1

When setting up Smart card authentication you publish that Intermediate/Sub CA to the NTAuthCertificates object in Active Directory and certificates from that CA will now be OK for certificate authentication. I am wondering if this is the ONLY certificate authority that the active directory trusts OR if the ROOT CA's specified in Certification Authorities Container ALSO can be used to validate a certificate. Consider this.

I am deploying a Sub CA called SUBCA1 in the NTAuthCertificates which is signed by my ROOT CA called ROOTCA1. My private key for the ROOTCA1 is compromised and the attacker now has the ability to forge a user certificate based upon ROOTCA1. So in this scenario will the fact that I have only published the SUBCA1 to the active directory protect me?

I know you should have a routine implemented for when a Root CA is compromised etc etc but this is totally hypothetical.

This page explains the different containers but I am curious if there is anything behind the scenes that maybe will accept a user certificate signed by the ROOTCA1. https://blogs.technet.microsoft.com/pki/2011/02/28/quick-check-on-adcs-health-using-enterprise-pki-tool-pkiview/

Improve this question

1 Answer 1

Reset to default
0

Certificate-based authentication in Windows require at a minimum:

  • authentication certificate's chain ends with a trusted root CA
  • issuing CA certificate must be installed in the NTAuth DS store.
  • revocation information is up to date for every certificate in the chain (except root CA, of course).

So, if root CA is compromised, only first requirement is met. There is no way to forge an already existing issuing CA certificate with the same public key. Certificates in NTAuth DS store are compared with exact match. This means that if root CA certificate is not installed in the DS store, it cannot be used to issue authentication certificates. Even if attacker attempts to do so, they won't work, because root CA certificate (as issuer of rogue authentication certificates) is not installed in the NTAuth DS store.

In order to craft legitimate authentication certificates, an attacker must compromise the CA which certificate is installed in the NTAuth store.

Improve this answer
3
  • Does not quite answer my question if active directory only trusts certificates in the NTAuth container or if I would issue a USER certificate for logon directly from the root CA active directory will accept it. I know it probably should not work like that but after a few years I would not be surprised.
    – user2782999
    Commented Jan 22, 2019 at 17:15
  • I believe, you need to read my answer carefully, because it certainly answers your question.
    – Crypt32
    Commented Jan 22, 2019 at 17:59
  • Sorry you are definitely correct
    – user2782999
    Commented Jan 22, 2019 at 18:00

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .