Logitech Inconveniences Customers with Poor Certificate Management
If you use Logitech devices with your Mac, you likely weren’t a happy camper back in January! Right after celebrating the new year, Logitech customers booted up their MacBooks to find that their device customizations were gone. Angry users flooded the Logitech forums asking, “What the heck happened?” Since you’re here reading this particular blog, […]
To Revoke or Not to Revoke: Balancing Security with Performance and Operational Complexity
As a PKI engineer, I have consistently faced the challenges associated with certificate revocation. In several positions, I’ve been tasked with implementing automation to perform certificate revocation in bulk. Although I appreciated a task that showcased my coding skills, I often argued against such processes. I believe that many organizations misunderstand certificate revocation and how […]
Gardening and Weeding Certificate Templates: Private Key Flags
Mismanagement of certificate templates is one of the lowest of the low-hanging fruits when it comes to ADCS threat vectors. Among other things, a misconfigured certificate template can lead to a threat actor obtaining a certificate which could be used for privilege escalation up to and including Enterprise Administrator! As you can imagine, it’s a […]
Programmatically Determining Access Rights on Certificate Private Keys
There are times when the private key associated with a certificate needs to be accessible by multiple identities, not just the identity which owns the key material. An example is the deployment of the Microsoft Network Device Enrollment Services (NDES) role service on a server which needs to connect to a remotely hosted CA. In […]