirements tab, do the following
• Select The number of authorized signatures: and set it to 1
• Under Policy type required in signature, select Application Policy
• Under Application Policy select Certificate request Agent
6. On the Security tab, make sure the user or group that is designated as enrollment agent has Read and Enroll permissions on the template
7. Click Apply and then OK.
8. Close Certificate Templates console
9. In the Certificate Authority snap-in, right click Certificate Templates folder and select New
10. Select “Certificate Template to Issue”
11. Select the new template and click Ok

Specify/adjust the permissions of the Enrollment Agents and publish the Enrollment Agent certifiacte template:

1. Open the Certificate Template Management console
2. Right-click the EnrollmentAgent template, and then click Properties
3. On the Security tab, make sure the user or group designated as an enrollment agent has Read and Enroll permissions on the template, and then click OK
4. In the Certificate Authority snap-in, right click Certificate Templates folder and select New
5. Select “Certificate Template to Issue”
6. Select the Enrollment Agent template and click Ok

Create a smart card certificate for a user using the new smart card template and the enrollment agent:

1. Log on to system that has a smart card reader with a user that has an Enrollment Agent certificate
2. Open certmgr.msc
3. Expand Personal, and then right-click on the Certificates folder
4. Select All Tasks > Advanced Operations > Enroll on behalf of from the context menu
5. Click Next
6. When prompted, browse to the signing certificate for the enrollment agent. Click Next
7. Select the certificate template you created, and click Next
8. Browse and select the user name (This will be the subject of the smartcard certificate) Click Enroll

The certificate selection user interface in Windows supports filtering logic to provide a simplified user experience when an application presents multiple certificates. But some applications are not designed to use filtering logic (developers not aware of functionality…) or uses filters that does not provide efficient reduction of the number of certificates presented to the user making it almost impossible for a user to know witch certificate to choose unless opening the certificate and looking at the details of template name, EKU, etc.

This is particularly true when all certificates has been automatically enrolled using the same user DN/CN attribute based on the users Active Directory user object attributes. In addition to that, Autoenrollment does not support variations in certificate subject name unless using some third party policy module installed on the Active Directory Certificates Services.

Knowing that the certificate selection UI supports certificate friendly names. Setting the certificate friendly name to include information about the certificate template can simplify the users task to select the correct certificate.

Friendly names are properties in the X.509 certificate store in Windows that can be set at any time after the certificate has been created/installed in the store.

One way to set the friendly name is through the certificate MMC SnapIn. Alternatively certutil.exe can be used in the following way:

Create a text file containing the following information:

[Version]
Signature = “$Windows NT$”
[Properties]
11 = “{text}My Friendly Name”

Save the file as friendlyname.inf

Determine the serialnumber of the certificate where the friendly name should be changed.

Run the following command at a command-line:
certutil –repairstore –user my {SerialNumber} FriendlyName.inf

Automating the friendly name can be achieved by either automating/scripting the steps above alternatively by creating a tool that enumerates all certificates in the personal store and assign the friendly name.

A proof of concept CertFN.exe tool was created to automate the above. The tool receives a parameter for the template name to use when filtering the user store, it then sets the friendly name based on the schema “Template Name – Certificate Subject Name”

  CertFN - Certificate Friendly Name Tool download:(39.3 KiB, 4,338)

  CertFN - Certificate Friendly Name Tool - The Powershell Edition download:(1.1 KiB, 5,572)

The Basics of PKI

Public Key Infrastructure (PKI) refers to the set of hardware, software, people, policies, and procedures necessary to create, manage, store, distribute, and revoke certificates based on public key cryptography. The characteristic operation of PKI is known as certification (the issuance of certificates). PKI certification provides a framework for the security feature known as authentication (proof of identification).

Understanding the role of PKI in identity management involves the following basic terms:

• The Public/Private Key Pair – The mathematics of public/private key pairs is beyond the scope of this guide, but it is important to note the functional relationship between a public and a private key. PKI cryptographic algorithms use the public key of the receiver of an encrypted message to encrypt data, and the related private key and only the related private key to decrypt the encrypted message.
• Digital Signature – A digital signature of a message is created with the signer’s private key. The corresponding public key, which is available to everyone, is then used to verify this signature. The secrecy of the private key must be maintained because the framework falls apart after the private key is compromised.
• Certification Authority (CA) – An authority that trusted to create and issue certificates that contain public keys acting as a trust in a public key infrastructure and providing services that authenticate the identity of individuals, computers, and other entities in a network.
• Certificate – A data structure containing an entities public key and related identification information, which is digitally signed with the private key of the CA that issued it. The certificate securely binds together the information that it contains; any attempt to tamper with it will be detected at the time of use.
• Self-signed – In a self-signed certificate, the public key in the certificate and the key used to verify the certificate are the same. Some self-signed certificates are designated as Root CAs.
• Root CA – A root CA is a special class of CA, which is trusted unconditionally by a client and is at the top of a certification hierarchy. All certificate chains terminate at a root CA. The root authority must sign its own certificate because there is no higher certifying authority in the certification hierarchy.
• Subordinate CA / Intermediate CA / Cross CA / Bridge CA – A CA that has been certified by another CA. Subordination creates a managed trust between separate certification authorities resulting in CA hierarchies.
• Certificate policy and practice statements –  The two documents that outline how the CA and its certificates are to be used, the degree of trust that can be placed in these certificates, legal liabilities if the trust is broken, and so on.
• Public key standards – Standards are developed to describe the syntax for digital signing and encrypting of messages and to ensure that a user has an appropriate private key. Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile, as specified in RFC5280 is one part of a family of standards for the X.509 Public Key Infrastructure (PKI) for the Internet.
• Revocation and Expiration – Certificates are issued with a planned lifetime, which is defined through a validity start time and an explicit expiration date. Once issued, a certificate becomes valid when its validity time has been reached, and it is considered valid until its expiration date. However, various circumstances may cause a certificate to become invalid prior to the expiration of the validity period. Such circumstances include change of name, change of association between subject and CA, and compromise or suspected compromise of the corresponding private key. Under such circumstances, the issuing CA needs to revoke the certificate.
• Registration Authority (RA) – A Registration Authority vouches to a CA for the binding between public keys and the identity and attributes of a prospective certificate holder. Essentially, using the RA is a form of administrative delegation—the CA delegates to the RA the task of verifying the binding of a public key to an entity.
• Certificate Chains – A certificate chain consists of all the certificates needed to certify the subject identified by the end certificate. In practice this includes the end certificate, the certificates of intermediate CAs, and the certificate of a root CA trusted by all parties in the chain. Every intermediate CA in the chain holds a certificate issued by the CA one level above it in the trust hierarchy.

Microsoft IT has released an updated version of the “Public Key Infrastructure at Microsoft” whitepaper found at http://www.microsoft.com/download/en/details.aspx?id=27581 or here Public Key Infrastructure at Microsoft 1750_PKI_TWP

The update deals with changes to the Microsoft internal PKI structure as part of the Windows Server 2008 R2 migration. There are many good “lessons learned and best practicess” outlined by Microsoft IT as a result of the migration/upgrade process that was performed.

Some of my favorites are the way they use CRL Overlap to provide higher availablity of CRLs and the simplified two tier structure together with Cross Forest Enrollment and the discussions about virtualisation of CAs

Some of the highlighted features in the document are:

Windows Server 2008:

• Improved enrollment capabilities that enable delegated enrollment agents to be assigned on a per-template basis
• Enhanced performance monitoring with the addition of new performance counters
• Scalable, high-speed revocation status response services that combine CRLs and integrated Online Responder services
• Support for Cryptography Next Generation (CNG) to enable the use of Suite B algorithms
• Enhanced service monitoring with the introduction of the Windows Server 2008 AD CS Management Pack for Microsoft Operations Manager 2005
• More detailed server administration with restricted certificate managers
• Failover cluster support

Windows Server 2008 R2:

• Cross-forest enrollment capability that allows for consolidation of existing hardware
• Databaseless CA feature to avoid storing unnecessary certificate records
• Best Practice Analyzer for improved configuration practices
• Web-based certificate enrollment protocol to allow enrollment over the Internet

Some interesting FIM CM 2010 links from Microsoft Donwloads:

Test Lab Guide: Demonstrating Forefront Identity Manager 2010 Certificate Management Smart Card Centralized Registration

Demonstrating FIM CM using a centralized smart card registration model in a test lab.

Test Lab Guide: Demonstrating Forefront Identity Manager 2010 Certificate Management User Smart Card Self-Service

Demonstrating User Smart Card Self-Service using FIM CM in a test lab.

Test Lab Guide: Demonstrating Forefront Identity Manager 2010 Certificate Management Delegated Smart Card Registration

Delegated smart card registration with FIM CM in a test lab.

Test Lab Guide: Demonstrating Forefront Identity Manager 2010 Certificate Management User Certificate Self-Service

Demonstrate using FIM CM for Self-Service certificate management.

Test Lab Guide: Installing Forefront Identity Manager 2010 Certificate Management with Constrained Delegation, Update 1, and FIM 2010 Integration

Install FIM CM with Constrained Delegation, Update 1, and FIM 2010 in a test lab.

Tack för en bra diskussion hos Microsoft i Kista under FIM CM sommarkollo 2011

Inspelningen av del 1 :

Ladda ner ADCS powershell skriptet adcs_install.ps1

Ladda ner presenationen för FIM CM Sommarkollo

How do I delete all Failed Requests logged on my Certificate Services database?

The Certutil tool can be used to list and delete Failed Requests logged on any ADCS database, but the two operations cannot be combined in one request and you have to manually transfer the request is from the listing of failed requests to the deleterow command.

The attached script combines the two steps and automate the whole process for an easier management task.

/Hasain

———————————–delete_failed_adcs_requests.vbs———————————–

Set objShell = CreateObject("WScript.Shell")

Set objWshScriptExec = objShell.Exec("certutil -silent -view -out ""RequestID"" LogFail")

Set objStdOut = objWshScriptExec.StdOut

Do Until objStdOut.AtEndOfStream
    strLine = objStdOut.ReadLine
    If Len(strLine) > 10 Then

 Set regEx = New RegExp
 regEx.Pattern = "( .*?\(|\))"
 regEx.IgnoreCase = True
 regEx.Global = True
 regEx.MultiLine = True
        WScript.Echo "Deleting: " & strLine
        Set objWshScriptExec = objShell.Exec("certutil -deleterow " & regEx.Replace(strLine, ""))

    End If
Loop

———————————–delete_failed_adcs_requests.vbs———————————–

Are you wondering about how scalable ADCS is?

An interesting ADCA scalability testing was done at the Enterprise Engineering Center (EEC) by the Windows Server Engineering Team showing that it is possible to produce more than 20 million certificates in less than 24 hours using a cluster of 10 ADCS VM!

Read more about this test at: http://blogs.technet.com/wincat/archive/2009/08/10/scale-testing-the-world-s-largest-pki-all-running-on-ws08r2-and-hyper-v.aspx

/Hasain

The following table lists the AD CS components that can be configured on different editions of Windows Server 2008 R2.

The following features are available on servers running Windows Server 2008 R2 that have been configured as CAs.

The default setting of the "CertSrv Request" component in Windows Server 2008 does not allow administrators to change the settings of the component. If your certification authority is behind a firewall or if you want to allow for connections to the service using static TCP ports; you need then to enable modification settings of' the 'CertSrv Request' component by following the steps below:

• Open Register Editor to 'HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{D99E6E74-FC88-11D0-B498-00A0C90312F3}'
• Right click the {D99E6E74-FC88-11D0-B498-00A0C90312F3} key (AppID of Certsrv Request), choose permission
• Take the ownership to Administrators. Then grant the Administrators 'full control' permission
• Start the dcomcnfg.exe and change the setting

Use with great care!

/Hasain

One very common reason to this issue is that the CA is not able to read the content of the template; this is often because the authenticated users group has been removed from the ACL list of the template. To solve this without reusing the authenticated users group you can give the computer account of your CA read permissions to the specific template.

If the above is not true, make sure the templates is listen in the templates to issue for your CA and that the template is available throughout your Active Directory.

/Hasain

This is now possible using the Authentication mechanism assurance feature in Active Directory Domain Services (AD DS) in Windows Server 2008 R2. When enabling this feature a user's access to resources on the network when authenticated using certificate based logon can be treated as different from what that access would be when the user types a user name and password as the user's group membership is changed reflecting the authentication method used

This feature is intended for organizations that use certificate-based authentication methods, such as smart card or token-based authentication systems. Organizations that do not use certificate-based authentication methods will not be able to use authentication mechanism assurance, even if they have Windows Server 2008 R2 domain controllers with their domain functional level set to Windows Server 2008 R2.

The best part of this feature is that any client or server operating system that is able to interpret Windows access tokens can be used to grant or deny access based on the group membership or memberships that are added to a user's token by authentication mechanism assurance.

 /Hasain

Is it possible to migrate a Windows Server 2003 based Certification Authority to Windows Server 2008?

The answer is yes but you need all detailes in the Active Directory Certificate Services Upgrade and Migration Guide from Microsoft found at http://www.microsoft.com/downloads/details.aspx?FamilyID=C70BD7CD-9F03-484B-8C4B-279BC29A3413&displaylang=en

The short answer would be that you need to performe the following steps:

1. Backup your existing CA using the certutil -backup command
2. Install the new Windows Server 2008 CA with the same name as the replaced server
3. Add the ADCS role and import the CA-certificate from the backup
4. Upgrade the templates to WS2008
5. Restore the old CA database using the certutil -restore  command

/Hasain