Offline Certificate Authority – What Exactly Does that Mean?
This post started as recommended maintenance and updates for offline CAs, and it became clear I should make this a two-part post. So today I am covering what an Offline CA really means, and tomorrow I will cover recommendations for maintaining one of them. First, we must cover what I mean by Offline CA – […]
Offline CA Maintenance – What Do You Really Need to Do?
In a previous post, I discussed the configuration and isolation of true offline Certificate Authorities. There I made reference to the fact that an offline CA is one that never sees the light of day, figuratively that is. The CA should be air-gaped from the network, which requires physical access to the CA to manage […]
Database log files are not truncated when you perform a full Certification Authority database backup
As part of joining PKI Solutions, several blog posts from my old site are re-posted here for visibility and thoroughness. April 1, 2020 – The issue described here is applicable to Windows Server 2016 and older. Windows Server 2019 has changed the behavior of log truncation – when a backup is performed, all unused logs […]
Enabling Active Directory Certificate Services (ADCS) Advanced Audit
Hello S-1-1-0, here is another unscheduled blog post on enabling advanced audit in Microsoft CA. Today I went through another thread on Twitter which suggests how to enable advanced audit in Microsoft CA. Throughout the thread it was apparent that only partial solution was provided. Windows CA auditing engines Microsoft CA implements a set of […]
ADCS Database Log Truncation Change in Server 2019
In our past blogs on the subject of Windows Server ADCS backups, we have touched on the issue of jet database logs not being truncated and deleted in some scenarios. https://www.pkisolutions.com/adcsbackups/ https://www.pkisolutions.com/database-log-files-are-not-truncated-when-you-perform-a-full-certification-authority-database-backup/ Specifically, if backups are performed via snapshot or non-VSS based backups and secondly, if any logs are still held open by the jet […]
Backing up ADCS Certificate Authorities (Part 2 of 2)
In my last blog post (Backing up ADCS Certificate Authorities Part 1) I covered the inner workings of how ADCS and the Jet database works to maintain the CA data. In this post I am going to go over a comprehensive PowerShell script that I wrote to perform a full backup of all necessary ADCS […]
Announcing the Online PKI Assessmental Portal
Editor’s Note (2025 Update): The Online PKI Assessment Portal is no longer offered. Its capabilities have evolved into PKI Spotlight—a modern platform designed to give you continuous visibility into the health and security of your PKI. If you’re considering an assessment today, Spotlight is where to start. Contact us to learn how you can get […]
Backing up ADCS Certificate Authorities (Part 1 of 2)
One of the areas I have spoken about extensively at conferences and cover in our training classes is the unique issues associated with backing up and managing your ADCS Certificate Authority. There are several items I would like to address in this two-part series: CA Database and log file structure Unique issues with VM Snapshots with ADCS […]