Issues with In-Place Upgrade of Windows OCSP Server
Recently, a client reached out after experiencing issues with an in-place upgrade of a Windows OCSP server. After the upgrade, the Online Responder had a bad signing certificate and would not request a new one. This is a unique case, as the Online Responder server was using a Luna HSM for key protection and had […]
NTDS replication warning with Event ID 1093 — Template Best Practices
When configuring and managing Active Directory Certificate Services (ADCS) PKI, little things can have downstream impacts. Recently a client reached out regarding replication errors the team managing the domain controllers had forwarded. Microsoft lists a solution to the issue but does not address the root cause: https://learn.microsoft.com/en-us/troubleshoot/windows-server/active-directory/ntds-replication-warning-event-id-1093 The root cause of the issue is a default […]
CAB Forum Certificate Validity Updates
Since the news about changes to certificate validity was released, we have received numerous questions and observed a significant amount of misinformation stemming from misunderstandings. In this blog, our goal is to provide background information and guidance to support future planning. Specifically, we aim to clarify how the upcoming changes—shortening certificate validity periods—will impact public […]
Active Directory Certificate Services (ADCS) Certificate Authority Renewal Error
Certificate Authority Migration and Renewal In the past year many enterprises have migrated their Microsoft ADCS based PKI Infrastructure from Windows Server 2012 R2 to a newer operating system. The most common path for the migration is backup & restore to a server with the same name or backup & restore to server with a […]
The Case of the Blank Enrollment Policy
The Problem: Recently we worked with a client having issues with servers being unable to enroll for certificates. Users logged onto the servers could enroll successfully, however both autoenroll and manual enrollment for the servers were unsuccessful. Troubleshooting the Issue: The first test was to attempt a manual enrollment via CertLM.msc. We launched CertLM in […]
Certificate Requirements for Apple iOS 13 & macOS 10.15
When the next iOS and macOS major update arrives this fall to iPhones, iPads and Macs there will be changes that impact environments with TLS certificates not current with standards. Certificates with key lengths shorter than 2048, those signed with a SHA1 algorithm, and certificates without the DNS name in the subject alternative name (SAN) […]
Object Identifiers (OID) in PKI
A common question asked in our classes when we cover object identifiers (OIDs) is if there is a list of all the OIDs in a PKI environment. An object identifier is a string of decimal numbers that uniquely identifies an object. Since it isn’t a quick answer, I created this post to go a little […]
Creating RDP Certificates
In a previous blog on Object Identifiers (OID) in PKI, I mentioned creating a certificate template for Remote Desktop Connection (RDP). In this blog, I will show how to create the template, why the OID and extensions are important, and how to implement it and remove self-signed certificate warnings from RDP connections. Important Note Prior […]