The Name Constraints extension indicates to the relying party what namespaces are acceptable for the various hierarchical name forms such as DN, DNS names, URL, IP address, RFC 822 names, UPN, etc. The extension is only valid for a CA certificate. There are two components for this as defined in https://tools.ietf.org/html/rfc5280#section-4.2.1.10 as: Permitted Subtree(s): This…
Read More
Since the launch of our Online Assessment Program in 2020, we have seen incredible interest in the ability to perform a thorough review and assessment of an organization’s PKI without the expense and effort of working with a consultant onsite. The self-paced, on-demand approach was an industry first for reviewing and assessing the configuration, health,…
Read More
What do AWS, Radware, Nintendo, Google, and Facebook all have in common (other than being some of the smartest actors in internet commerce)? Over the past 18 months, they have all been impacted by outages traceable to the Border Gateway Protocol (BGP). The BGP was designed in 1994, literally on a napkin, to route data…
Read More
Hello S-1-1-0, @Crypt32 is again on a failboatboard with new blog post. Today I will share information about a little-known portion in configuration of Microsoft ADCS Certification Authority – serial number generation algorithm. This article assumes big-endian encoding Certificate serial number requirements Every X.509 conforming CA generates a unique serial number for each issued certificate,…
Read More
Hello everyone, I’m back again and today I want to share some thoughts on retrieving massive results from ADCS Certification Authority database. Point of interest As a part of my ongoing project I had to collect database statistics (simply, number of revoked, issued, pending, failed, denied requests) and my concern was query performance on relatively…
Read More
The magic number is a value that states when CRLs will be processed over OCSP, specifically it is when the total number of cached OCSP responses from a single OCSP responder URL on behalf of a single certificate authority will stop performing OCSP and start processing CRLs. This will occur if the number of cached…
Read More
Today we are announcing a new feature for our Online PKI Assessment portal. Our portal offers the world’s first, on-demand, self-paced assessment of Microsoft ADCS based PKIs. Utilizing our proprietary automated data collection tools, you can quickly scan and collect configuration details from your PKI and receive an assessment online – all at your convenience…
Read More
Hello S-1-1-0, here is another blog post in the PSPKI v3.7 enhancement blog series. Today I will talk about another interesting work done in PSPKI. Intro In one of my previous posts, I’ve outlined a very general roadmap for PKI library and the move towards the .NET Core. There are several obstacles for the move…
Read More
Today I’m starting a series of blog posts where I will explore new features we have added to PowerShell PKI module, version 3.7. First post is dedicated to security descriptors. Major changes in PSPKI Within PSPKI module, we had an ability to manage security descriptors (access control lists) for Certification Authority can certificate template objects.…
Read More