Understanding Active Directory Certificate Services Containers in Active Directory
As part of joining PKI Solutions, several blog posts from my old site are re-posted here for visibility and thoroughness. Hello folks! Today I want to explain in details about Active Directory containers related to ADCS (Active Directory Certificate Services), their purposes and how they work. Intro All ADCS related containers are stored in configuration […]
Request extension processing in Active Directory Certification Authority
Hello S-1-1-0, Crypt32 is on air! Today I want to explain how ADCS Certification Authority processes extensions from incoming requests and certificate templates. Every X.509 V3 certificate contains certificate extensions to include extra information about certificate owner, issuer, intended usages, limitations/constraints. CA utilize multiple sources to generate extension list to be included in signed certificate, […]
OCSP Magic Number
The magic number is a value that states when CRLs will be processed over OCSP, specifically it is when the total number of cached OCSP responses from a single OCSP responder URL on behalf of a single certificate authority will stop performing OCSP and start processing CRLs. This will occur if the number of cached […]
Name Constraints Extension
The Name Constraints extension indicates to the relying party what namespaces are acceptable for the various hierarchical name forms such as DN, DNS names, URL, IP address, RFC 822 names, UPN, etc. The extension is only valid for a CA certificate. There are two components for this as defined in https://tools.ietf.org/html/rfc5280#section-4.2.1.10 as: Permitted Subtree(s): This […]
Field Report – PKI Spotlight Rocked My World Again
This is another blog in the series about how PKI Spotlight is changing how customers realize improved operational efficiency, enhanced security, and better visibility of their PKI and HSM key management environments, and how it’s changing our world as PKI practitioners. All the names and specifics are redacted to protect the confidentiality of all involved […]
Announcing the Online PKI Assessmental Portal
Editor’s Note (2025 Update): The Online PKI Assessment Portal is no longer offered. Its capabilities have evolved into PKI Spotlight—a modern platform designed to give you continuous visibility into the health and security of your PKI. If you’re considering an assessment today, Spotlight is where to start. Contact us to learn how you can get […]
Announcing Free PKI Assessments
Editor’s Note (2025 Update): The Online PKI Assessment Portal is no longer offered. Its capabilities have evolved into PKI Spotlight—a modern platform designed to give you continuous visibility into the health and security of your PKI. If you’re considering an assessment today, Spotlight is where to start. Contact us to learn how you can get […]