Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

We determined that a number of our account lockout issues are related to Activesync devices using old/expired passwords.

One way to remedy an account lockout issue is to issue and deploy certificates to our ActiveSync users. I believe this will give us stronger security with Mutual Auth TLS.

  • Before we implement this, is this a valid solution to the account lockout problem? (Will certificates properly prevent premature account lockouts?)

  • Do the devices (Windows Phone, Blackberry, iPhone, etc) all use a CRL or OCSP as expected or are there issues I should avoid?

  • Are there any best practices I should adopt?

share|improve this question

1 Answer 1

This page seems to indicate that when client certificates are used, then clients are authenticated by the certificate only, with no reference to any password (just like what is done with smart card logon). No password implies no failed password entry, thus no password-related lockout. Of course, as with all things Microsoft, this requires some thorough testing.

Whether devices will properly download CRL or OCSP responses depends on these devices, and personally I doubt they will. Note, though, that the device authenticates the server certificate; validation of the client certificate happens on the server, so that's the server which should download CRL or OCSP responses when client certificates are used. Microsoft's software tends to do revocation checks more or less properly (i.e. they reject the connection when the CRL cannot be obtained).

My cynical part tells me that the best practice with PKI is probably to run away as quickly as possible when X.509 certificates are talked about. It is known that maintaining a PKI is a lot of work. Microsoft's PKI (Active Directory Certificate Services) does a lot of things automatically and works best when all the involved systems are part of the same Domain as the CA.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.