Certificate Requirements for Apple iOS 13 & macOS 10.15
When the next iOS and macOS major update arrives this fall to iPhones, iPads and Macs there will be changes that impact environments with TLS certificates not current with standards. Certificates with key lengths shorter than 2048, those signed with a SHA1 algorithm, and certificates without the DNS name in the subject alternative name (SAN) […]
MS Press Server 2008 PKI Book Errata launch
For many years I’ve been tracking the corrections and issues in the last Microsoft Press Windows Server 2008 PKI book. All of these items have previously been incorporated into our standard deployment and consulting engagements as well as baked into our training courses. But I’ve long wanted to post an unofficial errata list for the […]
Windows Server 2016 – What’s New with ADCS
Well, here it is – the concise list of updates and changes to Active Directory Certificate Services (ADCS) for Windows Server 2016. I will go ahead and tell you now that there aren’t any new earth shattering features. Consider this an incremental set of improvements to ADCS. Remember that we still have things like Elliptical Curve […]
The mystery of “Valid existing certificate” setting in ADCS certificate templates – demystified
This is a follow-up of “Certificate renewal request is placed in pending state when Valid Existing Certificate is selected in certificate template” blog post and final nail into the subject. Let’s re-iterate the problem. ADCS Certificate Templates provide configuration for issuance requirements, which allows you to forcibly put request in pending state (no automatic issuance) […]
OCSP Magic Number
The magic number is a value that states when CRLs will be processed over OCSP, specifically it is when the total number of cached OCSP responses from a single OCSP responder URL on behalf of a single certificate authority will stop performing OCSP and start processing CRLs. This will occur if the number of cached […]
Announcing our Microsoft KB Archive Service
We have been working on an interesting skunkworks style project and are pleased to share our work with all of you. It all started when we started to notice Microsoft was archiving/deleting Support KB articles from its site – often even when the information was still pertinent. We started noticing a number of the items […]
Microsoft Security Advisory for ADCS exploit – ADV210003
This morning we provided details to our existing support and co-management customers on a recent notice of vulnerability to certain Microsoft ADCS configurations. The exploit involves NTLM and leveraging some ADCS PKI components. Full details can be found here: https://msrc.microsoft.com/update-guide/en-US/vulnerability/ADV210003. Summary In environments with NTLM authentication still enabled in Active Directory and when using ADCS Web […]
Database log files are not truncated when you perform a full Certification Authority database backup
As part of joining PKI Solutions, several blog posts from my old site are re-posted here for visibility and thoroughness. April 1, 2020 – The issue described here is applicable to Windows Server 2016 and older. Windows Server 2019 has changed the behavior of log truncation – when a backup is performed, all unused logs […]