| Event Source: | Microsoft-Windows-CertificateServicesClient-CertEnroll |
| Event ID: | 64 (0x825A0040) |
| Event log: | Application |
| Event type: | Warning |
| Event text (English): | Certificate enrollment for %1 successfully load policy from policy server %2 |
| Event text (German): | The policy was successfully loaded from the policy server %2 using the certificate enrollment for %1. |
Category: Certificate usage
Details of the event with ID 65 of the source Microsoft-Windows-CertificateServicesClient-CertEnroll
| Event Source: | Microsoft-Windows-CertificateServicesClient-CertEnroll |
| Event ID: | 65 (0x825A0041) |
| Event log: | Application |
| Event type: | Warning |
| Event text (English): | Certificate enrollment for %1 is successfully authenticated by policy server %2 using authentication mechanism %5 (Credential: %4). Policy Id: %3 |
| Event text (German): | Certificate enrollment for %1 was successfully authenticated by policy server %2 using authentication mechanism %5 (credentials: %4). Policy ID: %3 |
Details of the event with ID 67 of the source Microsoft-Windows-CertificateServicesClient-CertEnroll
| Event Source: | Microsoft-Windows-CertificateServicesClient-CertEnroll |
| Event ID: | 67 (0x825A0043) |
| Event log: | Application |
| Event type: | Warning |
| Event text (English): | Certificate enrollment for %1 failed to load policy from policy servers with ID %2 (%3) |
| Event text (German): | Error loading policy using certificate enrollment for %1 from policy servers with ID %2 (%3). |
Details of the event with ID 68 of the source Microsoft-Windows-CertificateServicesClient-CertEnroll
| Event Source: | Microsoft-Windows-CertificateServicesClient-CertEnroll |
| Event ID: | 68 (0x825A0044) |
| Event log: | Application |
| Event type: | Warning |
| Event text (English): | Certificate enrollment for %1 failed in authentication to policy servers with ID %2 (%3) |
| Event text (German): | Error authenticating certificate policy for %1 on policy servers with ID %2 (%3). |
Details of the event with ID 74 of the source Microsoft-Windows-CertificateServicesClient-CertEnroll
| Event Source: | Microsoft-Windows-CertificateServicesClient-CertEnroll |
| Event ID: | 74 (0x825A004A) |
| Event log: | Application |
| Event type: | Warning |
| Event text (English): | Certificate enrollment for %1 failed to load policy from policy server %2 with ID %3 (%4) |
| Event text (German): | Error loading policy using certificate enrollment for %1 from policy server %2 with ID %3 (%4). |
Details of the event with ID 75 of the source Microsoft-Windows-CertificateServicesClient-CertEnroll
| Event Source: | Microsoft-Windows-CertificateServicesClient-CertEnroll |
| Event ID: | 75 (0x825A004B) |
| Event log: | Application |
| Event type: | Warning |
| Event text (English): | Certificate enrollment for %1 failed in authentication to policy server %2 with ID %3 (%6). Authentication mechanism was %5 (Credential: %4). |
| Event text (German): | Certificate enrollment error for %1 when authenticating for policy server %2 with ID %3 (%6). Authentication mechanism used %5 (credentials: %4). |
Details of the event with ID 86 of the source Microsoft-Windows-CertificateServicesClient-CertEnroll
| Event Source: | Microsoft-Windows-CertificateServicesClient-CertEnroll |
| Event ID: | 86 (0xC25A0056) |
| Event log: | Application |
| Event type: | Error |
| Event text (English): | SCEP Certificate enrollment initialization for %1 via %2 failed: %3 Method: %4 Stage: %5 %6 |
| Event text (German): | Error during initialization of SCEP certificate registration for %1 via %2: %3 Method: %4 Phase: %5 %6 |
Details of the event with ID 87 of the source Microsoft-Windows-CertificateServicesClient-CertEnroll
| Event Source: | Microsoft-Windows-CertificateServicesClient-CertEnroll |
| Event ID: | 87 (0xC25A0057) |
| Event log: | Application |
| Event type: | Error |
| Event text (English): | SCEP Certificate enrollment for %1 via %2 failed: %3 Method: %4 Stage: %5 %6 |
| Event text (German): | SCEP certificate registration error for %1 over %2: %3 Method: %4 Phase: %5 %6 |
No certificate is requested via autoenrollment if a user is connected via Virtual Private Network (VPN)
Assume the following scenario:
- A user works remotely via Virtual Private Network (VPN)
- Actually, a certificate should be requested via autoenrollment, but this is not done
- A connection test (certutil -ping) to the certification authority throws the following error message:
Server could not be reached: The RPC server is unavailable. 0x800706ba (WIN32: 1722 RPC_SERVER_UNAVAILABLE) -- (31ms) CertUtil: -ping command FAILED: 0x800706ba (WIN32: 1722 RPC_S_SERVER_UNAVAILABLE) CertUtil: The RPC server is unavailable.Continue reading „Es wird kein Zertifikat per Autoenrollment beantragt, wenn ein Benutzer per Virtual Private Network (VPN) verbunden ist“
Microsoft Outlook: Signed e-mail messages appear invalid with error message "No certificate was found to verify the signature of this message."
Assume the following scenario
- A user receives an e-mail message signed with Secure/Multipurpose Internet Mail Extensions (S/MIME).
- The user (the recipient) uses Microsoft Outlook for Windows.
- The sender uses Microsoft Outlook for Macintosh.
- The certificate used to sign the message is valid.
- The e-mail signature is displayed as invalid. Inspection of the signature reveals that no details about the signature certificate can be displayed.
Error: No certificate was found to verify the signature of this message. Signed by (certificate subject name unknown) using RSA/SHA256 at 15:44:59 19.05.2021.Continue reading „Microsoft Outlook: Signierte E-Mail Nachrichten erscheinen ungültig mit Fehlermeldung „Es wurde kein Zertifikat zum Überprüfen der Signatur dieser Nachricht gefunden.““
Microsoft Outlook: "This message cannot be encrypted or signed by Microsoft Outlook because there are no certificates for sending messages from the email address [...]."
Assume the following scenario:
- A user wants to send a signed e-mail
- The operation fails with the following error message:
This message cannot be encrypted or signed by Microsoft Outlook because there are no certificates for sending messages from the email address "rudi.ratlos@adcslabor.de". Either request a new digital ID for this account, or use the Accounts button to send the message using an account for which you have certificates.Continue reading „Microsoft Outlook: „Diese Nachricht kann von Microsoft Outlook weder verschlüsselt noch signiert werden, da keine Zertifikate für das Senden von Nachrichten von der E-Mail Adresse […] vorhanden sind.““
The "Application Policies" certificate extension
The purposes for which a digital certificate may be used are controlled via the certificate extensions "Key Usage" and "Extended Key Usage".
In the "Extended Key Usage" certificate extension, the extended key uses for which the certificate may be used.
However, there is another certificate extension called "Application Policies" for certificates issued by a Microsoft Certification Authority, which also contains a list very similar to the Extended Key Usages extension.
Continue reading „Die „Application Policies“ Zertifikaterweiterung“New certificates are regularly requested via Autoenrollment
Assume the following scenario:
- A certificate template is configured for automatic request and issuance (AutoEnrollment).
- Users or computers apply for new certificates at regular intervals and long before the defined renewal period.
The key algorithm of certificate requests is not checked by the certification authority's policy module
Assume the following scenario:
- A certificate template is configured to use elliptic curve based keys (e.g. ECDSA_P256).
- As a result, a minimum key length of 256 bits is configured.
- Nevertheless, certificate requests that use other ECC curves or RSA-based keys are also signed.
SignTool installation without Windows Software Development Kit (SDK) installation
One way to perform code signatures is to use the SignTool command line tool. This is part of the Windows 10 Software Development Kit (SDK).
If you want to use the tool on a system without having to install Visual Studio or the Windows SDK, you can proceed as follows.
Continue reading „SignTool Installation ohne Installation des Windows Software Development Kit (SDK)“
English 
Deutsch