Ignore Revocation Checking – The bane of my existence!
As students in my PKI training classes know, one of the areas I am a vocal about is the blind use of the CRLF_REVCHECK_IGNORE_OFFLINE setting in a PKI environment. I am so adamantly against the use of this setting, I personally refuse to ever explicitly share or type the syntax to enable this nasty beast. Unfortunately […]
Offline Certificate Authority – What Exactly Does that Mean?
This post started as recommended maintenance and updates for offline CAs, and it became clear I should make this a two-part post. So today I am covering what an Offline CA really means, and tomorrow I will cover recommendations for maintaining one of them. First, we must cover what I mean by Offline CA – […]
Offline CA Maintenance – What Do You Really Need to Do?
In a previous post, I discussed the configuration and isolation of true offline Certificate Authorities. There I made reference to the fact that an offline CA is one that never sees the light of day, figuratively that is. The CA should be air-gaped from the network, which requires physical access to the CA to manage […]
Enabling Active Directory Certificate Services (ADCS) Advanced Audit
Hello S-1-1-0, here is another unscheduled blog post on enabling advanced audit in Microsoft CA. Today I went through another thread on Twitter which suggests how to enable advanced audit in Microsoft CA. Throughout the thread it was apparent that only partial solution was provided. Windows CA auditing engines Microsoft CA implements a set of […]
Backing up ADCS Certificate Authorities (Part 2 of 2)
In my last blog post (Backing up ADCS Certificate Authorities Part 1) I covered the inner workings of how ADCS and the Jet database works to maintain the CA data. In this post I am going to go over a comprehensive PowerShell script that I wrote to perform a full backup of all necessary ADCS […]
Announcing the Online PKI Assessmental Portal
Editor’s Note (2025 Update): The Online PKI Assessment Portal is no longer offered. Its capabilities have evolved into PKI Spotlight—a modern platform designed to give you continuous visibility into the health and security of your PKI. If you’re considering an assessment today, Spotlight is where to start. Contact us to learn how you can get […]
Backing up ADCS Certificate Authorities (Part 1 of 2)
One of the areas I have spoken about extensively at conferences and cover in our training classes is the unique issues associated with backing up and managing your ADCS Certificate Authority. There are several items I would like to address in this two-part series: CA Database and log file structure Unique issues with VM Snapshots with ADCS […]