Category Archives: PKI

PKI lockdown for internal Enterprise Roots using CAPolicy.inf

Posted on November 4, 2011 by DXter

Sorry for being absence from the blog right now. A lot of time consuming stuff is happening at work right now, but I will better myself, I promise! A very common problem I see regarding ADCS and PKI is that … Continue reading →

Posted in PKI | Tagged , | 4 Comments

ADCS Certificate Expiration Report Tool

Posted on August 9, 2011 by DXter

I want to start with a little disclaimer: The real credits for this tool does not really belong to me. This tool is using the really wonderful PSPKI PowerShell module from http://pspki.codeplex.com/ and all credits should go them for making … Continue reading →

Posted in PKI, PowerShell | Tagged , , | 18 Comments

WINSEC crew @ Microsoft Sommarkollo 2011

Posted on June 30, 2011 by DXter

Yesterday myself, Hasain Alshakarti and Göran Melvås (all three of us are members of Swedish Windows Security User Group) had a live session at Microsoft Sweden about Forefront Identity Manager Certificate Management 2010 (FIM-CM 2010).   I wanted to thank … Continue reading →

Posted in PKI | Tagged , , , | 2 Comments

How to issue EV SSL certificates from an Enterprise CA

Posted on May 22, 2011 by DXter

A question that I get all the time, is how to issue internal Extended Validation certificates from an internal Enterprise CA. Even though EV certificates do not provide increased security from a technical point of view, sometimes people just want … Continue reading →

Posted in PKI | Tagged , | 3 Comments

Do not enable SAN certificate requests on your Enterprise CA’s!

Posted on May 13, 2011 by DXter

Not many people are not aware of the fact that enabling SAN attributes in certificate requests can be a security issue. I have seen many people on different forums that tell other people to enable EDITF_ATTRIBUTESUBJECTALTNAME2 with certutil on Enterprise … Continue reading →

Posted in PKI | Tagged , | Leave a comment

Goodies from CAPolicy.inf–LoadDefaultTemplates

Posted on April 26, 2011 by DXter

Not many people are aware of a certain available option in CAPolicy.inf that came with Windows Server 2003 SP1. The LoadDefaultTemplates is very useful since it prevents the CA to associate itself with the default list of certificate templates when … Continue reading →

Posted in PKI | Tagged , | Leave a comment

How to remotely check if Base CSP is installed

Posted on April 15, 2011 by DXter

At this TechDays 2011 here in Sweden, I got a question when I was standing in the Swedish Windows Security User Group booth about if there was some easy way to determine if the Microsoft Base CSP (KB909520) is installed … Continue reading →

Posted in PKI | Tagged , , | Leave a comment

Don’t forget the CAPolicy.inf file!

Posted on April 9, 2011 by DXter

Yesterday I saw it again – a Windows Server 2003 Root CA that was installed with NO CAPolicy.inf file!   Apparently, not everybody are aware about how Certificate Services works regarding the creation of the certificate that is being generated … Continue reading →

Posted in PKI | Tagged , | 1 Comment

Windows 2008 R2 ADCS in a Windows 2000 ADDS

Posted on April 5, 2011 by DXter

Last night, I did a quite fun test. I tested ADCS in 2008 R2 from a compatibility view. I installed a Windows 2000 mixed mode domain (schema version 13) and installed an Enterprise Root on a domain member running Windows … Continue reading →

Posted in PKI | Tagged , | Leave a comment

ADCS Backup Tool–ADCS Backups made easy…

Posted on March 31, 2011 by DXter

Last week, I discussed with dear pal Stefan Schörling at http://www.msfaq.se/ regarding some questions about how to do a complete backup and restore of an Enterprise CA in a disaster recovery scenario without using a full machine backup. In other … Continue reading →

Posted in PKI, PowerShell, PowerShell Blogs | Tagged , | 1 Comment