Spat's WebLog (Steve Patrick) : Crypto

Just a quick post on IIS7 cert mapping setup

SpatDSG — Mon, 30 Nov 2009 15:41:00 GMT

Install the role service under IIS At the Server level - enable DS mapping under authentication: Create the web site. Enable it for HTTPS ( bindings ) Set the site to require certs under: Enable the site : C:\Windows\SysWOW64\inetsrv> appcmd unlock...(read more)

Cool new features in 2k8 R2 for Certificate Services

SpatDSG — Thu, 17 Sep 2009 17:36:00 GMT

I really dont like posting about another post.. but its too cool not to in this case :) There are some really awesome new features for Cert Services in 2k8 R2.. check it out in the Certificate Enrollment Web Services Whitepaper Original post: http://blogs.technet.com/pki/archive/2009/09/15/certificate-enrollment-web-services-whitepaper.aspx...(read more)

Joining a domain via Smartcards

SpatDSG — Wed, 10 Dec 2008 18:35:00 GMT

http://technet.microsoft.com/en-us/library/cc721959.aspx undefined A snip from the article: Smart card root certificate requirements for use when joining a domain When using a smart card to join a domain, the smart card certificate must comply with one...(read more)

Honey, I lost the (private) keys -- EFS keys missing?

SpatDSG — Mon, 20 Oct 2008 17:40:00 GMT

Interesting EFS issue the other day.. Customer was rolling out EFS so they set up DRA's and this worked great. When they encrypted files the DRA's showed up just fine in the file information. However, when they went to decrypt a file via the assigned...(read more)

Get Serial number, expiry date, subject name and subject alternative names in script

SpatDSG — Thu, 31 Jul 2008 18:12:00 GMT

The question was something like this: ..."What I need to be able to do is iterate through each certificate in the Local Machine’s Personal store and spit out at least the serial number, expiry date, subject name and subject alternative names." Here is...(read more)

How to use Certificate Services Web enrollment pages together with Windows Vista or Windows Server 2008

SpatDSG — Wed, 02 Apr 2008 22:45:00 GMT

Wheww!! we finally have the matrix for what works, what doesnt and how to fix it :) http://support.microsoft.com/kb/922706/en-us SUMMARY loadTOCNode(1, 'summary'); The Windows Server 2003 Certificate Services Web enrollment functionality relies on an...(read more)

EFS failures after upgrade to 2008

SpatDSG — Mon, 18 Feb 2008 18:31:00 GMT

FYI .. ( havent had time to finish the kerb posts.. but here is an important FYI ) http://www.microsoft.com/downloads/details.aspx?FamilyID=fd786261-d278-40db-baf8-70f42d786223&displaylang=en Overview When a user encrypts a file stored on a Windows...(read more)

Putting CAPI2 logging to good use...

SpatDSG — Wed, 08 Aug 2007 17:20:00 GMT

So there was a problem with a printer which you could connect to via SSL in order to print via IPP.

You go in and configure the printer via a web page like so:

Create New Self-Signed Certificate
Create a new self-signed certificate. Warning: This operation will overwrite the currently installed certificate with a new self-signed certificate.

Create Certificate Request
Create the Certificate Request that you will give to a Certificate Authority. The Certificate Request will be used to generate a certificate for you.

Import Certificate and Private Key
Import a certificate and private key to use as the Jetdirect certificate. (Note: This will overwrite the current Jetdirect certificate and private key.

Export Certificate
Export the Jetdirect certificate and private key.

The server was configured for “Create New Self-Signed Certificate “ However, Vista would fail to connect to the server. We would connect to https://10.10.10.34 and Vista fails with an error:

"Windows cannot connect to the printer. Make sure that you have typed the name correctly, and that the printer is connected to network."

BTW - you know you can ctrl+c when those popup boxes are there and capture the info in them right?

So – why did XP work OK but Vista failed..

Let’s start with some CAPI logging… which I discussed back on march 13 , ’07 -- http://blogs.msdn.com/spatdsg/archive/2007/03/13/troubleshooting-pki-problems-on-windows-vista.aspx

The first entry to take note of is this one – spoolsv.exe is the process which is doing a trust verification check

Log Name: Microsoft-Windows-CAPI2/Operational

Source: Microsoft-Windows-CAPI2

Date: 8/6/2007 6:40:34 PM

Event ID: 80

Task Category: Verify Trust

Level: Information

Keywords: Trust Verification

User: CRISCO1\administrator

Computer: VistaCrisco.crisco.com

Description:

<EventAuxInfo ProcessName="spoolsv.exe" />

</WinVerifyTrustStart>

</UserData>

Then we can clearly see that the certificate is not trusted by the Vista machine we are trying to connect with.

Log Name: Microsoft-Windows-CAPI2/Operational

Source: Microsoft-Windows-CAPI2

Date: 8/6/2007 6:40:35 PM

Event ID: 11

Task Category: Build Chain

Level: Error

Keywords: Path Discovery,Path Validation

User: CRISCO1\administrator

Computer: VistaCrisco.crisco.com

Description:

For more details for this event, please refer to the "Details" section

Event Xml:

</AdditionalStore>

</ExtendedKeyUsage>

</TrustStatus>

</TrustStatus>

</ApplicationUsage>

</ChainElement>

</CertificateChain>

<Result value="800B0109">A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider.</Result>

</CertGetCertificateChain>

There was an option to export the cert from the printer so we do that and import it into the Vista machine trusted root store.

Try again…. Ahh a new error – Ill just paste the relevant section from the CAPI2 logs.

<StateAction value="0">WTD_STATEACTION_IGNORE</StateAction>

<CertificateInfo displayName="10.10.10.34" />

<Result value="800B010F">The certificate's CN name does not match the passed value.</Result>

</WinVerifyTrust>

</UserData>

</Event>

Hrmm this one is a little more difficult.

The printer automatically creates a name like:

Subject:

OU=J7961G

OU=00110AF8ACE8

O=Hewlett-Packard Co.

CN=HP Jetdirect 0AF8ACE8

And we don’t like the name? The error is : The certificate's CN name does not match the passed value.

What does that mean?

It means that the passed value https://10.10.10.34 did not match the CN….

It does a check in crypt32.dll for the “server name” ( 10.10.10.34 ) against the CN (HP Jetdirect 0AF8ACE8 ) and fails if they are not the same.

We cannot simply connect to https://HP Jetdirect 0AF8ACE8 as it is not a proper FQDN.

So now we know we can’t get around this and change these check. How to configure this then?

The easiest way to workaround it is to generate a self signed cert which does have the proper names we can connect to.

Per the printer config page we could submit a request to a CA – but if we don’t have one then the procedure outlined below is the next best option..

Get a copy of makecert.exe ( its in the free download Platform SDK )

· Run it like so in order to create a self signed cert which has an exportable key and the proper subject.

makecert.exe -r -pe -n "CN=10.10.10.34" -b 07/01/2007 -e 07/01/2010 -eku 1.3.6.1.5.5.7.3.1 -ss My printer.cer

· The switches to make this work are the:

· –pe switch ( allow the keys to be exportable )

· -r self signed

· -eku – specify Server Auth OID

· You will see a new file called printer.cer

C:\Program Files\Microsoft SDKs\Windows\v6.0\Bin>dir prin*

Volume in drive C has no label.

Volume Serial Number is 108D-3591

Directory of C:\Program Files\Microsoft SDKs\Windows\v6.0\Bin

07/31/2007 10:16 AM 542 printer.cer

1 File(s) 542 bytes

0 Dir(s) 3,574,562,816 bytes free

· Now looking in your personal store via certmgr.msc you should see a cert in there with the Issued by field as “CN = 10.10.10.34”

· Right click on this cert, and export this and include the private keys.

· Now, go to the printer management web page and import the .PFX file you just exported.

· Also take the file called printer.cer – and import it to the trusted root store on the Vista machine.

You should now be able to connect OK.

Takeaways:

CAPI2 logging is very very helpful – check it out before you jump to conclusions – it may be more helpful than you realize.

Spatdsg

Is there any debug logs or tracing logs can help us to monitor certificate importing or EFS decrypting?

SpatDSG — Tue, 07 Aug 2007 17:39:00 GMT

This is a recent question I saw ...

You can track detailed EFS events such as EFS decrypt\encrypt and EFS engine cert enrollment via the EFS debug logging in Vista.

In addition – Vista has new DPAPI logging for auditing its usage ( DPAPI is what EFS uses to protect its keys so you should see some data for a key import \export ) you can enable this via the method outlined here:

http://blogs.msdn.com/spatdsg/archive/2007/05/11/New-Auditing-in-Vista.aspx

Here is the EFS debug logging….

Enable advanced EFS logging via the eventvwr -- ( click on "enable log" )

Tests I ran…nothing super technical so I am not 100% sure of when and where we log it all in the grand scheme of things, play with it some if you want a specific event flowchart.

Encrypt a file when there is no EFS key – it automatically got one from the Ent CA in my domain:

Event posted:

Log Name: Microsoft-Windows-EFS/Debug

Source: Microsoft-Windows-EFS

Date: 8/6/2007 1:56:30 PM

Event ID: 260

Task Category: None

Level: Information

Keywords:

User: CRISCO1\administrator

Computer: VistaCrisco.crisco.com

Description:

1.3634: Attempt to create a new EFS key

Log Name: Microsoft-Windows-EFS/Debug

Source: Microsoft-Windows-EFS

Date: 8/6/2007 1:56:36 PM

Event ID: 256

Task Category: None

Level: Information

Keywords:

User: CRISCO1\administrator

Computer: VistaCrisco.crisco.com

Description:

EFS key promoted from current key. CertValidated: 2, cbHash: 20, pbHash: E2 B3 9B 13 ED C6 4D 2B D6 17 8D 68 63 FE 89 48 1A 37 E3 83, ContainerName: d7bbcfe2c68036677fc606f5309b0453_79f3ab01-e697-496e-afe2-672634d9bf6a, ProviderName: Microsoft Enhanced Cryptographic Provider v1.0, DisplayInformation: Administrator(administrator@crisco.com), dwCapabilities: EKU_EFS KU_GOOD_FOR_EFS KEYSPEC_EXCHANGE MASTERKEY RSA_ENCRYPT IS_TIME_VALID KEY_LARGE_ENOUGH , bIsCurrentKey: TRUE, eKeyType: RSA KEY

For an encrypt \ decrypt operation we seem to log the following so the two event highlighted look to be a promising identifier.

4.11824: attempting to validate EFS stream

4.11926: EFS stream validated

Good luck to you…

spatdsg

Notify users of cert expiration...

SpatDSG — Thu, 19 Jul 2007 17:42:00 GMT

A recent mail thread was asking about querying for cert about to expire and notifying the users of this.

You could do it a few ways.. Run some kind of svc\logon script etc.. on the clients - which tracked the stores and cert data. Query the CA DB directly for certs about to expire.

I thought it’d be easiest to get the information directly from the CA. You can use the ICertView2 interface ---- specifically, EnumCertViewColumn.

You can obtain the DB schema info via “certutil –view” then play with the GetColumnIndex call below…

I ended up with something like this - - its not quite finished as you can see, error checks and mail function - but thats easy enough. The less documented part is already done and you can build off of that.

have fun!

spatdsg

Const CV_OUT_BASE64 = &H1

'THIS IS THE <Machinename>\CAName
CAName = "MyMachine\SpatCA" '=======>> CHANGE THIS TO THE CORRECT MACHINE\CA==

'create the CAView object
set oCAView = CreateObject("CertificateAuthority.View.1")

'open the connection to the Machine\CA
oCAView.OpenConnection (CAName)

'retrieve specific columns from DB
oCAView.SetResultColumnCount(3)
Index0 = oCAView.GetColumnIndex(False, "CommonName")
Index1 = oCAView.GetColumnIndex(False, "Email")

Index2 = oCAView.GetColumnIndex(False, "NotAfter")

oCAView.SetResultColumn (Index0)
oCAView.SetResultColumn (Index1)

oCAView.SetResultColumn (Index2)

'open the view

Set RowObj= oCAView.OpenView

Do Until RowObj.Next = -1

Set ColObj = RowObj.EnumCertViewColumn()

Do Until ColObj.Next = -1

wscript.echo ColObj.GetValue(CV_OUT_BASE64) & vbcrlf
'insert logic for checking date to

'current and if near\past send mail.

'see http://www.paulsadowski.com/WSH/cdo.htm

'for a number of examples of mail send info

'Obviously you may want to use the cert email

'attribute to send the mail

Loop

Set ColObj = Nothing

Loop

Credential Roaming hotfix...

SpatDSG — Tue, 19 Jun 2007 19:33:00 GMT

Just a slight detour from our debugging stuff for some new info on credential roaming\DIMS ...

http://support.microsoft.com/?id=934797

The size of the Ntds.dit file on the domain controller grows continually larger after you enable the "Credential Roaming" feature for Windows Vista-based client computers in the domain

Well now, that can't be good can it. If you use cred roaming for Vista clients - better get this on there.

spatdsg

EFS and Vista... and XP

SpatDSG — Thu, 07 Jun 2007 17:10:00 GMT

I just wanted to make sure folks realized that Vista and XP EFS files aren't exactly compatible...

Here was a snip from a recent question:

" I’m asking this question on behalf of another colleague. He’s having problems accessing encrypted files on a removable HDD in XP. He encrypted the folder and files in Vista and backed up the certificate. Now he’s attached the HDD to an XP machine and copied the certificate over but he can’t access the encrypted files and folders. When he tried it on another Vista machine, he can access it. Is there a difference in the EFS structure in Vista and XP that’s preventing this?"

They both use AES256 but in the Vista case the $EFS stream has changed and is not supported on downlevel OS's...

See http://www.microsoft.com/technet/prodtechnol/windows2000serv/reskit/distrib/dsck_efs_duwf.mspx?mfr=true for more info on the internals for EFS.

Creating a New File with Encryption Enabled

There are two ways to create a file that has encryption already enabled. One method is to use Windows Explorer to create a file inside an encrypted folder. For example, in Windows Explorer, you can click an encrypted folder and then, on the File menu, point to New , and then click Rich Text Document . A second method is available to applications when they call the CreateFile() API with the file encryption flag, FILE_ATTRIBUTE_ENCRYPTED. Depending on which way you do it, NTFS checks the encryption status of the parent folder or of the flag passed in. If NTFS finds that the file must be created as encrypted, it calls the EFS FSRTL, which requests the EFS service to generate the metadata (FEK, DDF, and DRF) for the file object. The EFS service acquires the metadata from CryptoAPI and returns it by means of the EFS FSRTL to the EFS driver.

When the EFS service returns the metadata, the EFS driver sets up an EFS context for the file object and creates a $EFS stream of data containing the metadata. As the user writes data in the file, NTFS calls the FSRTL to encrypt the data.

Encrypting an Existing Plaintext File

Changing a file from plaintext to encrypted (by selecting the Encrypt contents check box in the Advanced Attributes dialog box) calls EncryptFile(). This API creates a backup copy of the file and requests the FEK, DRF, and DDF from the EFS service. The API then passes this metadata to the FSRTL by way of NTFS. The FSRTL sets up an EFS context for the file object and creates a $EFS stream with DDF, DRF, and so forth, for that object. EncryptFile() then reads the data from the backup and writes the data to the file. During the write, NTFS calls the FSRTL to encrypt the data before writing. When the writing is complete, the backup file is automatically deleted.

How Data Is Read and Written in Encrypted Files

Users do not need to decrypt files or folders during normal operations because EFS provides transparent encryption and decryption during data writes and reads. When you open the encrypted file, your private key (from your protected store in your user profile) is applied to the DDF to unlock the FEK, and the file contents appear on-screen in plaintext. EFS automatically detects an encrypted file and locates a user certificate and associated private key in the certificate and key stores.

Opening an encrypted file calls CreateFile(). NTFS checks the file on the disk to determine its encryption status, then calls the EFS service to verify the user. The EFS service finds the user's certificate and private key, and requests CryptoAPI to use the private key to decrypt the FEK. The EFS service then returns the FEK by way of the FSRTL to the EFS driver. If the user password or recovery agent information has changed, the EFS service requests a new DDF or DRF from CryptoAPI, as required, and returns it with the FEK to replace the old metadata.

When the EFS service returns the metadata, the EFS driver sets up an EFS context for the file object and creates a $EFS stream containing the metadata. The FEK decrypts the file so that it appears in plaintext on the screen.

As the user writes data in the file, NTFS calls the EFS FSRTL to encrypt the data.

If another user tries to open the file, access is denied. No one else can decrypt the file without the encryptor's private key or a private key for recovery. This is true even if administrators change permissions or file attributes, or file ownership is shared.

PS - looks like this may be fixed in Vista SP1 ....

[update april2 2008] guess not -- see http://support.microsoft.com/kb/939391

spatdsg

New Security code samples...

SpatDSG — Mon, 14 May 2007 17:31:00 GMT

Dan, over at JWSecure has written a bunch of new samples for some difficult to use API's ( previously he also wrote some cred prov samples )

The new batch includes a CNG plugin to implement a new cipher algorithm in Vista - cool stuff. I especially liked his section on 'kicking the tires' and a little about his methodolgy behind new API's.

http://jwsecure.com/dan/2007/05/now_available_new_vista_securi.html

spatdsg

Smartcard logon over Terminal Services ( RDP redirection ) pII ( vista FYI )

SpatDSG — Wed, 09 May 2007 17:15:00 GMT

It seems I do spend a fair bit of time with smartcards lately, but I have some other interesting posts planned as well. Anyway, this is kind of a heads up to an interesting issue with Vista.

We changed some of the way things work ( for the better ) in Vista. You may have noticed that scredir.dll no longer exists in Vista - much of that code was moved into Winscard.dll. We also changed the way we call the CSP previously ( see http://blogs.msdn.com/spatdsg/archive/2006/10/06/Smartcards-and-cached-logons_2E002E002E00_.aspx ) we called from LSASS into winlogon.exe but we no longer do this in Vista - we go straight to the CSP.

Anyway - this post is marginally related to my other post Smartcard logon over Terminal Services ( RDP redirection )

Remember that the "server" will call back to the client via the RDP protocol ( virtual channel ) and MSTSC.EXE loads winscard.dll on the client in order to process these IO requests. Well in this case the calls never made it up to that level of the code. In fact, they died in the RDP client.

If you have a CSP which calls SCardUIDlgSelectCardW, it may fail due to this issue. The RDP session is initaited from Vista...

Vista --> Vista : works OL

Vista --> XP: FAILURE

XP--> XP: works OK

XP--> Vista : works OK

Error on XP:

Event Type: Failure Audit

Event Source: Security

Event Category: Logon/Logoff

Event ID: 537

Date: 3/27/2007

Time: 12:32:26 PM

User: NT AUTHORITY\SYSTEM

Computer: XPDEBUG

Description:

Logon Failure:

Reason: An error occurred during logon

User Name:

Domain:

Logon Type: 10

Logon Process: User32

Authentication Package: Kerberos

Workstation Name: XPDEBUG

Status code: 0xC000006D à STATUS_LOGON_FAILURE

Substatus code: 0xC0000321 -> STATUS_SMARTCARD_SUBSYSTEM_FAILURE

Anyway - I hate leaving people in the dark with issues they may assume are due to the ISV's software .. so, even tho no fix is out yet... I have this FYI.

Fix is pending.. but again, if the behavior isnt changed, dont shoot the messenger.

[added on July 10,2007 ]Whooo hooo! It was fixed -public KB article is coming but if you need the fix now ask for the fix for article 939682

spatdsg

LH Beta 3 OCSP doc..

SpatDSG — Tue, 01 May 2007 01:47:00 GMT

This white paper describes the concepts behind and steps needed to install, configure, and troubleshoot the Microsoft Online Responder, a role service that is used to implement online certificate status protocol (OCSP) revocation checking in Active Directory Certificate Services environments.

http://download.microsoft.com/download/5/3/c/53cdc0bf-6609-4841-a7b9-cae98cc2e4a3/Installing, Configuring, and Troubleshooting the Microsoft Online Responder.doc

spatdsg