Understanding Microsoft Cryptographic Service Providers
A common question I often get from customers and students is about Microsoft’s Cryptographic Service Providers (CSP). The CSPs are responsible for creating, storing and accessing cryptographic keys – the underpinnings of any certificate and PKI. These keys can be symmetric or asymmetric, RSA, Elliptical Key or a host of others such as DES, 3DES, […]
Cybersecurity Laws, Regulations and Compliance
We are providing this evergreen and living document on Cybersecurity Laws, Regulations and Compliance With an Emphasis on Threat Detection Recon. Please let us help you with your best practices. These are laws, regulations, and compliance requirements related to cybersecurity and the protection of sensitive data, along with a summary of each, an explanation of […]
Ignore Revocation Checking – The bane of my existence!
As students in my PKI training classes know, one of the areas I am a vocal about is the blind use of the CRLF_REVCHECK_IGNORE_OFFLINE setting in a PKI environment. I am so adamantly against the use of this setting, I personally refuse to ever explicitly share or type the syntax to enable this nasty beast. Unfortunately […]
Field Report – Stop REACTING to Expired CRLs
In this article, I continue to dig into how we are changing the world of PKI administration with PKI Spotlight. One of the most common issues organizations face around the world is due to expired Certificate Revocation Lists (CRLs). If you’re not already familiar, Certificate Authorities (CA) are not involved in the moment-to-moment verification of […]
PowerShell PKI (PSPKI) 3.7 enhancements – security descriptors
Today I’m starting a series of blog posts where I will explore new features we have added to PowerShell PKI module, version 3.7. First post is dedicated to security descriptors. Major changes in PSPKI Within PSPKI module, we had an ability to manage security descriptors (access control lists) for Certification Authority can certificate template objects. […]
PowerShell PKI (PSPKI) 3.7 enhancements – Certification Authority API (part 1)
Hello S-1-1-0, here is another blog post in the PSPKI v3.7 enhancement blog series. Today I will talk about another interesting work done in PSPKI. Intro In one of my previous posts, I’ve outlined a very general roadmap for PKI library and the move towards the .NET Core. There are several obstacles for the move […]
Unveiling PKI Spotlight: Industry’s first and only real-time PKI monitoring and alerting solution
Today, we’re excited and proud to announce the launch of PKI Spotlight, the industry’s first and only real-time PKI monitoring and alerting solution. This revolutionary product provides important information about the availability, configuration, and security of all of your organization’s PKI environments – all consolidated into one easy-to-use dashboard. You can read the news release about […]
The mystery of “Valid existing certificate” setting in ADCS certificate templates – demystified
This is a follow-up of “Certificate renewal request is placed in pending state when Valid Existing Certificate is selected in certificate template” blog post and final nail into the subject. Let’s re-iterate the problem. ADCS Certificate Templates provide configuration for issuance requirements, which allows you to forcibly put request in pending state (no automatic issuance) […]