Writing /var/www/html/john.de-graaff.net/webroot/wiki/data/cache/d/d897cc938dded44ebee64b7b72126528.xhtml failed

PKI

tags: PKI, RSA, X509, SSL, HTTPS, Encryption, Digital Signatures, CA
tls
ipv6

Definitions

PKI = Public Key Infrastructure
Public Key Cryptography
Digital Signature
Public Key Certificate
X.509
TLS = Transport Layer Security
Certificate Revocation, published by either of these methods:
- CRL = Certificate Revocation List
- delta CRL
- OCSP (Online Certificate Status Protocol)
  - OCSP is RFC-5019
    “The Lightweight Online Certificate Status Protocol (OCSP) Profile for High-Volume Environments”
  - RFC-6960
    “X.509 Internet Public Key Infrastructure Online Certificate Status Protocol - OCSP”
```
4.1.  Request Syntax
... The actual formatting of the message could vary, depending
on the transport mechanism used (HTTP, SMTP, LDAP, etc.).
Appendix A.  OCSP over HTTP
A.1.  Request
GET {url}/{url-encoding of base-64 encoding of the DER encoding of
   the OCSPRequest}
An OCSP request using the POST method is constructed as follows: The
   Content-Type header has the value "application/ocsp-request", ...
```
  - Most OCSP responders get their data from published CRLs and are therefore reliant on the publishing frequency of the CA.
  - About OCSP Stapling
AIA = Authority Information Access (defined in RFC-3280)
PRQP = PKI Resource Query Protocol is similar (in concept) to a 'DNS for PKI resources'
RFC-3647 Internet X.509 Public Key Infrastructure Certificate Policy and Certification Practices Framework

PEN

Kazmierczak recommends:
If implementing in organizations, DO use templates OID to differentiate company’s policy objects from default Microsoft policy objects tree. You should request PEN (Private Enterprise Number) from IANA organization (Internet Assigned Numbers Authority). Templates OID should be created with PREFIX (got from IANA) and individually created numbers for template structure.
PEN = Private Enterprise Numbers
application (free) → http://pen.iana.org/pen/PenApplication.page
list → http://www.iana.org/assignments/enterprise-numbers

for example: JDG has these 2:

SMI Network Management Private Enterprise Codes:
Prefix: iso.org.dod.internet.private.enterprise (1.3.6.1.4.1)
This file is http://www.iana.org/assignments/enterprise-numbers
Decimal
| Organization
| | Contact
| | | Email
| | | |
23044
  SmallBizConcepts BV
    John de Graaff
      iana_registration_j&smallbizconcepts.nl
29914
  Networkconcepts BV
    John de Graaff
      iana.j&networkconcepts.nl

# so that is:
1.3.6.1.4.1.23044 = SmallBizConcepts BV
1.3.6.1.4.1.29914 = Networkconcepts BV

Public Trusted Root

CA/B = CA/Browser Forum
https://cabforum.org
https://www.sslcertificaten.nl/support/Terminologie/CAB_Forum
Certification Authority Root Signing
- subordinate your Private PKI to one of the commercial Public PKI root certificates that are trusted by Microsoft Windows installations
- Root Signing is implemented in a Qualified Subordination or Cross-Certification This link is external to TechNet Wiki. It will open in a new window. form. This means that your PKI (under an external root) will be eligible to issue certificates only for a set of specified purposes, such as Server/Client Authentication, Code/Document/Email signing and so on. In addition, your CA will be restricted to issue certificates for the domains owned by the trusted organization.
Planning and Implementing Cross-Certification and Qualified Subordination Using Windows Server 2003

Microsoft Security

CIS = Center for Internet Security
GPO = Group Policy Object
ISATAP = Intra-Site Automatic Tunnel Addressing Protocol

Microsoft IP-HTTPS

MS-IPHTTPS = IP over HTTPS (IP-HTTPS) Tunneling Protocol
MS-DA is IPv6 in IPsec (Transport mode) in IP-HTTPS
http://tools.ietf.org/html/rfc1945 Hypertext Transfer Protocol – HTTP/1.0
http://tools.ietf.org/html/rfc2616 Hypertext Transfer Protocol – HTTP/1.1
http://tools.ietf.org/html/rfc2818 HTTP Over TLS
SSTP = Secure Socket Tunneling Protocol
DirectAccess IP-HTTPS in Server 2012 uses Null_encryption to avoid double load
(the encapsulated IPsec does use encryption)
AuthIP is a Microsoft auth extension for IPsec, similar to IKEv2
NRPT = Name Resolution Policy Table
Cross Certification
MS Jet Database Engine
if the local LAN only talks IPv4 (and the DA clients talk IPv6) the DA server translates using: DNS64 en NAT64

MS PKI

MS supports 2 kinds of PKI:
- Stand-Alone CA
- Enterprise CA
  uses: Active Directory Certificate Services (AD CS)
Active Directory Certificate Services (AD CS) Clustering
Active Directory Certificate Services (AD CS) Public Key Infrastructure (PKI) Design Guide
HSM = Hardware Security Module
AD CS (PKI) Resources and Migration to 2012 R2
Is it possible to cohabit with an old PKI hierarchy and a new PKI in a same Forest?
“Yes you can have multiple root CAs and even multiple PKIs in a single Active Directory forest. Because of the way the objects are representing those CAs are named and stored, you couldn’t possibly experience a conflict unless you tried to give more than one CA the same CA name.“
Win2012R2 AD CS Migrating the Certification Authority
A Complete Guide on Active Directory Certificate Services in Windows Server 2008 R2
Certification Authority Guidance
microsoftvirtualacademy.com Windows Server 2012 R2: Implementing a Basic PKI

CAPolicy.inf Syntax

[Version]
Signature= "$Windows NT$"
[Certsrv_Server]
RenewalKeyLength=4096
RenewalValidityPeriod=Years
RenewalValidityPeriodUnits=20
[CRLDistributionPoint]
[AuthorityInformationAccess]

The DOs and DON’Ts of PKI – Microsoft ADCS
Windows Server 2008 R2 CAPolicy.inf Syntax
Administer a Certification Authority
Can a single ADCS instance “hold” more than one PKI namespace?
https://www.manageengine.com/products/active-directory-audit/
Implement Role-Based Administration (Applies To: Windows Server 2008 R2)
Certificate Enrollment Web Service Guidance (Applies To: Windows Server 2012 R2, Windows Server 2012)
Certificate Enrollment Web Services in Active Directory Certificate Services (Applies to Windows Server 2008 R2 and Windows Server 2012)
Troubleshooting Certificate Status and Revocation
Establish Restricted Enrollment Agents
Requesting Offline Domain Controller Certificates (Advanced Certificate Enrollment and Management)
AD CS: Web Enrollment

OCSP

Microsoft DA

Microsoft DirectAccess, also known as Unified Remote Access, is a VPN-like technology that provides intranet connectivity to client computers when they are connected to the Internet.
DA-Client connects using one of these IPv6 tunneling protocols:
- 6to4 (IP protocol 41)
- Teredo (UDP/3544)
- IP-HTTPS (TCP/443)
Windows Server 2012 R2 and Windows Server 2012
Stapsgewijze handleiding bij Active Directory Certificate Services voor Windows Server
how to install certificate authority on windows server 2012
DirectAccess Technical Overview for Windows 7 and Windows Server 2008 R2
What's new in DirectAccess in Windows Server 2012 R2 and Windows Server 2012
DirectAccess Design Guide
Auto-Enrollment - Avoid the challenges of making end users manage their certificates

System Administrator command line shortcuts to popular MMCs

adsiedit.msc = AD SI edit
certsrv.msc  = Certification Authority Management
certmgr.msc  = Local Certificates Current User
certlm.msc   = Local Certificates Local Computer
certtmpl.msc = Certificate Templates
cluadmin.msc = Cluster Administrator
dsa.msc      = AD Users and Computers
gpedit.msc   = Local Group Policy Editor
ocsp.msc     = Online Responder Configuration

mstsc.exe    = Remote Desktop Client
cluadmin.exe = Cluster Administrator

dnsmgmt.msc  = DNS Management
eventvwr.msc = Event Viewer
nlbmgr.exe   = Network Load balancing
pkiview.msc  = PKI Viewer
pkmgmt.msc   = Public Key Management

C:\Windows\System32>dir *.msc
18-06-2013  17:02            63.081 certlm.msc
18-06-2013  17:02            63.070 certmgr.msc
25-06-2015  13:44            92.853 certsrv.msc
25-06-2015  13:44           145.293 certtmpl.msc
18-06-2013  16:51           147.439 gpedit.msc
25-06-2015  13:44            92.554 ocsp.msc
18-06-2013  17:01           145.519 perfmon.msc
25-06-2015  13:44           144.354 pkiview.msc
18-06-2013  16:47            92.746 services.msc
18-06-2013  17:30            64.923 wbadmin.msc

Windows 8, Server 2012: save screenshot directly to file:
- press <Windows> key + <Prt Sc> (Print Screen)
- full screen PNG is directly saved to $HOME\Pictures\Screenshots\

MMC = Microsoft Management Console
PowerShell.exe = Windows PowerShell
CSP = Cryptographic Service Provider
is a software library that implements the CAPI (Microsoft CryptoAPI)
CNG = Cryptography API Next Generation
How to Configure DirectAccess in Windows Server 2012 to Work with an External Hardware Load Balancer
DirectAccess Troubleshooting Tool

Microsoft Bitlocker

MBAM = Microsoft BitLocker Administration and Monitoring
BitLocker
TPM = Trusted Platform Module
technet Microsoft BitLocker Administration and Monitoring
Microsoft BitLocker Administration and Monitoring 2 Administrator's Guide
BitLocker Drive Encryption Overview
BitLocker Drive Encryption Technical Overview
MBAM and Secure Network Communication
BitLocker, MBAM and Data Recovery Agents (DRA)
http://www.pcworld.com/article/2013621/what-you-should-know-about-microsoft-bitlocker-administration-and-management-mbam-2-0.html
http://www.css-security.com/blog/mbam-real-world-information/

Microsoft SCCM

SCCM = System Center Configuration Manager

Microsoft Failover Clustering & NLB

S/MIME in Office365

S/MIME = Secure / Multipurpose Internet Mail Extensions
Microsoft Premum Partner - Advisory Case - Response:
SST = Serialized Store (keeps properties of MS Cert Store)
Various SSL/TLS Certificate File Types/Extensions
What is Azure Active Directory?
https://azure.microsoft.com/
Microsoft Azure
How to prevent Outlook 2010 from publishing certificates to userSMIMEcertificate

Website van John de Graaff

Sidebar

Info

Links

Table of Contents

PKI

Definitions

PEN

Public Trusted Root

Microsoft Security

Microsoft IP-HTTPS

MS PKI

OCSP

Microsoft DA

Microsoft Bitlocker

Microsoft SCCM

Microsoft Failover Clustering & NLB

S/MIME in Office365

Website van John de Graaff

User Tools

Site Tools

Sidebar

Info

Links

Table of Contents

PKI

Definitions

PEN

Public Trusted Root

Microsoft Security

Microsoft IP-HTTPS

MS PKI

OCSP

Microsoft DA

Microsoft Bitlocker

Microsoft SCCM

Microsoft Failover Clustering & NLB

S/MIME in Office365

Page Tools