In order for a smart card login to be successful, some requirements must be met in the Active Directory environment:
Author: Uwe Gradenegger
Removing ADCS-specific extensions from certificates
When using Active Directory Certificates, it is noticeable that there are certain extensions in the certificates of the certification authorities and the certificates they issue that are not defined in the relevant RFCs and are specific to AD CS.
Firewall rules required for Active Directory Certificate Services
Implementing an Active Directory integrated certification authority often requires planning the firewall rules to be created on the network. The following is a list of the required firewall rules and any pitfalls.
Continue reading „Benötigte Firewallregeln für Active Directory Certificate Services“Description of the EDITF_ADDOLDKEYUSAGE flag
When installing a subordinate certificate authority, you may encounter the following behavior:
- One requests a Key Usage extension that is marked as critical, for example, or does not include DigitalSignature.
- However, the certificate issued by the parent certificate authority includes DigitalSignature, and the Key Usage extension is marked as non-critical.
- The parent certification authority is a standalone certification authority, i.e. without Active Directory integration.
Installing Remote Server Administration Tools for Active Directory Certificate Services on Windows 10 version 1809 and later
Since Windows 10 version 1809, the remote server management tools can no longer be found as a standalone download, but are part of Features on Demand.
Continue reading „Remoteserver-Verwaltungstools für Active Directory Certificate Services auf Windows 10 ab Version 1809 installieren“How secure is the "Allow private key to be exported" setting in the certificate templates?
PKI administrators often assume that the option in the certificate template to not allow the private key for export is mandatory.
Continue reading „Wie sicher ist die Einstellung „Allow private key to be exported“ in den Zertifikatvorlagen?“Importing a certificate into a smart card
Sometimes it is necessary to import a certificate that uses a software key into a smart card.
Role configuration for Network Device Enrollment Service (NDES) fails with error message "The RPC server is unavailable. 0x800706ba (WIN32: 1722 RPC_S_SERVER_UNAVAILABLE)".
Assume the following scenario:
- One installs a Network Device Enrollment Service (NDES) server
- One has the necessary permissions to install the role (local administrator, enterprise administrator)
- The role configuration fails with the following error message:
The RPC server is unavailable. 0x800706ba (WIN32: 1722 RPC_SERVER_UNAVAILABLE)Continue reading „Die Rollenkonfiguration für den Registrierungsdienst für Netzwerkgeräte (NDES) schlägt fehl mit Fehlermeldung „The RPC server is unavailable. 0x800706ba (WIN32: 1722 RPC_S_SERVER_UNAVAILABLE)““
Requesting certificates via Certificate Enrollment Web Services fails with error message "Error: The remote endpoint is unable to process the request due to being overloaded. 0x803d0012 (-2143485934 WS_E_ENDPOINT_TOO_BUSY)".
Assume the following scenario:
- A user requests a certificate.
- An enrollment policy is configured for this, which points to a Certificate Enrollment Policy Web Service (CEP).
- The connection to the CEP fails and the user receives the following error message:
Error: The remote endpoint is unable to process the request due to being overloaded. 0x803d0012 (-2143485934 WS_E_ENDPOINT_TOO_BUSY)Continue reading „Die Beantragung eines Zertifikats über die Certificate Enrollment Web Services schlägt fehl mit Fehlermeldung „Error: The remote endpoint is unable to process the request due to being overloaded. 0x803d0012 (-2143485934 WS_E_ENDPOINT_TOO_BUSY)““
Requesting certificates via Certificate Enrollment Web Services fails with error message "Error: A message containing a fault was received from the remote endpoint. 0x803d0013 (-2143485933 WS_E_ENDPOINT_FAULT_RECEIVED)".
Assume the following scenario:
- A user requests a certificate.
- An enrollment policy is configured for this, which points to a Certificate Enrollment Policy Web Service (CEP).
- Authentication is done via Kerberos.
- The application for the certificate is made by the CEP server itself.
- The connection to the CEP fails and the user receives the following error message:
Error: A message containing a fault was received from the remote endpoint. 0x803d0013 (-2143485933 WS_E_ENDPOINT_FAULT_RECEIVED)Continue reading „Die Beantragung eines Zertifikats über die Certificate Enrollment Web Services schlägt fehl mit Fehlermeldung „Error: A message containing a fault was received from the remote endpoint. 0x803d0013 (-2143485933 WS_E_ENDPOINT_FAULT_RECEIVED)““
Requesting certificates via Certificate Enrollment Web Services fails with error message "Error: The operation timed out 0x80072ee2 (WinHttp: 12002 ERROR_WINHTTP_TIMEOUT)".
Assume the following scenario:
- A user requests a certificate.
- An enrollment policy is configured for this, which points to a Certificate Enrollment Policy Web Service (CEP).
- The connection to the CEP fails and the user receives the following error message:
Error: The operation timed out 0x80072ee2 (WinHttp: 12002 ERROR_WINHTTP_TIMEOUT)Continue reading „Die Beantragung eines Zertifikats über die Certificate Enrollment Web Services schlägt fehl mit Fehlermeldung „Error: The operation timed out 0x80072ee2 (WinHttp: 12002 ERROR_WINHTTP_TIMEOUT)““
Overview of the different generations of domain controller certificates
Over the generations of Windows operating systems, various certificate templates for domain controllers have been established. In a current Active Directory directory service, one will find three different templates for this purpose.
- Domain controller
- Domain Controller Authentication
- Kerberos Authentication
Below is a description of each template and a recommendation for configuring domain controller certificate templates.
Continue reading „Übersicht über die verschiedenen Generationen von Domänencontroller-Zertifikaten“(Mass) deletion of entries in the certification authority database (certificates, requirements, revocation lists)
Sometimes it happens that the database of the certification authority becomes extremely large. Perhaps a large number of certificate requests have arrived unnoticed and have been rejected, or perhaps there are many certificates in the database that have been issued twice. Before the certification authority database compacts can be used, these entries must first be deleted in order to free up the storage space in the database.
Continue reading „(Massenhaftes) Löschen von Einträgen in der Zertifizierungsstellen-Datenbank (Zertifikate, Anforderungen, Sperrlisten)“Compacting (defragmenting) the certification authority database
Sometimes it happens that the database of the certification authority becomes extremely large. Perhaps a large number of certificate requests have arrived unnoticed and have been rejected, or perhaps there are many certificates in the database that have been issued twice. After the corresponding entries have been deleted from the Certification Authority database, the space now gained must (can) still be freed by compacting this in the server's file system.
Continue reading „Kompaktieren (Defragmentieren) der Zertifizierungsstellen-Datenbank“Viewing the certificate authority database revocation list table
By default, the certification authority stores all revocation lists that have not yet expired in the certification authority database.
Under certain circumstances, e.g. due to a misconfigured script, a large number of blacklists are stored in the database in this way, which can lead to a corresponding growth of the database (e.g. if large blacklists are recreated very often).
Continue reading „Einsicht in die Sperrlisten-Tabelle der Zertifizierungsstellen-Datenbank“
English 
Deutsch