Re: How could my program support enterprise CA?

From: Alon Bar-Lev (alon_at_xor-t.com)
Date: 05/12/04 

Date: Wed, 12 May 2004 19:33:23 +0200

Dear Allie,

This is the classic question...
It can be done, but It invloves in C++ programming...
You need to create a pkcs10 request and sign it using certificate request
agent certificate into a pkcs#7.
The pkcs#7 must have an authenticated attribute as name value pair, when
name is RequesterName and value is the target SAM account.

1. You encode the name value pair using CryptEncodeObject with
szOID_ENROLLMENT_NAME_VALUE_PAIR ("RequesterName", "XXX\SAM User") from
CRYPT_ENROLLMENT_NAME_VALUE_PAIR to CRYPT_ATTR_BLOB.
2. You make CRYPT_ATTRIBUTE to point to it.
3. You sign a pkcs#10 as binary data using CryptSignMessage put the
CRYPT_ATTRIBUTE as an authenticated attribute.
4. Use ICertRequest to forward your request to the CA.

Best Regards,
Alon Bar-Lev.

"Allie" <moonghost@tom.com> wrote in message
news:%23ra$sjJNEHA.3348@TK2MSFTNGP09.phx.gbl...
> Hello all,
> How could I using my own program to issue certificates support
microsoft
> enterprise CA?
> eg.sending a request to enterprise CA and then the enterprise CA issue
a
> cert to a AD user?
> What should I do with this request?
>
>

Relevant Pages

  • Re: Computer and User Certificates Issues
    ... Enrollment of User Certificates using the custom v2 User Certificate Template ... I can NOT request the custom v2 Computer Cert nor the included v1 no ... Concerning permissions, these are the exact permissions I am using now: ...
    (microsoft.public.security)
  • Re: Cannot request computer certificate.
    ... request a computer certificate for about 9 months. ... and verify that you can get a computer/server certificate from it. ... List of NetBt transports currently bound to the Redir ... DNS Host Name: srvr3.domain.com ...
    (microsoft.public.windows.server.security)
  • RE: SIMple SSL question ??
    ... OK - i would also delete a cert request file lying around. ... But a certificate is a pub key + extra info. ... That said - if someone compromises the server he will also find a way to retrieve the private key. ... traffic between the initial web server and the client. ...
    (microsoft.public.dotnet.security)
  • Re: how can we restrict what certificate WSE will use?
    ... the valid x509 certificate which is used to identify him'. ... X509SecurityTokenManager to verify the request is from a trusted client. ... the problem is that he can not passed the authentication (suppose we ... > decrypte and signature validation process. ...
    (microsoft.public.dotnet.framework.webservices.enhancements)
  • Re: Web Certificate Enrollment security problem
    ... Enrollment works only with the NetBIOS Name and not with the FQDN. ... Svyatoslav Pidgorny, MS MVP - Security, MCSE ... access auditing and logging "issue and manage certificate requests" on ... Have seen that there is a component "Certsrv Request" when launching ...
    (microsoft.public.security)
Quantcast