Microsoft - Certificate Authority

TechNet - Active Directory Certificate Services Pagina met links naar de voor AD CS relevante pagina's op TechNet.
TechNet - Certificate Services pagina met links naar een aantal checklists voor installatie en algemene CA informatie.

TechNet - Renewing a certification authority

Microsoft Support - "0x80092013, CRYPT_E_REVOCATION_OFFLINEA" error message when you try to verify a certificate that has multiple chains in Windows Server 2008 R2 or in Windows 7 (KB2615174)

Microsoft Support - Windows root certificate program members
TechNet Blogs » Windows PKI blog » SHA1 Deprecation Policy

Microsoft Learn - How Certificates Work

Blogposts/Articles

TechNet Blogs > An Infrastructure Geek Floating in a Sea of UberCoders > Publishing Delta CRLs on IIS 7
Corelan Team - Windows 2008 PKI / Certificate Authority (AD CS) basics
Wiki > TechNet Articles > Step by Step Guide - Single Tier PKI Hierarchy Deployment (en-US)
BeccaBits - Post Installation Script (Post_Install.bat) Template for Windows Server 2008 R2 Policy CA
TechNet - Windows Server Library - AIA Publishing Properties
TechNet - Windows Server Library - CRL Distribution Point Replacement Token

TechNet Blogs > Windows PKI blog > Basic CRL checking with certutil

Microsoft Learn - Creating Custom Secure LDAP Certificates for Domain Controllers with Auto Renewal

xdot509.blog
xdot509.blog - LDAPS / Domain Controller Certificates

Certificates with RSA key <1024 bits blocked after KB 2661254

TechNet Blogs > Windows PKI blog > RSA keys under 1024 bits are blocked
TechNet Blogs > Windows PKI blog > Blocking RSA Keys less than 1024 bits (part 2)
Security TechCenter > Security Advisories > Microsoft Security Advisory (2661254)
Microsoft Support - Microsoft Security Advisory: Update for minimum certificate key length
System Center: Operations Manager Engineering Blog - IMPORTANT: HP-UX PA-RISC computers monitored by Operations Manager will experience heartbeat and monitoring failures after an upcoming Windows update

NDES/SCEP

Wiki > TechNet Articles > Network Device Enrollment Service (NDES) in Active Directory Certificate Services (AD CS)
TechNet Blogs > Windows PKI blog > Connecting iPads to an Enterprise Wireless 802.1x Network Using Certificates and Network Device Enrollment Services (NDES)
Ask the Directory Services Team - iPad / iPhone Certificate Issuance
Apple Support Communities > iPhone > iPhone in the Enterprise > Discussions - iPhone & certificate enrollment OTA via SCEP

TechNet - Windows Server 2008 - AD CS: Network Device Enrollment Service
TechNet - Windows Server 2008 R2 - Use the Network Device Enrollment Service
Technet - Windows Server 2008 R2 - Configure the Network Device Enrollment Service

Auto-enrollment

Domain Controller certificate auto-enrollment

In short: If an Enterprise CA is available and the Domain Controllers certificate is published (it is by default) Domain Controllers will auto-enroll to the Domain Controllers certificate template, (even) when auto-enrollment is not configured via GPO.

Morgan Simonsen's Blog - Active Directory Domain Controllers and certificate auto-enrollment
The things that are better left unspoken - TODO: Upgrade the Certificates for your Windows Server 2016-based Domain Controllers (and up) to enable Windows Hello for Business Hybrid Scenarios

SAN certificates

The Industry Insiders - Creating Subject Alternative Name Certificates with Microsoft Certificate Server
ARB Security Solutions - Creating Certificates With Dual San Attributes

Notes

Verify certificate

certutil -verify -urlfetch c:\digicert.cer >cert1.txt

Source:TechCenter > Exchange Server 2010 Forums > Exchange Server 2010 > The Certificate Status could not be determined because the revocation check failed

Problem: Submitting a request via the Certification Authority console results in error

Error:

The request contains no certificate template information.
0x80094801 (-2146875391)
Denied by Policy Module 0x80094801, The request does not
contain a certificate template extension or the Certificate Template
request attribute.

Solution: Use the following to request the certificate:

certreq.exe -submit -attrib "CertificateTemplate:WebServer" c:\setup\certificate.req

Then select the CA that should sign the certificate and save the signed certificate somewhere. Source:ExchangeInbox.com - Replacing the Exchange 2007 Self-Signed Certificate (Part 2)

Table of Contents