As part of my forensics, I want to determine if a given certificate has any indicator of which PKI software was used to create it.
So far, I see differences in the following properties for a Certificate Authority:
- Serial Number (format, length, is ( not) random)
- Issuer value (may align with internal AD forest name in MSFT)
- Presence of "Certificate Template Information" (MSFT)
- CRL Distribution Point contains a server name
- Subject contains "DC = " (MSFT) versus other properties such as
Cpresent in Google.com
I'm sure there are comparable differences in end entity certificates, and CRL/CRL Dif certificates.
Is there any resource that investigates the differences between the certificate output from various CA's (or makecert.exe for that matter)?
Is there any byte level fingerprinting within a certificate? (or is everything exposed via a certificate export?