ADCS Open Protocols specifications
Hello S-1-1-0, Today I want to talk about another area in ADCS I’m contributing to — Open Protocols specifications. Around 15 years ago, Microsoft moved toward to open source and started a new documentation branch called “Open Specifications”, where Microsoft publishes a very detailed Windows protocols specifications so third party can build compatible clients and […]
Crafting a dummy certificate with specific serial number in Microsoft ADCS
Today I went through a thread on Twitter with claims that there is no supported way to revoke a rogue certificate with known serial number in Microsoft CA. TL;DR skip to next section The long story short: the thread originally was focused on an OCSP deterministic response support. The idea behind this is that by default, Microsoft […]
ADCS Certification Authority Database query numbers
Hello everyone, I’m back again and today I want to share some thoughts on retrieving massive results from ADCS Certification Authority database. Point of interest As a part of my ongoing project I had to collect database statistics (simply, number of revoked, issued, pending, failed, denied requests) and my concern was query performance on relatively […]
Certificate renewal request is placed in pending state when Valid Existing Certificate is selected in certificate template
Hello S-1-1-0, here is a new blog post in a long time. Today I want to talk about the issue when “Valid existing certificate” does not bypass CA Manager approval and/or enrollment agent requirement during certificate renewal in Microsoft CA. In certificate template settings, Issuance Requirements we can configure additional requirements for enrollment and re-enrollment […]
Book review – “Pro Active Directory Certificate Services” by Lawrence E. Hughes
Disclaimer: This review contains my personal opinion about the book and does not necessary reflect the company’s or other people’s opinion. Hello everyone, today I have a little-bit unusual blog post, which is a book review. As you may know, my primary interest area is Microsoft Active Directory Certificate Services (ADCS) and it there are […]
ADCS certificate serial number generation algorithms – a comprehensive guide
Hello S-1-1-0, @Crypt32 is again on a failboatboard with new blog post. Today I will share information about a little-known portion in configuration of Microsoft ADCS Certification Authority – serial number generation algorithm. This article assumes big-endian encoding Certificate serial number requirements Every X.509 conforming CA generates a unique serial number for each issued certificate, […]
Basic Constraints certificate extension
Hello everyone! Today I’m going to talk about X.509 Basic Constraints certificate extension. Basic Constraints is an X.509 Version 3 certificate extension and is used to identify the type of the certificate holder/subject. In the past (prior to version 3 X.509 certificates) it was impossible to identify who is the subject: CA certificate or end […]
Accessing and using certificate private keys in .NET Framework/.NET Core
This blog post is about programming and its purpose is to have a link to direct developers for explanation. Inspired from this list: Casting private key to RSACryptoServiceProvider not working Best way to initiate RSACryptoServiceProvider from x509Certificate2? Unable to cast object of type ‘RSACng’ to type ‘System.Security.Cryptography.RSACryptoServiceProvider’ RSACryptoServiceProvider not working in .net core Getting RSA […]