I'm in the middle of writing an MS Active Directory Certificate Services Key Management Lifecycle document for my organization. The primary purpose certificates will serve for this organization is to generate TLS certificates for IIS web servers.

I'm using NIST 800-57/NIST 800-52 as standards against which to base this process document. When it comes to the Destroyed State for the private key, I want to document how an auditor can check and verify that a revoked certificate's private key has been "destroyed" (or deleted) based on Windows/IIS) event or security logs.

I have no clue where to find such an event or security log. Can anyone point me in the right direction?

Short version: How might an auditor validate that a web server's SSL/TLS Certifiate's corresponding private key has been deleted from a Windows IIS security/audit logs?

  • Sounds like a use case for an HSM? – StackzOfZtuff Nov 26 '15 at 7:41
  • Technically, yes, but in practice, few organizations are going to shell out the money on an HSM for certificates issued to subscribers. They're priced to mainly service the CA's (Root & Issuing) private keys. What I'm talking about is a way to validate after-the-fact that a revoked SSL certificate's private key has been deleted. Perhaps the answer is simply that revocation is all you need; but NIST reccommends a way to verify the corresponding private key has been "Destroyed". (SP 800-57 Part I, 7.2, "Transition 5", pg 87). Is there a way to do that in IIS or Windows server logs? – Daniel Nov 30 '15 at 15:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.