How to create Certificate Trust List (CTL) using PowerShell
In this post, I will explain how to create custom certificate trust list (CTL) using PowerShell PKI (PSPKI) module. What is CTL? In short, CTL is a Microsoft open format of portable certificate container based on PKCS#7 format. Although, PKCS#7 already is a simple container for certificate, CTL provides several useful features: Name each list […]
Announcing our Microsoft KB Archive Service
We have been working on an interesting skunkworks style project and are pleased to share our work with all of you. It all started when we started to notice Microsoft was archiving/deleting Support KB articles from its site – often even when the information was still pertinent. We started noticing a number of the items […]
Deleting certificates from Windows Certificate Store programmatically (PowerShell and C#)
Yesterday I went through one thread on Reddit: New to PS and want to create a script to clear all personal certificates from a local machine and something was suspicious to me. Then I went further and asked google for similar question and examined first page: Delete certificate from Computer Store Removing a certificate from […]
Handling X509KeyStorageFlags in applications
Hello everyone! While participating on StackOverflow.com, I’m observing common in-app certificate handling misuses in .NET applications and I want to share some thoughts on this. Today I would like to speak about handling X509Certificate2 object creation inside the application code, common problems in handling private key material, potential issues and how to overcome them. Problem […]
Microsoft KB Archive update, February 2020
Hello everyone! Today I want to provide some cool news from our Microsoft KB Archive service. UX changes After service launch, we received various feedback from users and I addressed most requested ones. Search bar everywhere Initially, there was only dedicated page with search box to search for articles. Now, search box is placed on a menu […]
Database log files are not truncated when you perform a full Certification Authority database backup
As part of joining PKI Solutions, several blog posts from my old site are re-posted here for visibility and thoroughness. April 1, 2020 – The issue described here is applicable to Windows Server 2016 and older. Windows Server 2019 has changed the behavior of log truncation – when a backup is performed, all unused logs […]
Escalating from child domain’s admins to enterprise admins in 5 minutes by abusing AD CS, a follow up
Hello everyone, long time no see. I’m still extremely busy on my main job stuff, specifically PKI Spotlight commercial product development, so my blogging has slowed, and I’m here again! Prologue Disclaimer: This post contains steps and information that can lead to legal issues with your employer and lawsuits if you execute them in a production […]
Enabling Active Directory Certificate Services (ADCS) Advanced Audit
Hello S-1-1-0, here is another unscheduled blog post on enabling advanced audit in Microsoft CA. Today I went through another thread on Twitter which suggests how to enable advanced audit in Microsoft CA. Throughout the thread it was apparent that only partial solution was provided. Windows CA auditing engines Microsoft CA implements a set of […]