When does a Windows CA refreshes the CRL?

Hi, since I am working with Windows PKI (10+ years) I noticed that a Windows CA is running into a situation where the CRL has expired and the CA service will never renew it until you force it to do.
That happens if the CA is down for maintenance or restore right at the time the renew of the CRL would be triggered. So that is bad but only things we cannot change keep us awake at night and so here is the solution for that problem.
I recommend to issue the CRL e.g. for issuing CAs with a validity between 10 and 14 days, no longer and definitely not much shorter until you are 110 percent sure about you recovery process and you have tested it in real before. I had once a client they promised to have any machine recovered within 4 hours. We had a bad hard drive or controller and one came to the other. We asked for a recovery what happened 4 days later. Okay so if your CRL is to short you get a lot of pressure at this point.

As in any good PKI project you can ask certutil.exe for help.

A certutil.exe -CRL command triggers the CA to issue a new CRL. Depending on your configuration that file goes into LDAP and/or on the file system. With certutil.exe -getcrl myCAcrlfile.crl you get it from the CA as well e.g. in case you want copy it to multiple web servers.
That can do a scheduled tasks e.g. executed once a day or night

So that gives us some advantages:
1) we see every day a new CRL (like a heartbeat ;-))
2) the new CRL has always the max validity period
3) is contains the latest revoked certificates, if any
4) even the CA was down for maintenance at the point of CRL renewal,   the schedule task will take care of the CRL renewal

If you make use of certificate revocation a lot that is also the way to trigger the CA to issue new CRLs more often. Just run it more often.

Until next time,
Lutz

certutil.exe shortcut

Hi,
currently I am working with great people on a PKI project. So it came how it has to come, we use certutil.exe for various purposes and we came across a nice shortcut I want share.
So every time you use certutil.exe to query a CA server from remote you have to specify the config information. (Actually the -ping allows you just to specify the CA hostname, no -config necessary)


e.g.



C:\system>certutil.exe
Entry 0:
  Name:                         `AAA-trii-CAI01'
  Organizational Unit:          `'
  Organization:                 `tribaldi'
  Locality:                     `'
  State:                        `'
  Country/region:               `'
  Config:                       `cai01.tribaldi.net\AAA-trii-CAI01'
  Exchange Certificate:         `'
  Signature Certificate:        `'
  Description:                  `'
  Server:                       `cai01.tribaldi.net'
  Authority:                    `AAA-trii-CAI01'
  Sanitized Name:               `AAA-trii-CAI01'
  Short Name:                   `AAA-trii-CAI01'
  Sanitized Short Name:         `AAA-trii-CAI01'
  Flags:                        `1'
  Web Enrollment Servers:       `'
CertUtil: -dump command completed successfully.


So then you copy the config value and use it like:

C:\system>certutil -catemplates -config "cai01.tribaldi.net\AAA-trii-CAI01"
3b_clmAgent: 3b_clmAgent -- Auto-Enroll: Access is denied.
3B_enrollment_agent: 3B_enrollment_agent -- Auto-Enroll: Access is denied.
3BUser_onbehalf: 3BUser_onbehalf -- Auto-Enroll: Access is denied.
WebServerORG: Web Server ORG -- Auto-Enroll: Access is denied.
3bcomputer: 3bcomputer -- Auto-Enroll: Access is denied.
ISE_BYOD: ISE_BYOD -- Auto-Enroll: Access is denied.
BYOD: BYOD -- Auto-Enroll: Access is denied.
WebServer: Web Server -- Auto-Enroll: Access is denied.
IPSECIntermediateOffline: IPSec (Offline request) -- Auto-Enroll: Access is denied.
CEPEncryption: CEP Encryption -- Auto-Enroll: Access is denied.
EnrollmentAgentOffline: Exchange Enrollment Agent (Offline request) -- Auto-Enroll: Access is denied.
CertUtil: -CATemplates command completed successfully.



So while that is cool for scripting purpose, e.g. for documentation, the shortcut is much simpler. Instead of the value behind the config parameter you can just type a dash (minus sign), and that will open a dialog showing you all CA registered in AD. See here

And that will give you exact the same result as in the command before. 

Until next time,

Lutz

P.S. these examples are created from Windows 2012 R2 machines.

How to archive and un-archive certificates

You are might aware that certificates can be flagged archived on a Windows machine. That has nothing (as in nada) to do with key archiving what is performed if configured on the Certification Authority.
The archive flagged is used to make certificates invisible to applications without deleting them from a user or machine store. E.g. auto-enrollment sets this flag to an certificate if a new certificate has been enrolled.
In this post I want show you how to set and unset this flag.

First of all we want see if we have a certificate in the certificate store with the archive flag set. I work on my machine as local administrator and so should you.

1. Open for that a MMC and add the Certificate snap-in for either your user or the local machine, or both if you like.

Then enable show archived certificates. That is like an advanced view setting that you might know from Active Directory Users and Computers.

Note: You have to enable the Archived certificate view for each snap-in separately. So in the picture above I made that for Certificates - Current user and for Certificates (Local Computer)


Now you see archived certificates in the MMC

Note the letter A at the end. That is the sign that this certificate is flagged archived.


2. You can do the same by running a certutil command. The MMC does not give you an option to set the flag from there. So you have to use certutil to do that, see below.


Use certutil to see all certificates

certutil.exe -store my

will show you all certificates in the local machine store

...
================ Certificate 4 ================
Archived!
Serial Number: 3dc344f3e2cf6dab48d7085ecd1bb849
Issuer: CN=localhost
 NotBefore: 6/13/2012 2:17 PM
 NotAfter: 6/12/2022 5:00 PM
Subject: CN=localhost
Signature matches Public Key
Root Certificate: Subject matches Issuer
Template:
Cert Hash(sha1): 80 3e 7f 62 5a be 5b 14 52 e3 65 dd 72 4d 59 98 cb 8a 30 d3
  Key Container = IIS Express Development Certificate Container
  Unique container name: fad662b360941f26a1193357aab3c12d_42f2ea6e-c662-4d0b-8b56-2f094a3a3dc9
  Provider = Microsoft RSA SChannel Cryptographic Provider
Encryption test passed
....


So that certificate is number 4 in the certificate store. Lets write this down for later.


3. We will use certutil for un-archiving the certificate (and we can use it for archiving as well).

Here the file to set the archive flag.
- Create a new file with notepad and call it archive_set.inf
- paste these two lines to the archive_set.inf file

[Properties]
19 = Empty ;

- save the file

Here the file to remove the archive flag
- Create a new file with notepad and call it archive_remove.inf
- paste these 2 lines to the archive_remove.inf file

[Properties]
19 =          ;

- save the file

4. Now you can toggle the archive flag as you desire:

Now you need the number you have taken down from step 2 or use the certificate serial number instead.


flag on

certutil.exe -repairstore my 4 archive_set.inf


flag off

certutil.exe -repairstore my 4 archive_remove.inf





See also http://blogs.technet.com/b/pki/archive/2007/02/22/how-to-manually-set-the-archive-flag-for-certifictes.aspx

Error opening SSL protected web sites running on IIS from a Windows XP computer

Recently I have experienced an error accessing a HTTPS web site using Internet Explorer 8. Even this is not the most current setup I thought I should share what happened.

1. A SSL certificate is installed on the Windows Server and is configured in IIS on the default web site or any other web site you have.

2. The client is a Windows XP machine and you use Internet Explorer to access the web site. (The problem does not occur if you use Chrome or Firefox.)

3. The problem: IE reports a "Internet Explorer cannot display the webpage" immediately when you try to access the web site. This is the same message you see if the web site or server does not exist or the DNS name cannot be resolved.

4. Accessing the same web site from Windows 7 using Internet Explorer works with no issues.

So what is wrong?

To investigate the problem I used Fiddler and the information from the server's event log that the browser and the web server could not found a common encryption cipher.
Because the server was just using the default settings I thought it would be good to verify the local machine's certificate store.
So I run a certutil.exe -store my on the server and I found out that the SSL certificate was installed using the Microsoft Strong Cryptographic provider. So I exported it and I have imported it using the certutil.exe -importpfx command to the Microsoft RSA SChannel Cryptographic Provider CSP. After that the access from the XP machines worked again.

btw: Qualys runs a free service with a excellent test drive for SSL web sites (including explanations what and why to configure) at https://www.ssllabs.com/ssltest/

How to transfer binary files through a RDP session

This post can a) help you to transfer binary files to a server over the RDP session or b) it can help you to close a gap in your server hardening procedures.


a)
Transferring a simple text file is just open the file on your local machine and copy&paste to the file on the server. But what if you have a binary file or you need to transfer multiple files which you have packed into a zip container?
All Windows PKI users should know the certutil.exe command line utility. Besides many other functions, it can also encode and decode files from and to base64. Originally this was planned to convert certificates between the base64 format and the binary format. You can also write a powershell script an use the ToBase64String and FromBase64String method. If you are not familiar with powershell you want use certutil.exe what is pre-installed on Windows 7, 2008 R2, Windows 8, Windows 2012.

1. to get your file prepared for the transfer run:

certutil.exe -encode file.zip filezip.txt

2. next, open the filezip.txt with Notepad and mark all and copy it to the clipboard

3. Open Notepad on the server with the same file name

notepad.exe filezip.txt

and paste the content from the clipboard. Save the file.

4. Last step is to convert the file back to binary using certutil again:

certutil.exe -decode filezip.txt file.zip

Now you can extract your files from the file.zip on the server.

According to comments made to this article http://blogs.msdn.com/b/rds/archive/2006/11/20/why-does-my-shared-clipboard-not-work-part-2.aspx
you cannot transfer any size of data through the RDP session. But you can transfer files in slices you have only to split the text file. And don't worry about the ---- BEGIN CERTIFICATE ----- and ----- END CERTIFICATE ----- line in the text file.



b)
To prevent these transfers you must disable the RDP clipboard in the RDP server settings directly or over Group Policy settings. It seems that this is a server-wide setting and cannot be set on a user-base. Well, you lose a lot of convenience in working with the server console but it is more secure.