Table of Contents
PKI
Definitions
- TLS = Transport Layer Security
- Certificate Revocation, published by either of these methods:
- delta CRL
-
- OCSP is RFC-5019
“The Lightweight Online Certificate Status Protocol (OCSP) Profile for High-Volume Environments” - RFC-6960
“X.509 Internet Public Key Infrastructure Online Certificate Status Protocol - OCSP”
4.1. Request Syntax ... The actual formatting of the message could vary, depending on the transport mechanism used (HTTP, SMTP, LDAP, etc.). Appendix A. OCSP over HTTP A.1. Request GET {url}/{url-encoding of base-64 encoding of the DER encoding of the OCSPRequest} An OCSP request using the POST method is constructed as follows: The Content-Type header has the value "application/ocsp-request", ... - Most OCSP responders get their data from published CRLs and are therefore reliant on the publishing frequency of the CA.
- About OCSP Stapling
- AIA = Authority Information Access (defined in RFC-3280)
- PRQP = PKI Resource Query Protocol is similar (in concept) to a 'DNS for PKI resources'
- RFC-3647 Internet X.509 Public Key Infrastructure Certificate Policy and Certification Practices Framework
PEN
- Kazmierczak recommends:
If implementing in organizations, DO use templates OID to differentiate company’s policy objects from default Microsoft policy objects tree. You should request PEN (Private Enterprise Number) from IANA organization (Internet Assigned Numbers Authority). Templates OID should be created with PREFIX (got from IANA) and individually created numbers for template structure. - application (free) → http://pen.iana.org/pen/PenApplication.page
- for example: JDG has these 2:
SMI Network Management Private Enterprise Codes: Prefix: iso.org.dod.internet.private.enterprise (1.3.6.1.4.1) This file is http://www.iana.org/assignments/enterprise-numbers Decimal | Organization | | Contact | | | Email | | | | 23044 SmallBizConcepts BV John de Graaff iana_registration_j&smallbizconcepts.nl 29914 Networkconcepts BV John de Graaff iana.j&networkconcepts.nl # so that is: 1.3.6.1.4.1.23044 = SmallBizConcepts BV 1.3.6.1.4.1.29914 = Networkconcepts BV
Public Trusted Root
- CA/B = CA/Browser Forum
-
- subordinate your Private PKI to one of the commercial Public PKI root certificates that are trusted by Microsoft Windows installations
- Root Signing is implemented in a Qualified Subordination or Cross-Certification This link is external to TechNet Wiki. It will open in a new window. form. This means that your PKI (under an external root) will be eligible to issue certificates only for a set of specified purposes, such as Server/Client Authentication, Code/Document/Email signing and so on. In addition, your CA will be restricted to issue certificates for the domains owned by the trusted organization.
Microsoft Security
- GPO = Group Policy Object
Microsoft IP-HTTPS
 |  |
- MS-IPHTTPS = IP over HTTPS (IP-HTTPS) Tunneling Protocol
- MS-DA is IPv6 in IPsec (Transport mode) in IP-HTTPS
- http://tools.ietf.org/html/rfc1945 Hypertext Transfer Protocol – HTTP/1.0
- http://tools.ietf.org/html/rfc2616 Hypertext Transfer Protocol – HTTP/1.1
- http://tools.ietf.org/html/rfc2818 HTTP Over TLS
- DirectAccess IP-HTTPS in Server 2012 uses Null_encryption to avoid double load
(the encapsulated IPsec does use encryption) - NRPT = Name Resolution Policy Table
MS PKI
- MS supports 2 kinds of PKI:
- Stand-Alone CA
- Enterprise CA
uses: Active Directory Certificate Services (AD CS)
- HSM = Hardware Security Module
- AD CS (PKI) Resources and Migration to 2012 R2
Is it possible to cohabit with an old PKI hierarchy and a new PKI in a same Forest?
“Yes you can have multiple root CAs and even multiple PKIs in a single Active Directory forest. Because of the way the objects are representing those CAs are named and stored, you couldn’t possibly experience a conflict unless you tried to give more than one CA the same CA name.“ - microsoftvirtualacademy.com Windows Server 2012 R2: Implementing a Basic PKI
- CAPolicy.inf Syntax
[Version] Signature= "$Windows NT$" [Certsrv_Server] RenewalKeyLength=4096 RenewalValidityPeriod=Years RenewalValidityPeriodUnits=20 [CRLDistributionPoint] [AuthorityInformationAccess]
- Implement Role-Based Administration (Applies To: Windows Server 2008 R2)
- Certificate Enrollment Web Service Guidance (Applies To: Windows Server 2012 R2, Windows Server 2012)
- Certificate Enrollment Web Services in Active Directory Certificate Services (Applies to Windows Server 2008 R2 and Windows Server 2012)
OCSP
- OCSP → Creating a Revocation Configuration (Applies To: Windows Server 2008 R2)
Microsoft DA
- Microsoft DirectAccess, also known as Unified Remote Access, is a VPN-like technology that provides intranet connectivity to client computers when they are connected to the Internet.
DA-Client connects using one of these IPv6 tunneling protocols: - System Administrator command line shortcuts to popular MMCs
adsiedit.msc = AD SI edit certsrv.msc = Certification Authority Management certmgr.msc = Local Certificates Current User certlm.msc = Local Certificates Local Computer certtmpl.msc = Certificate Templates cluadmin.msc = Cluster Administrator dsa.msc = AD Users and Computers gpedit.msc = Local Group Policy Editor ocsp.msc = Online Responder Configuration mstsc.exe = Remote Desktop Client cluadmin.exe = Cluster Administrator dnsmgmt.msc = DNS Management eventvwr.msc = Event Viewer nlbmgr.exe = Network Load balancing pkiview.msc = PKI Viewer pkmgmt.msc = Public Key Management
C:\Windows\System32>dir *.msc 18-06-2013 17:02 63.081 certlm.msc 18-06-2013 17:02 63.070 certmgr.msc 25-06-2015 13:44 92.853 certsrv.msc 25-06-2015 13:44 145.293 certtmpl.msc 18-06-2013 16:51 147.439 gpedit.msc 25-06-2015 13:44 92.554 ocsp.msc 18-06-2013 17:01 145.519 perfmon.msc 25-06-2015 13:44 144.354 pkiview.msc 18-06-2013 16:47 92.746 services.msc 18-06-2013 17:30 64.923 wbadmin.msc
Windows 8, Server 2012: save screenshot directly to file: - press <Windows> key + <Prt Sc> (Print Screen) - full screen PNG is directly saved to $HOME\Pictures\Screenshots\
- PowerShell.exe = Windows PowerShell
- CSP = Cryptographic Service Provider
is a software library that implements the CAPI (Microsoft CryptoAPI)
CNG = Cryptography API Next Generation
Microsoft Bitlocker
- MBAM = Microsoft BitLocker Administration and Monitoring
- TPM = Trusted Platform Module
- technet Microsoft BitLocker Administration and Monitoring
Microsoft SCCM
Microsoft Failover Clustering & NLB
-
- VMware KB article
- Cisco config example
S/MIME in Office365
- S/MIME = Secure / Multipurpose Internet Mail Extensions
- Microsoft Premum Partner - Advisory Case - Response:
- SST = Serialized Store (keeps properties of MS Cert Store)