3
votes
2answers
425 views

Possible to use a YubiKey in HSM mode to secure a Windows CA infrastructure?

I'm looking for a low-cost Hardware Security module, and discovered that YubiKey has a HSM mode. I'm not entirely clear if this HSM mode is what I'm thinking, but I'd like to use it as the offline ...
1
vote
1answer
721 views

How does a developer interact with Microsoft Certificate *Web Services*

Microsoft Certificate Web Services is a HTTPS web service (WS-Trust) that has no Kerberos dependency and can be used on a variety of devices. This is new in Windows 2008 and is separate from the ...
2
votes
3answers
2k views

Making a Windows cert say it's purpose is “Ensures the identity of a remote computer”

Maybe this is a superuser.com question, I don't know. Anyway, I want my cert to show up like this when I double click on it in Windows: If I just double click on a random cert I get this: The ...
3
votes
4answers
9k views

how to import a private key in windows

Say I have an X.509 cert and a private key that corresponds to it. I can import X.509 certs easily enough into Windows but what about private keys? Is the only way I can do that by converting both ...
4
votes
1answer
2k views

AIA/CRL locations for Offline Root

I've read the answer to the following "Checklist on building an Offline Root & Intermediate Certificate Authority (CA)" and I have one questions based on the system I am trying building It's an ...
2
votes
1answer
120 views

Which .CER file format is more secure for purposes of an AIA record?

What file format is most appropriate or secure for the AIA record in a PKI certificate? The options I'm aware of are: DER encoded binary X.509 (.cer) Base-64 encoded X.509 (.cer) I also have the ...
3
votes
2answers
426 views

Mitigations for Windows clients that don't support OCSP Nonces

Windows 7 clients (and older) don't support NONCES, a key feature used in securing the revocation check. Without a NONCE a MITM could replay a previously signed response and alter the validation of ...
5
votes
1answer
8k views

What is updated with “Update Root Certificates” enabled? What is the equivalent in Windows 2008R2?

What root certificates are/are not updated when the following checkbox is checked? Additional questions If I manually remove a root certificate, will this service replace that very certificate? ...
2
votes
1answer
3k views

Clearing IE temp files don't erase CRL history. How can this be purged?

Even after I purge all my Internet temporary files, I still see information when I type certutil -urlcache How do I purge this information?
2
votes
3answers
990 views

What is the most secure way to do OCSP signing without creating validation loops?

I'd like to enable the most secure OCSP validation that Windows 2008 SP1 and newer support. Based on the following information, am I required to implement id-pkix-ocsp-nocheck on my OCSP ...
2
votes
1answer
845 views

What are attribute certificates? Why would someone partition a certificate by reason codes?

In "How Certificate Revocation Works" a brief mention of Attribute Certificate and Reason Code partition is made: If validated by a client that supports partitioned and indirect CRLs, the IDP ...
4
votes
1answer
1k views

Can a certificate have multiple chains and multiple self-signed roots?

The following MSFT document has this paragraph: All possible certificate chains are built using locally cached certificates. If none of the certificate chains ends in a self-signed ...
1
vote
1answer
3k views

What are the OIDs (KU and EKU) necessary for Smart Card Authentication in Windows?

MSFT smart card authentication is listed in PKINIT RFC 4556 however I don't see any OIDs listed. Based on this and this KB article the EKU section of the certificate should contain "Client ...
11
votes
3answers
8k views

Checklist on building an Offline Root & Intermediate Certificate Authority (CA)

Microsoft allows a CA to use Cryptography Next Generation (CNG) and advises of incompatibility issues for clients that do not support this suite. Here is an image of the default cryptography settings ...