Category Archives: PKI

The consequence of not renewing ATA certificate in time

Posted on 13 January, 2020 by Tom Aafloen

A customer who uses Microsoft Advanced Threat Analytics (ATA) recently had severe issues with their ATA implementation. At first, the portal started to behave strangely, not showing all information in alerts and some configuration settings were missing. After a restart … Continue reading →

Posted in ATA, Certificates, PKI, SSL | Tagged , | 2 Comments

Get a free publicly trusted certificate using Let’s Encrypt, PowerShell and DNS

Posted on 4 December, 2017 by Tom Aafloen

I have previously blogged about the free publicly trusted certificate solution Let’s Encrypt, see here. In this post, I will show how you can request a certificate with a PowerShell script and prove ownership of the domain name using DNS … Continue reading →

Posted in CA, Certificates, LetsEncrypt, PKI, SAN, SSL | Tagged , , , , , | Leave a comment

Certificate related problems when using a web proxy server

Posted on 27 September, 2017 by Tom Aafloen

I have several times encountered these issues, so it decided it was time to write a blog post about it. The situation You are using a proxy server for web communication. Direct communication to the Internet is blocked. The proxy … Continue reading →

Posted in CA, Certificates, CRL, NDES, PKI, SCEP | Tagged , , , | 4 Comments

SSL Certificates and SAN – What domain names are valid?

Posted on 29 March, 2016 by Tom Aafloen

An SSL certificate has a field called Subject. The Subject field contains the domain name that the certificate is valid for. Subject can only contain one domain name: The field Subject can have more information, like the screenshot below, but … Continue reading →

Posted in Certificates, PKI, SAN, SSL | Tagged , , , | Leave a comment

Get a free publicly trusted SSL-certificate

Posted on 23 March, 2016 by Tom Aafloen

This blog post will guide you through the steps of obtaining a publicly trusted SSL certificate with up to 5 domain names, at no cost. There are no hidden costs, ads or referrals involved. You do need to be able … Continue reading →

Posted in Certificates, PKI | Tagged , , , | 6 Comments

Require SSL on NDES admin site via PowerShell

Posted on 1 February, 2016 by Tom Aafloen

Best Practices from Microsoft when deploying Network Device Enrollment Service (available here) states: “Always set up the administrator site with SSL-only configuration. (Disable http access to this site.)” This is to protect the sensitive One Time Passwords that are transmitted … Continue reading →

Posted in CA, Certificates, NDES, PKI, SCEP | Tagged , , , | 6 Comments

Quick access to the Certificate snap-ins

Posted on 15 May, 2015 by Tom Aafloen

Are you also opening the local certificate snap-ins by first running mmc.exe and then adding the Certificate snap-ins manually? I’ve done that sooo many times that I’ve gotten pretty fast at it. A faster way is to type certmgr.msc for … Continue reading →

Posted in Certificates, PKI | Tagged , , , | Leave a comment

What is the difference between the formats "DER encoded" and "Base64 encoded" when exporting a certificate?

Posted on 6 March, 2014 by Tom Aafloen

I am often asked what the difference between the following certificate export options are: The first option exports the certifcate encoded in the format Distinguished Encoding Rules, which is a binary format. The second option exports the certificate encoded with … Continue reading →

Posted in Certificates, PKI | Tagged , , , , , , , | 6 Comments

Can disabling Delta CRL on a CA cause problems?

Posted on 4 February, 2014 by Tom Aafloen

Imagine that you are using both Base CRL and Delta CRL, but you want to stop using Delta CRL and only use Base CRL going forward. Could this cause any problems in revocation checking if you do not carefully plan … Continue reading →

Posted in CA, CRL, PKI, smart card | Tagged , , , | 2 Comments

Internet Explorer and revocation check failure

Posted on 28 January, 2014 by Tom Aafloen

Internet Explorer normally warns you if the server you visit have any certificate issues. Some examples: The certificate has another Subject than the URL you used to access it: The certificate was issued by a CA that your computer do … Continue reading →

Posted in CA, Certificates, CRL, PKI | 1 Comment