7 Appendix B: Product Behavior

The information in this specification is applicable to the following Microsoft products or supplemental software. References to product versions include released service packs:

• Microsoft Windows® 2000 operating system

• Windows® XP operating system

• Windows Server® 2003 operating system

• Windows Vista® operating system

• Windows Server® 2008 operating system

• Windows® 7 operating system

• Windows Server® 2008 R2 operating system

• Windows® 8 Consumer Preview operating system

• Windows Server® 8 Beta operating system

Exceptions, if any, are noted below. If a service pack or Quick Fix Engineering (QFE) number appears with the product version, behavior changed in that service pack or QFE. The new behavior also applies to subsequent service packs of the product unless otherwise specified. If a product edition appears with the product version, behavior is different in that product edition.

Unless otherwise specified, any statement of optional behavior in this specification that is prescribed using the terms SHOULD or SHOULD NOT implies product behavior in accordance with the SHOULD or SHOULD NOT prescription. Unless otherwise specified, the term MAY implies that the product does not follow the prescription.

<1> Section 1.1: A representation of the history of Windows behavior: Windows Server 2003 stores request submissions and certificate revocations that have occurred since the last log file truncation or backup. Log file volume increases as database activity occurs. The log files can be decreased in size by performing a backup and then calling BackupTruncateLogs (as specified in section 2.2.2.1).

<2> Section 2.1: The following values are used by the Certificate Services Remote Administration Protocol client and server.

<3> Section 2.1: On a Windows computer, if NULL authentication identity and credentials is passed, the RPC_C_AUTHN_GSS_NEGOTIATE security provider uses the identity and credentials from the process token of the process in which the higher layer application is running. This means the account on which the Certificate Services Remote Administration Protocol client is running is the account whose identity will be sent as the identity of the ORPC call.

<4> Section 2.2.2.2:

Windows Server 2003 will use key recovery certificates that contain the following X.509v3 extensions specific to Windows:

• Application Policies (Policy Identifier = Key Recovery Agent)

• Certificate Template Information

Key recovery certificates, when issued by a Windows enterprise CA, are automatically written to the configuration container of Active Directory. The actual certificates are published to the userCertificate attribute (as specified in [RFC4523]) of the key recovery agent (KRA)object when issued to a member of the domain administrators group in Active Directory.

<5> Section 3.1.1: Windows implements the version-specific Request, Attribute, Extension, and CRL database tables as detailed in the following tables. The first table details the Request table for Windows 2000 Server.

The following table details the Requesttable for Windows Server 2003.

The following table details the Request table for Windows Server 2008, Windows Server 2008 R2, and Windows Server 8 Beta.

The following table details the Extensiontable for Windows 2000 Server, Windows Server 2003, Windows Server 2008, Windows Server 2008 R2, and Windows Server 8 Beta.

The following table details the Attributetable for Windows 2000 Server, Windows Server 2003, Windows Server 2008, Windows Server 2008 R2, and Windows Server 8 Beta.

The following table details the CRLtable for Windows Server 2003, Windows Server 2008, Windows Server 2008 R2, and Windows Server 8 Beta. (Windows 2000 Server does not have a CRLtable.)

<6> Section 3.1.1.1.1: Windows uses a DWORD number to represent these values. The following table shows how Windows internal values correspond to the preceding string representations.

<7> Section 3.1.1.1.2: Request_RequesterName_From_Old_Certificate is supported in Windows Server 2008 R2 and Windows Server 8 Beta only.

<8> Section 3.1.1.4: Windows 2000, Windows Server 2003, Windows Server 2008, Windows Server 2008 R2, and Windows Server 8 Beta CAs store this CRL in the registry location HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs.

<9> Section 3.1.1.7: The permissions of Officer, Operator, and Auditor are supported on Windows Server 2003 Enterprise Edition, Windows Server 2003 Datacenter Edition, Windows Server 2008 Enterprise, Windows Server 2008 Datacenter, Windows Server 2008 R2 Enterprise Edition, Windows Server 2008 R2 Datacenter Edition, and Windows Server 8 Beta.

<10> Section 3.1.1.8: The Microsoft CA keeps all CRL publishing locations in a registry multistring value.

                  HKLM\SYSTEM\CurrentControlSet\Services\CertSvc\Configuration\
{CA Name}\CRLPublicationURLs

                

The Microsoft CA uses a numeric prefix that is stored with each entry of the CRL publishing location list in order to indicate which of the ADM elements the URL belongs to, as shown in the following table.

Calling the ICertAdminD2::SetConfigEntry method with the pwszNodePath as an EMPTY string, the pwszEntry "CRLPublicationURLs", and the pVariant data that contains the required URLs allows manipulation of this list.

Also, the usual registry manipulation tools that are specified in [MS-RRP] can be used to update these values.

For Config_CA_CDP_Publish_To_Base and Config_CA_CDP_Publish_To_Delta, the default values that are used by the Microsoft CA are a local path on the CA machine,

                  {SYSTEM}\CertSrv\CertEnroll\{CATruncatedName}{CRLNameSuffix}
{DeltaIndicator}.crl

                

a local path in the registry,

                  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs\

                

and the Active Directory path,

                  
ldap: ///CN={CATruncatedName}{CRLNameSuffix},CN={CAServerShortName},
CN=CDP,CN=Public Key 
Services,CN=Services,CN=Configuration,DC={contoso},DC=com{CDPObjectClass}

                

where:

• "{SYSTEM}" is replaced with the system directory of the CA machine, such as "C:\Windows\System32".

• "{CATruncatedName}" is replaced with the sanitized name of the CA, as defined in [MS-WCCE] sections 1.3.2.3 and 3.1.1.4.1.1.

• "{DeltaIndicator}" is replaced with NULL for a base CRL and "+" for a delta CRL.

• "{CRLNameSuffix}" is replaced with NULL if the CRL is signed by the first CAkey (a CA key that has a key index of 0) and by "(n)" if the CRL is signed by any subsequent CAkey.

  Where "(n)" is replaced with an integer that is equal to the identifier Signing_Private_Key_Version_ID, as defined in [MS-WCCE] section 3.2.1.1.2 and in the example in [MS-WCCE] section 3.2.1.4.3.2.34.

• "{CAServerShortName}" is replaced with the name of the host on which the CA is running.

• "DC={contoso},DC=com" is replaced by the distinguished name (DN) of the forest root domain naming context (NC) of the Active Directory forest in which the Microsoft CA is installed.

  • The forest root domain NC is defined in [MS-ADTS] section 1.1.

  • For example, the DN of the forest root domain NC of a forest called "corp.contoso.com" would be "DC=corp,DC=contoso,DC=com".

• "{CDPObjectClass}" is replaced with "?certificateRevocationList?base?objectClass=cRLDistributionPoint" for a base CRL and with "?deltaRevocationList?base?objectClass=cRLDistributionPoint" for a delta CRL.

  • The object class cRLDistributionPoint is as defined in [MS-ADSC].

  • The attribute certificateRevocationList is defined in [MS-ADA1].

  • The attribute deltaRevocationList is defined in [MS-ADA1].

The deltaRevocationList attribute is not used by the Windows 2000 version of the CA. The Windows Server 2003, Windows Server 2008, Windows Server 2008 R2, and Windows Server 8 Beta versions of the CA use both base CRL and delta CRL attributes.

Within the certificateRevocationList or deltaRevocationList attribute, the CRL is encoded by using Distinguished Encoding Rules (DER).

<11> Section 3.1.1.10: Microsoft CAs persist only a subset of the configuration data. They store the configuration data in the registry in the following locations:

Values under

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CertSvc\Configuration\

DBSessionCount

ADM Datum: Config_Max_Number_Of_AD_Connections and OnNextRestart_ Config_Max_Number_Of_AD_Connections.

Registry Value Type: REG_DWORD

Default Value: 20

Registry Value Mapping to ADM: The value in the registry equals the ADM datum value. The minimum value for this registry is 4 and the maximum value is 1024.

No Value Semantics: The value always exists.

LDAPFlags

ADM Datum: Config_CA_LDAP_Flags and OnNextRestart_Config_CA_LDAP_Flags.

Registry Value Type: REG_DWORD

Default Value: 0

Registry Value Mapping to ADM: The value in the registry equals the ADM datum value.

No Value Semantics: The value always exists.

Version

ADM Datum: Config_Product_Version and OnNextRestart_Config_Product_Version

Registry Value Type: REG_DWORD

Default Value: By default, the value depends on the Windows version:

• 0x00010001 – Windows 2000 Server

• 0x00020002 – Windows Server 2003

• 0x00030001 – Windows Server 2008

• 0x00040001 – Windows Server 2008 R2

• 0x00050001 – Windows Server 8 Beta

Registry Value Mapping to ADM: The value in the registry equals the ADM datum value.

No Value Semantics: The value always exists.

                  
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CertSvc\Configuration\<CA_CN>

                

where <CA_CN> is replaced with the common name (CN) of the CA. The values are as follows:

ConfigurationDirectory

ADM Datum: Config_Configuration_Directory (defined in [MS-WCCE]).

Registry Value Type: REG_SZ

Default Value: By default, the value does not exist.

Registry Value Mapping to ADM: The value in the registry equals the ADM datum value.

No Value Semantics: The CA does not implement Config_Configuration_Directory datum (for details, see section 3.2.1.4.3.2.8).

ParentCAMachine

ADM Datum: Config_CA_Parent_DNS (defined in [MS-WCCE]).

Registry Value Type: REG_SZ

Default Value: By default, the value does not exist for the root CA. For the subordinate CA, the value is set to the FQDN (1) of the machine where the parent CA is installed.

Registry Value Mapping to ADM: The value in the registry equals the ADM datum value.

No Value Semantics: The CA does not have a parent CA.

RoleSeparationEnabled

ADM Datum: Config_CA_Role_Separation (defined in [MS-WCCE]).

Registry Value Type: REG_DWORD

Default Value: The value does not exist by default.

Registry Value Mapping to ADM: If the value in the registry is zero, the ADM datum is set to false. For any nonzero registry value, ADM datum is set to true.

No Value Semantics: Same as setting the value to zero.

CAXchgCertHash

ADM Datum: Config_CA_Exchange_Cert (defined in [MS-WCCE]).

Registry Value Type: REG_MULTI_SZ

Default Value: None.

Registry Value Mapping to ADM: Each value is an SHA-1 hash of the corresponding CA exchange certificate. The actual exchange certificates are stored in the Request table.

No Value Semantics: There are no CA exchange certificates configured on the server.

CACertPublicationURLs

• ADM Datum: Multiple, see Registry Value Mapping to ADM.

• Registry Value Type: REG_MULTI_SZ

• Default Value:

  1:C:\Windows\system32\CertSrv\CertEnroll\%1_%3%4.crt

  3:ldap:///CN=%7,CN=AIA,CN=Public Key Services,CN=Services,%6%11

  2:http://%1/CertEnroll/%1_%3%4.crt

  0:file://%1/CertEnroll/%1_%3%4.crt

• Registry Value Mapping to ADM: The string format for each string in the list is

  <Numeric Prefix Value>:<Some Path>

  Where the <Numeric Prefix Value> is a binary OR of the values in the following table and is represented as a decimal value. And where <Some Path> is a string that is composed of literal strings and wild cards, that is defined in the following tables, and that represents an HTTP, FILE, or LDAPURL), or a UNC path.

  Numeric prefix value	ADM element
  0x00000001	Config_CA_CACert_Publish_To and OnNextRestart_Config_CA_CACert_Publish_To. The CA publishes its signing certificate to this location.
  0x00000002	Config_CA_AIA_Include_In_Cert and OnNextRestart_Config_CA_AIA_Include_In_Cert.
  0x00000020	Config_CA_OCSP_Include_In_Cert and OnNextRestart_Config_CA_OCSP_Include_In_Cert.

  Wild card	Meaning
  %1	The NetBIOS name of the server on which the CA is installed.
  %2	The FQDN (1) of the server on which the CA is installed.
  %3	The name of the CA.
  %4	The certificate file name suffix that corresponds to the key index for the CA signing key.
  %6	The DN name of the configuration container.
  %7	The truncated name of the CA.
  %11	The class name for the AD object of the CA.

• No Value Semantics: The ADMs that correspond to the prefixes are empty.

CRLPublicationURLs

• ADM Datum: Multiple, see Registry Value Mapping to ADM.

• Registry Value Type: REG_MULTI_SZ

• Default Value:

  65:E:\Windows\system32\CertSrv\CertEnroll\%3%8%9.crl

  79:ldap:///CN=%7%8,CN=%2,CN=CDP,CN=Public Key Services,CN=Services,%6%10

  6:http://%1/CertEnroll/%3%8%9.crl

  0:file://%1/CertEnroll/%3%8%9.crl

• Registry Value Mapping to ADM: The string format for each string in the list is:

  <Numeric Prefix Value>:<Some Path>

  Where the <Numeric Prefix Value> is a binary OR of the values in the following table and is represented as a decimal value. And <Some Path> is a string that is composed of literal strings and wild cards, that is defined in the following tables, and that represents an HTTP, FILE, or LDAPURL, or a UNC path.

  Numeric prefix value	ADM element
  0x00000001	Config_CA_CDP_Publish_To_Base and OnNextRestart_Config_CA_CDP_Publish_To_Base
  0x00000002	Config_CA_CDP_Include_In_Cert and OnNextRestart_Config_CA_CDP_Include_In_Cert
  0x00000040	Config_CA_CDP_Publish_To_Delta and OnNextRestart_Config_CA_CDP_Publish_To_Delta
  0x00000008	Config_CA_CDP_Include_In_CRL_Publish_Locations_Extension and OnNextRestart_Config_CA_CDP_Include_In_CRL_Publish_Locations_Extension
  0x00000004	Config_CA_CDP_Include_In_CRL_Freshest_CRL_Extension and OnNextRestart_Config_CA_CDP_Include_In_CRL_Freshest_CRL_Extension
  0x00000080	Config_CA_CDP_Include_In_CRL_IDP_Extension and OnNextRestart_Config_CA_CDP_Include_In_CRL_IDP_Extension

  Wild card	Meaning
  %1	The FQDN (1) of the server on which the CA is installed.
  %2	The NetBIOS name of the server on which the CA is installed.
  %3	The name of the CA.
  %4	The certificate name.
  %6	The DN name of the configuration container.
  %7	The truncated name of the CA.
  %8	The signing key identifier, which is enclosed in (), of the CA.
  %9	Append + character suffix.
  %10	The AD CRL and delta CRL object class.
  %11	The class name for the AD object of the CA.

EnrollmentAgentRights

• ADM Datum: Config_Permissions_Enrollment_Agent_Rights (defined in [MS-WCCE]).

• Registry Value Type: REG_BINARY

• Default Value: None.

• Registry Value Mapping to ADM: A binary security descriptor that is defined in section 2.2.1.11.

• No Value Semantics: No Enrollment Agent permissions are defined.

OfficerRights

• ADM Datum: Config_Permissions_Officer_Rights (defined in [MS-WCCE]).

• Registry Value Type: REG_BINARY

• Default Value: None.

• Registry Value Mapping to ADM: A binary security descriptor that is defined in section 2.2.1.11.

• No Value Semantics: No Officer permissions are defined.

Security

• ADM Datum: Config_Permissions_CA_Security (defined in [MS-WCCE]), and OnNextRestart_Config_Permissions_CA_Security

• Registry Value Type: REG_BINARY

• Default Value:

  • Standalone CA

    • Builtin Administrators – Owner, Group, Administrator, Officer

    • Everyone: Enroll

  • Enterprise CA

    • Builtin Administrators – Owner, Group, Administrator, Officer

    • Domain Administrators – Administrator, Officer

    • Enterprise Administrators – Administrator, Officer

    • Authenticated Users – Enroll

• Registry Value Mapping to ADM: A binary security descriptor with permissions that are defined as follows.

  Permission	Bit value
  Read	0x00000100
  Enroll	0x00000200
  Officer	0x00000002
  Administrator	0x00000001
  Auditor	0x00000004
  Operator	0x00000008

• No Value Semantics: None defined.

AuditFilter

ADM Datum: Config_CA_Audit_Filter and OnNextRestart_Config_CA_Audit_Filter

Registry Value Type: REG_DWORD

Default Value: None.

Registry Value Mapping to ADM: Specified in section 3.1.4.2.10.

No Value Semantics: No auditing occurs.

CAType

ADM Datum: Config_CA_Type and OnNextRestart_Config_CA_Type

Registry Value Type: REG_DWORD

Default Value: None.

Provisioning: Populated by the CA installation, based upon a selection made by the administrator.

Registry Value Mapping to ADM:

• ENUM_ENTERPRISE_ROOTCA = 0x00000000

• ENUM_ENTERPRISE_SUBCA = 0x00000001

• ENUM_STANDALONE_ROOTCA = 0x00000003

• ENUM_STANDALONE_SUBCA = 0x00000004

No Value Semantics: Value always present.

CommonName

ADM Datum: Config_CA_Common_Name and OnNextRestart_Config_CA_Common_Name

Registry Value Type: REG_SZ

Default Value: None.

Provisioning: Populated by the CA installation, based upon a selection made by the administrator.

Registry Value Mapping to ADM: Value is set to installed CA name.

No Value Semantics: Value always present.

CRLDeltaNextPublish

ADM Datum: Config_CA_CRL_Delta_Next_Publish and OnNextRestart_Config_CA_CRL_Delta_Next_Publish

Registry Value Type: REG_BINARY

Default Value: Installed filetime plus 1 day.

Registry Value Mapping to ADM: Specified in section 3.1.4.2.14.

No Value Semantics: Value always present is re-created based on calculations specified in section 3.1.4.1.6.

CRLNextPublish

ADM Datum: Config_CA_CRL_Next_Publish and OnNextRestart_Config_CA_CRL_Next_Publish

Registry Value Type: REG_BINARY

Default Value: Installed filetime plus 1 week.

Registry Value Mapping to ADM: Specified in section 3.1.4.2.14.

No Value Semantics: Value is re-created based on calculations specified in section 3.1.4.1.6.

CRLDeltaPeriod and CRLDeltaPeriodUnits

ADM Datum: Config_Delta_CRL_Validity_Period

Registry Value Type: CRLDeltaPeriod is REG_SZ, and CRLDeltaPeriodUnits is REG_DWORD

Default Value: CRLDeltaPeriodUnits = 1; CRLDeltaPeriod = "Days"

Registry Value Mapping to ADM: CRLDeltaPeriod contains the string representation of the "periods of time" in which the Config_Delta_CRL_Validity_Period is expressed. Valid values are Seconds, Minutes, Hours, Days, Weeks, or Months. CRLDeltaPeriodUnits contains the number of those periods of time. For example, see "Default Value" above.

No Value Semantics: Hardcoded default values equal to "Default Value", above, are used

CRLPeriod and CRLPeriodUnits

ADM Datum: Config_Base_CRL_Validity_Period

Registry Value Type: CRLPeriod is REG_SZ, and CRLPeriodUnits is REG_DWORD.

Default Value: CRLPeriodUnits = 1; CRLPeriod = "Weeks".

Registry Value Mapping to ADM: CRLPeriod contains the string representation of the "periods of time" in which the Config_Base_CRL_Validity_Period is expressed. Valid values are Seconds, Minutes, Hours, Days, Weeks, or Months. CRLPeriodUnits contains the number of those periods of time. For example, see "Default Value" above.

No Value Semantics: Hardcoded default values equal to "Default Value" above, are used.

HighSerial

ADM Datum: Config_High_Serial_Number, Config_High_Serial_String, OnNextRestart_Config_High_Serial_Number, and OnNextRestart_Config_High_Serial_String

Registry Value Type: REG_DWORD

Default Value: The value does not exist by default. It must be created manually using registry methods.

Registry Value Mapping to ADM: Defined in [MS-WCCE] section 3.2.1.4.2.1.4.5.

No Value Semantics: Same as registry value of 0.

InterfaceFlags

ADM Datum: Config_CA_Interface_Flags and OnNextRestart_Config_CA_Interface_Flags.

Registry Value Type: REG_DWORD

Default Value: 0x41

Registry Value Mapping to ADM: Defined in section 3.1.4.2.14.

No Value Semantics: No interface flags in effect.

KRAFlags

ADM Datum: Config_CA_KRA_Flags and OnNextRestart_Config_CA_KRA_Flags.

Registry Value Type: REG_DWORD

Default Value: 0

Registry Value Mapping to ADM: Defined in section 3.1.4.2.14.

No Value Semantics: No KRA flags in effect.

SetupStatus

ADM Datum: Config_Setup_Status and OnNextRestart_Config_Setup_Status.

Registry Value Type: REG_DWORD

Default Value: By default, for a complete CA installation, the value is 1.

Registry Value Mapping to ADM: The value in the registry equals the ADM datum value.

No Value Semantics: Value always present.

SubjectTemplate

ADM Datum: Config_CA_DN_Order_String

Registry Value Type: REG_MULTI_SZ

Default Value: Email

CommonName

OrganizationalUnit

Organization

Locality

State

DomainComponent

Country

Registry Value Mapping to ADM: The value in the registry equals the ADM datum value.

No Value Semantics: Value always present.

CRLDeltaOverlapPeriod and CRLDeltaOverlapUnits

ADM Datum: Config_Delta_CRL_Overlap_Period

Registry Value Type: CRLDeltaOverlapPeriod is REG_SZ, and CRLDeltaOverlapUnits is REG_DWORD.

Default Value: CRLDeltaOverlapUnits = 0; CRLDeltaOverlapPeriod = "Minutes".

Registry Value Mapping to ADM: CRLDeltaOverlapPeriod contains the string representation of the "periods of time" in which the Config_Delta_CRL_Overlap_Period is expressed. Valid values are Seconds, Minutes, Hours, Days, Weeks, or Months. CRLDeltaOverlapUnits contains the number of those periods of time. For example, see "Default Value" above.

No Value Semantics: Hardcoded default values equal to "Default Value", above, are used.

CRLOverlapPeriod and CRLOverlapUnits

ADM Datum: Config_Base_CRL_Overlap_Period

Registry Value Type: CRLOverlapPeriod is REG_SZ, and CRLOverlapUnits is REG_DWORD.

Default Value: CRLOverlapUnits = 0; CRLOverlapPeriod = "Hours"

Registry Value Mapping to ADM: CRLOverlapPeriod contains the string representation of the "periods of time" in which the Config_Base_CRL_Overlap_Period is expressed. Valid values are Seconds, Minutes, Hours, Days, Weeks, or Months. CRLOverlapUnits contains the number of those periods of time. For example, see "Default Value" above.

No Value Semantics: Hardcoded default values equal to "Default Value", above, are used.

CRLAttemptRepublish

ADM Datum: OnNextRestart_Config_CA_CRL_Attempt_Republish

Registry Value Type: REG_DWORD

Default Value: By default the element is absent. Windows instantiates the value upon the first unsuccessful CRL publishing attempt per the processing rules in section 3.1.4.1.6.

Registry Value Mapping to ADM: The value in the registry equals the ADM datum value.

No Value Semantics: Same as value of 0.

Maximum Value: 10

KRACertCount

ADM Datum: Config_CA_KRA_Cert_Count

Registry Value Type: REG_DWORD

Default Value: 0

Registry Value Mapping to ADM: The value in the registry equals the ADM datum value.

No Value Semantics: No KRAcertificates available for encryption.

KRACertHash

ADM Datum: Config_CA_KRA_Cert_List

Registry Value Type: REG_MULTI_SZ

Default Value: Empty by default.

Registry Value Mapping to ADM: Each of the multiple values in the registry is the hash of one of the KRAcertificates in the list.

No Value Semantics: No KRAcertificates available for encryption.

UseDS

ADM Datum: Config_CA_Use_DS and OnNextRestart_Config_CA_Use_DS

Registry Value Type: REG_DWORD

Default Value: For an enterprise CA (Config_CA_Type of 0 or 1), the value is 1. For a standalone CA (Config_CA_Type of 3 or 4), the value is 0.

Registry Value Mapping to ADM: The value in the registry equals the ADM datum value.

No Value Semantics: Value always present.

CNGHashAlgorithm

ADM Datum: Config_CSP_CNG_Hash_Algorithm and OnNextRestart_Config_CSP_CNG_Hash_Algorithm

Registry Value Type: REG_SZ

Default Value: None

Provisioning: : If the administrator has selected a CNG provider as the Config_CSP_Provider, this value is populated by the CA installation, based upon another selection made by the administrator. If the administrator has selected a CryptoAPICSP as the Config_CSP_Provider, this value is provisioned with no value (null).

Registry Value Mapping to ADM: The value in the registry equals the ADM datum value.

No Value Semantics: If there is no Config_CSP_CNG_Hash_Algorithm value, then this means the CA uses a CryptoAPICSP and not a CNG provider. In this case, Config_CSP_Hash_Algorithm will contain the identifier of the CA hash algorithm.

HashAlgorithm

ADM Datum: Config_CSP_Hash_Algorithm and OnNextRestart_Config_CSP_Hash_Algorithm

Registry Value Type: REG_DWORD

Default Value: None

Provisioning: If the administrator has selected a CryptoAPICSP as the Config_CSP_Provider, this value is populated by the CA installation, based upon another selection made by the administrator. If the administrator has not selected a CryptoAPICSP as the Config_CSP_Provider, this value is initialized to 0xffffffff.

Registry Value Mapping to ADM: The value in the registry is either 0xffffffff or the algid (algorithm identifier) that corresponds to the hash algorithm used by the CA.

0xffffffff – no value. The CA has been installed with a CNG provider, so Config_CSP_CNG_Hash_Algorithm contains the name of the CA hash algorithm.

Algids of supported hash algorithms are as follows:

MD2 0x8001

MD5 0x8003

SHA1 0x8004

SHA256 0x8012

SHA384 0x8013

SHA512 0x8014

No Value Semantics: The element always exists.

Provider

ADM Datum: Config_CSP_Provider and OnNextRestart_Config_CSP_Provider

Registry Value Type: REG_SZ

Default Value: Populated by the CA installation, based upon a selection made by the administrator.

Registry Value Mapping to ADM: The value in the registry equals the ADM datum value.

No Value Semantics: Element always exists.

Values under:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CertSvc\Configuration\<CA_
CN>\PolicyModules\CertificateAuthority_MicrosoftDefault.Policy\RequestDisposition

where <CA_CN> is replaced with the common name (CN) of the CA. The values are as follows:

RequestDisposition

ADM Datum: OnNextRestart_ Config_CA_Requests_Disposition

Registry Value Type: REG_DWORD

Default Value: For an Enterprise CA (Config_CA_Type of 0 or 1), the value is 0x00000001. For a Standalone CA (Config_CA_Type of 3 or 4), the value is 0x00000101.

Registry Value Mapping to ADM: The value of the registry equals the value of the OnNextRestart_Config_CA_Requests_Disposition datum.

No Value Semantics: The OnNextRestart_Config_CA_Requests_Disposition datum value is set to 0x00000101 (REQDISP_PENDINGFIRST | REQDISP_ISSUE).

ProviderType

ADM Datum: Config_CSP_ProviderType and OnNextRestart_Config_CSP_ProviderType

Registry Value Type: REG_DWORD

Default Value: Populated by the CA installation based upon the selection of Provider made by the administrator. A value of 0 means the provider is a CNG provider. A nonzero value means the provider is a legacy CryptoAPICSP.

Registry Value Mapping to ADM: The value in the registry equals the ADM datum value.

No Value Semantics: Element always exists.

Values under:

                  
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CertSvc\Configuration\<CA_
CN>\PolicyModules\CertificateAuthority_MicrosoftDefault.Policy\EditFlags

                

where <CA_CN> is replaced with the CN of the CA. The values are as follows:

EditFlags

ADM Datum: Multiple, see Registry Value Mapping to ADM.

Registry Value Type: REG_DWORD

Default Value: The flags that are defined here for this value are not set by default.

Registry Value Mapping to ADM: 0x00000020 – If this bit is set, Config_CA_Accept_Request_Attributes_ValidityTime (defined in [MS-WCCE]) is set to true. Otherwise, it is set to false.

0x00008000 – If this bit is set, Config_CA_Accept_Request_Attributes_Extensions (defined in [MS-WCCE]) is set to true. Otherwise, it is set to false.

0x00040000 – If this bit is set, Config_CA_Accept_Request_Attributes_SAN (defined in [MS-WCCE]) is set to true. Otherwise, it is set to false.

0x00080000 – If this bit is set, Config_AD_Connection_Referral (defined in [MS-WCCE]) is set to true. Otherwise, it is set to false

0x02000000 – If this bit is set, Config_CA_Allow_RenewOnBehalfOf_Requests is set to true.

No Value Semantics: All ADM elements that are controlled by this value are set to false.

Values under:

                  
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CertSvc\Configuration\<CA_
CN>\CRLFlags

                

where <CA_CN> is replaced with the CN of the CA. The values are as follows:

CRLEditFlag

ADM Datum: Config_CA_Accept_Request_Attributes_Other (defined in [MS-WCCE])

Registry Value Type: REG_DWORD

Default Value: The flags that are defined here for this value are not set by default.

Registry Value Mapping to ADM: 0x00010000 – If this bit is set, Config_CA_Accept_Request_Attributes_Other (defined in [MS-WCCE]) is set to true. Otherwise, it is set to false.

No Value Semantics: All ADM elements that are controlled by this value are set to false.

Values under:

                  
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CertSvc\Configuration\<CA_
CN>\ExitModules\CertificateAuthority_MicrosoftDefault.Exit\PublishCertFlags

                

where <CA_CN> is replaced with the CN of the CA. The values are as follows:

PublishCertFlags

ADM Datum: Config_CA_Accept_Request_Attributes_CertPath (defined in [MS-WCCE])

Registry Value Type: REG_DWORD

Default Value: The flags that are defined here for this value are not set by default.

Registry Value Mapping to ADM: 0x00000001 – If this bit is set, Config_CA_Accept_Request_Attributes_CertPath (defined in [MS-WCCE]) is set to true. Otherwise, it is set to false.

No Value Semantics: All ADM elements that are controlled by this value are set to false.

Values under:

                  
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CertSvc\Configuration\<CA_
CN>\ExitModules

                

where <CA_CN> is replaced with the CN of the CA. The values are as follows:

Active

ADM Datum: See "Registry Value Mapping to ADM."

Registry Value Type: REG_MULTI_SZ

Default Value: CertificateAuthority_MicrosoftDefault.Exit

Registry Value Mapping to ADM: The names of the COM classes implementing the ICertExit interface and used as exit algorithms on the CA comprise Config_CA_Exit_Algorithm_Implementation_List and OnNextRestart_Config_CA_Exit_Algorithm_Implementation_List.

The number of entries in this value sets the Config_CA_Exit_Count.

No Value Semantics: No exit algorithms are installed on the CA.

Values under:

                  
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CertSvc\Configuration\<CA_
CN>\PolicyModules

                

where <CA_CN> is replaced with the CN of the CA. The values are as follows:

Active

ADM Datum: Config_CA_Policy_Algorithm_Implementation and OnNextRestart_Config_CA_Policy_Algorithm_Implementation

Registry Value Type: REG_SZ

Default Value: CertificateAuthority_MicrosoftDefault.Policy

Registry Value Mapping to ADM: The registry value contains the name of the COM class that implements the ICertPolicy interface and should be used at the policy algorithm on the CA.

No Value Semantics: Unsupported; a Windows CA always has at least one policy module.

<12> Section 3.1.1.10: Config_CA_Allow_RenewOnBehalfOf_Requests is supported in Windows Server 2008 R2 and Windows Server 8 Beta.

<13> Section 3.1.3: The DCOM security descriptor is accessed from the registry location HKLM\SOFTWARE\Microsoft\Ole\:

Value: MachineAccessRestriction

Values added

COM_RIGHTS_EXECUTE | COM_RIGHTS_EXECUTE_LOCAL | COM_RIGHTS_EXECUTE_REMOTE

and

Value: MachineLaunchRestriction

Values added

COM_RIGHTS_EXECUTE | COM_RIGHTS_ACTIVATE_LOCAL | COM_RIGHTS_ACTIVATE_REMOTE

where

COM_RIGHTS_EXECUTE maps to the value of 1

COM_RIGHTS_EXECUTE_LOCAL maps to the value of 2

COM_RIGHTS_EXECUTE_REMOTE maps to the value of 4

COM_RIGHTS_ACTIVATE_LOCAL maps to the value of 8

COM_RIGHTS_ACTIVATE_REMOTE maps to the value of 16

<14> Section 3.1.3: The Microsoft Windows CA, upon CA service startup, reads the configuration values from the registry location "HKLM\SYSTEM\CurrentControlSet\Services\CertSvc\".

<15> Section 3.1.4.1: The supported clients are Windows 2000 Professional, Windows XP, Windows Vista with Admin Pack, Windows 7, and Windows 8 Consumer Preview. The supported servers are Windows 2000 Server, Windows Server 2003, Windows Server 2008, Windows Server 2008 R2, and Windows Server 8 Beta.

<16> Section 3.1.4.1: In Windows 2000, Windows Server 2003, Windows Server 2008, Windows Server 2008 R2, and Windows Server 8 Beta, the error is E_ACCESSDENIED (0x80070005).

<17> Section 3.1.4.1: In Windows Server 2003, Windows Server 2008, Windows Server 2008 R2, and Windows Server 8 Beta, the error is E_ACCESSDENIED (0x80070005). Windows 2000 does not return an error.

<18> Section 3.1.4.1: In Windows Server 2003, Windows Server 2008, Windows Server 2008 R2, and Windows Server 8 Beta, the error is E_ACCESSDENIED (0x80070005). Windows 2000 does not return an error.

<19> Section 3.1.4.1.3: The Windows Server 2003 CA places 0x80094004 in the pdwDisposition parameter and returns successfully. Windows Server 2008, Windows Server 2008 R2, and Windows Server 8 Beta CAs place 0 in the pdwDisposition parameter and return 0x80094004 as the error code.

<20> Section 3.1.4.1.4: Windows 2000, Windows XP, Windows Server 2003, Windows Vista, and Windows Server 2008 set the Request_Status_Code to 0x0 (S_OK).

<21> Section 3.1.4.1.6: In a Windows 2000 CA, CRL creation can be disabled by setting the Config_Base_CRL_Validity_Period to 0. In a Windows 2000 CA, if the Microsoft default exit module "CertificateAuthority_MicrosoftDefault.Exit" is not active (that is, not included in the ADM element Config_CA_Exit_Algorithm_Implementation_List), then no CRLs are published. The setting Config_CA_Exit_Algorithm_Implementation_List has no effect on PublishCRL behavior of Windows Server 2003, Windows Server 2008, Windows Server 2008 R2, or Windows Server 8 Beta. If CRLs are disabled, certificates issued by the CA cannot be used for applications that require CRL–based revocation checking.

<22> Section 3.1.4.1.6: The Windows 2000 CA does not have a CRL table ; therefore, it does not create or update a CRLtable entry.

<23> Section 3.1.4.1.6: The Microsoft CA for Windows uses a default clock skew (Config_CA_Clock_Skew_Minutes) of 10 minutes. The Microsoft CA defines this value in the registry as follows:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services
\CertSvc\Configuration{CA Name}\ClockSkewMinutes  (REG_DWORD)

<24> Section 3.1.4.1.6: By default, the Config_Base_CRL_Overlap_Period and Config_Delta_CRL_Overlap_Period values are not defined. The Microsoft CA keeps these overlap periods in the following registry values:

HKLM\SYSTEM\CurrentControlSet\Services\CertSvc\Configuration\{CA Name}\
REG_SZ        CRLOverlapPeriod
REG_DWORD     CRLOverlapPeriodUnits
REG_SZ        CRLDeltaOverlapPeriod
REG_DWORD     CRLDeltaOverlapPeriodUnits

<25> Section 3.1.4.1.6: The Microsoft CA for Windows uses a default clock skew (Config_CA_Clock_Skew_Minutes) of 10 minutes. The Microsoft CA defines this value in the registry as follows:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services
\CertSvc\Configuration{CA Name}\ClockSkewMinutes  (REG_DWORD)

<26> Section 3.1.4.1.6: Differing from [RFC3280] section 5, a Windows 2000 CA does not populate the CRL number extension.

<27> Section 3.1.4.1.6: A Windows 2000 CA does not create delta CRLs.

<28> Section 3.1.4.1.6: The Microsoft CA keeps this list of CDP locations in a registry multistring value.

HKLM\SYSTEM\CurrentControlSet\Services\CertSvc\Configuration\
{CA Name}\CRLPublicationURLs

A specific protocol method does not exist to manipulate this list. Instead, the Microsoft CA uses the typical registry manipulation tools.

The default values used by the Microsoft CA are a local path on the CA machine,

{SYSTEM}\CertSrv\CertEnroll\

a local path in the registry,

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs\

and the Active Directory path,

ldap: ///CN={CAName}{CRLNameSuffix},CN={CAServerName},CN=CDP,
CN=Public Key Services,CN=Services,CN=Configuration,DC={contoso},DC=com

where:

• SYSTEM is replaced with the system directory of the CA machine, such as "C:\Windows\System32".

• CAName is replaced with the sanitized name of the CA, as defined in [MS-WCCE] sections 1.3.2.3 and 3.1.1.4.1.1.

• {CRLNameSuffix} is replaced with NULL if the CRL is signed by the first CAkey (CAkey with key index 0) and by "(n)" if the CRL is signed by any subsequent CAkey, with {n} being an integer equal to the identifier (Signing_Private_Key_Version_ID, as defined in [MS-WCCE] section 3.2.1.1.3) of the CAcertificateprivate key.

• CAServerName is replaced with the name of the host on which the CA is running.

• DC={contoso},DC=com is replaced with the name space of the Active Directory domain in which the Microsoft CA is installed.

<29> Section 3.1.4.1.6: For the Microsoft CA, the error code will be in the form of a 2-byte WIN32 error code (as specified in [MS-ERREF] section 2.2), such as 0x2098, which means "Insufficient access rights to perform the operation". This will then be converted to an HRESULT (4 byte) error code (as specified in [MS-ERREF] section 2.1), such as 0x80072098. Note that the first 2 bytes, the "0x8007" portion of the HRESULT value, have nothing to do with the error condition and are determined by the Severity and Facility bits, as defined in [MS-ERREF] section 2.1.

<30> Section 3.1.4.1.6: The Microsoft CA publishes CRLs to LDAP paths in Active Directory as follows:

The path the server expects is

                          
ldap: ///CN={CAName}{CRLNameSuffix},CN={CAServerShortName},
CN=CDP,CN=Public Key 
Services,CN=Services,CN=Configuration,DC={contoso},DC=com{CDPObjectClass}

                        

where:

"{CAName}" is replaced with the sanitized name of the CA, as defined in [MS-WCCE] sections 1.3.2.3 and 3.1.1.4.1.1.

"{DeltaIndicator}" is replaced with NULL for a base CRL and "+" for a delta CRL.

"{CRLNameSuffix}" is replaced with NULL if the CRL is signed by the first CAkey (CAkey with key index 0) and by "(n)" if the CRL is signed by any subsequent CAkey.

where "n" is replaced with an integer equal to the identifier (Signing_Private_Key_Version_ID, as defined in [MS-WCCE] section 3.2.1.1.2) of the CAcertificateprivate key.

"{CAServerName}" is replaced with the name of the host on which the CA is running.

"DC={contoso},DC=com" is replaced with the DN of the forest root domain naming context (NC) of the Active Directoryforest in which the Microsoft CA is installed.

The forest root domain NC is defined in section 1.1 of [MS-ADTS].

For example, the DN of the forest root domain NC of a forest called "corp.contoso.com" is "DC=corp,DC=contoso,DC=com".

{CDPObjectClass} is replaced with "?certificateRevocationList?base?objectClass=cRLDistributionPoint" for a base CRL and with "?deltaRevocationList?base?objectClass=cRLDistributionPoint" for a delta CRL.

The object class cRLDistributionPoint is as defined in [MS-ADSC]. The attribute certificateRevocationList is defined in [MS-ADA1].

The attribute deltaRevocationList is defined in [MS-ADA1].

The deltaRevocationList attribute is not used by the Windows 2000 version of the CA. The Windows Server 2003, Windows Server 2008, Windows Server 2008 R2, and Windows Server 8 Beta versions of the CA use both base CRL and delta CRL attributes.

Within the certificateRevocationList or deltaRevocationList attribute, the CRL is encoded by using DER.

For any ldap:/// write operation, if the LDAP write operation returns an error that indicates the LDAP server is down or otherwise unavailable, the Microsoft Windows Server 2003, Windows Server 2008, Windows Server 2008 R2, and Windows Server 8 Beta CA will attempt to rebind (creating a new LDAP handle) and reattempt the LDAP write one time. The Microsoft CA in Windows 2000 does not perform this LDAP handle caching and single retry with a new LDAP handle.

<31> Section 3.1.4.1.6: A Windows Server 2003, Windows Server 2008, Windows Server 2008 R2, or Windows Server 8 Beta CA will perform this one-time retry logic for LDAP if the LDAP call returns one of the following ldap error codes: LDAP_SERVER_DOWN (0x51), or LDAP_UNAVAILABLE (0x34), or LDAP_TIMEOUT (0x55). The Windows 2000 CA does not perform this one-time LDAP retry logic.

<32> Section 3.1.4.1.6: The Windows 2000 CA does not have a CRL table. Therefore, it does not create or update data elements for a CRL table.

<33> Section 3.1.4.1.7: The Windows 2000 CA retrieves the most recent base CRL from the registry location HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs\. The Windows Server 2003, Windows Server 2008, Windows Server 2008 R2, and Windows Server 8 Beta versions of the CA retrieve the most recent base CRL (CRLRawCRL) from the CRLtable.

<34> Section 3.1.4.1.8: Windows allows serial numbers longer than 20 octets.

<35> Section 3.1.4.1.8: The parameter value 0xfffffffd is valid only on a Windows Server 2008, Windows Server 2008 R2, or Windows Server 8 Beta CA. If this value is used on a Windows Server 2003 CA, the CA fails with return code ERROR_INVALID_PARAMETER (0x80070057).

<36> Section 3.1.4.1.8: The parameter value 0xfffffffe is valid only on a Windows Server 2008, Windows Server 2008 R2, or Windows Server 8 Beta CA. If this value is used on a Windows Server 2003 CA, the CA fails with return code ERROR_INVALID_PARAMETER (0x80070057).

<37> Section 3.1.4.1.10: Windows Server 2003, Windows Server 2008, Windows Server 2008 R2, and Windows Server 8 Beta send the column identifiers as the following DWORD array.

{0x00001000, 0x00001010, 0x0000100b, 0x00001008, 0x0000100a, 
 0x00002003, 0x0000101a, 0x00001022, 0x00001019, 0x00001018, 
 0x0000101b,0x0000101c, 0x00001017, 0x00001001}

These identifiers correspond to the following columns in the Request table:

"Request.RequestId", "Request.RequesterName", "Request.SubmittedWhen", "Request.StatusCode", "Request.DispositionMessage", "CertificateTemplate", "Request.CommonName", "Request.EMail", "Request.OrgUnit", "Request.Organization", "Request.Locality", "Request.State", "Request.Country", "Request.RawRequest"

Windows 2000 Server sends the column identifiers as the following DWORD array.

{0x00001000, 0x0000100f, 0x00002004, 0x00002006, 0x00002007, 
 0x00002011, 0x00002019, 0x00002010, 0x0000200f, 0x00002012
 0x00002013, 0x0000200e, 0x00002001}

These identifiers correspond to the following columns in the Request table:

"Request.RequestId", "Request.RequesterName", "SerialNumber", "NotBefore", "NotAfter", "CommonName", "EMail", "OrgUnit", "Organization", "Locality", "State", "Country", "RawCertificate"

<38> Section 3.1.4.1.10: Windows Server 2003, Windows Server 2008, Windows Server 2008 R2, and Windows Server 8 Beta send the column identifiers as the following DWORD array.

{0x00001000, 0x00001010, 0x00002006, 0x00002008, 0x00002009, 
 0x00002003, 0x00002016, 0x0000201e, 0x00002015, 0x00002014, 
 0x00002017, 0x00002018, 0x00002013, 0x00002001}

These identifiers correspond to the following columns in the Request table:

"Request.RequestId", "Request.RequesterName", "SerialNumber", "NotBefore", "NotAfter", "CertificateTemplate", "CommonName", "EMail", "OrgUnit","Organization", "Locality", "State", "Country", "RawCertificate"

Windows 2000 Server sends the column identifier as the following DWORD array.

{0x00001000, 0x0000100f, 0x00002004, 0x00002006, 0x00002007, 
 0x00002011, 0x00002019, 0x00002010, 0x0000200f, 0x00002012, 
 0x00002013, 0x0000200e, 0x00002001}

These identifiers correspond to the following columns in the Request table:

Request.RequestId", "Request.RequesterName", "SerialNumber", "NotBefore", "NotAfter", "CommonName", "EMail", "OrgUnit","Organization", "Locality", "State", "Country", "RawCertificate"

<39> Section 3.1.4.1.10: Windows Server 2003, Windows Server 2008, Windows Server 2008 R2, and Windows Server 8 Beta send the column identifiers as the following DWORD array.

{0x00001000, 0x00001010, 0x0000100b, 0x00001008, 0x0000100a, 
 0x00002003, 0x0000101a, 0x00001022, 0x00001019, 0x00001018, 
 0x0000101b, 0x0000101c, 0x00001017, 0x00001001, }

These identifiers correspond to the following columns in the Request table:

"Request.RequestId", "Request.RequesterName", "Request.SubmittedWhen", "Request.StatusCode", "Request.DispositionMessage", "CertificateTemplate", "Request.CommonName", "Request.EMail", "Request.OrgUnit", "Request.Organization", "Request.Locality", "Request.State", "Request.Country", "Request.RawRequest"

Windows 2000 Server sends the column identifiers as the following DWORD array.

{0x00001000, 0x0000100f, 0x0000100a, 0x00001009, 0x00001017,
 0x0000101f, 0x00001016, 0x00001015, 0x00001018, 0x00001019,
 0x00001014, 0x00001001}

These identifiers correspond to the following columns in the Request table:

Request.RequestId", "Request.RequesterName", "Request.SubmittedWhen", "Request.DispositionMessage", "Request.CommonName", "Request.EMail", "Request.OrgUnit", "Request.Organization", "Request.Locality", "Request.State", "Request.Country", "Request.RawRequest"

<40> Section 3.1.4.1.10: Windows Server 2003, Windows Server 2008, Windows Server 2008 R2, and Windows Server 8 Beta send the column identifiers as the following DWORD array.

{0x00004000, 0x00004001, 0x00004002, 0x00004003}

These identifiers correspond to the following columns in the Extension table:

"ExtensionRequestId", "ExtensionName", "ExtensionFlags", "ExtensionRawValue"

Windows 2000 Server returns E_INVALIDARG for this value of the iColumnSetDefault parameter.

<41> Section 3.1.4.1.10: Windows Server 2003, Windows Server 2008, Windows Server 2008 R2, and Windows Server 8 Beta send the column identifiers as the following DWORD array.

{0x00003000, 0x00003001, 0x00003002}

These identifiers correspond to the following columns in the Attribute table:

"AttributeRequestId", "AttributeName", "AttributeValue"

Windows 2000 Server returns E_INVALIDARG for this value of the iColumnSetDefault parameter.

<42> Section 3.1.4.1.10: Windows Server 2003, Windows Server 2008, Windows Server 2008 R2, and Windows Server 8 Beta send the column identifiers as the following DWORD array.

{0x00005000, 0x00005001, 0x00005002, 0x00005003, 0x00005004,
 0x00005005, 0x00005006, 0x00005007, 0x00005008, 0x00005009,
 0x0000500a, 0x0000500b, 0x0000500c, 0x0000500d, 0x0000500e,
 0x0000500f, 0x00005010}

These identifiers correspond to the following columns in the CRL table:

"CRLRowId", "CRLNumber", "CrlMinBase", "CRLNameId", "CrlCount", "CRLThisUpdate", "CRLNextUpdate", "CRLThisPublish", "CRLNextPublish", "CRLEffective", "CRLPropagationComplete", "CRLLastPublish", "CRLPublishAttempts", "CRLPublishFlags", "CRLPublishStatusCode", "CRLPublishError", "CRLRawCRL"

Windows 2000 Server returns E_INVALIDARG for this value of the iColumnSetDefault parameter.

<43> Section 3.1.4.1.10: Windows Server 2003, Windows Server 2008, Windows Server 2008 R2, and Windows Server 8 Beta send the column identifiers as the following DWORD array.

{0x00001000, 0x00001010, 0x00002006, 0x00002008, 0x00002009,
 0x00002003, 0x00002016, 0x0000201e, 0x00002015,
 0x00002014, 0x00002017, 0x00002018, 0x00002013, 0x00002001,
 0x0000100d, 0x0000100e, 0x0000100f}

These identifiers correspond to the following columns in the Request table:

"Request.RequestId", "Request.RequesterName", "SerialNumber", "NotBefore", "NotAfter", "CertificateTemplate", "OrgUnit", "DomainComponent", "Organization", "Country", "CommonName", "Locality", "RawName", "RawCertificate", "Request.RevokedWhen", "Request.RevokedEffectiveWhen", "Request.RevokedReason"

Windows 2000 Server returns E_INVALIDARG for this value of the iColumnSetDefault parameter.

<44> Section 3.1.4.1.18: In Windows Server 2003, Windows Server 2008, Windows Server 2008 R2, and Windows Server 8 Beta, the error is E_ACCESSDENIED (0x80070005). Windows 2000 does not return an error.

<45> Section 3.1.4.1.18: In Windows Server 2003, Windows Server 2008, Windows Server 2008 R2, and Windows Server 8 Beta, the Windows CA defines local configuration to restrict programmatic access to some backup-related methods from a remote computer.

The Windows CA enforces this restriction based on the value of the following registry key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CertSvc\Configuration\{CA Name}\InterfaceFlags.

<46> Section 3.1.4.1.19: In Windows Server 2003, Windows Server 2008, Windows Server 2008 R2, and Windows Server 8 Beta, the error is E_ACCESSDENIED (0x80070005). Windows 2000 does not return an error.

<47> Section 3.1.4.1.19: In Windows Server 2003, Windows Server 2008, Windows Server 2008 R2, and Windows Server 8 Beta, the Windows CA defines local configuration to restrict programmatic access to some backup-related methods from a remote computer.

The Windows CA enforces this restriction based on the value of the following registry key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CertSvc\Configuration\{CA Name}\InterfaceFlags

<48> Section 3.1.4.1.20: In Windows Server, the Windows CA defines local configuration to restrict programmatic access to some backup-related methods from a remote computer.

The Windows CA enforces this restriction based on the value of the following registry key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CertSvc\Configuration\{CA Name}\InterfaceFlags.

<49> Section 3.1.4.1.20: In Windows Server 2003 the error is ERROR_UNEXPECTED_ERROR (0x8000FFFF). In Windows Server 2008, Windows Server 2008 R2, and Windows Server 8 Beta, the error is E_ACCESSDENIED (0x80070005). Windows 2000 does not return an error.

<50> Section 3.1.4.1.21: In Windows Server 2003, Windows Server 2008, Windows Server 2008 R2, and Windows Server 8 Beta, the Windows CA defines local configuration to restrict programmatic access to some backup-related methods from a remote computer.

The Windows CA enforces this restriction based on the value of the following registry key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CertSvc\Configuration\{CA Name}\InterfaceFlags

<51> Section 3.1.4.1.21: In Windows Server 2003, the error is ERROR_UNEXPECTED_ERROR (0x8000FFFF). In Windows Server 2008, Windows Server 2008 R2, and Windows Server 8 Beta, the error is E_ACCESSDENIED (0x80070005). Windows 2000 does not return an error.

<52> Section 3.1.4.1.22: In Windows Server 2003, Windows Server 2008, Windows Server 2008 R2, and Windows Server 8 Beta, the Windows CA defines local configuration to restrict programmatic access to some backup-related methods from a remote computer.

The Windows CA enforces this restriction based upon the value of the following registry key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CertSvc\Configuration\{CA Name}\InterfaceFlags

<53> Section 3.1.4.1.22: Windows 2000 does not return an error. In Windows Server 2003, the error is ERROR_UNEXPECTED_ERROR (0x8000FFFF). In Windows Server 2008, Windows Server 2008 R2, and Windows Server 8 Beta, the error is E_ACCESSDENIED (0x80070005).

<54> Section 3.1.4.1.23: In Windows Server 2003, Windows Server 2008, Windows Server 2008 R2, and Windows Server 8 Beta, the Windows CA defines local configuration to restrict programmatic access to some backup-related methods from a remote computer.

The Windows CA enforces this restriction based on the value of the following registry key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CertSvc\Configuration\{CA Name}\InterfaceFlags.

<55> Section 3.1.4.1.23: In Windows Server 2003, the error is ERROR_UNEXPECTED_ERROR (0x8000FFFF). In Windows Server 2008, Windows Server 2008 R2, and Windows Server 8 Beta, the error is E_ACCESSDENIED (0x80070005). Windows 2000 does not return an error.

<56> Section 3.1.4.1.24: In Windows Server 2008, Windows Server 2008 R2, and Windows Server 8 Beta, the error is E_ACCESSDENIED (0x80070005). Windows Server 2003 and Windows 2000 do not return an error.

<57> Section 3.1.4.1.25: In Windows Server 2003, the error is ERROR_UNEXPECTED_ERROR (0x8000FFFF). In Windows Server 2008, Windows Server 2008 R2, and Windows Server 8 Beta, the error is E_ACCESSDENIED (0x80070005). Windows 2000 does not return an error.

<58> Section 3.1.4.1.25: In Windows Server 2003, Windows Server 2008, Windows Server 2008 R2, and Windows Server 8 Beta, the Windows CA defines local configuration to restrict programmatic access to some backup-related methods from a remote computer.

The Windows CA enforces this restriction based upon the value of the following registry key:HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CertSvc\Configuration\{CA Name}\InterfaceFlags

<59> Section 3.1.4.1.26: The Microsoft CA maintains local configuration to allow or prevent the importing of foreign certificates, regardless of the value of dwFlags. The configuration is stored in the registry at the location that is specified in the following code example. If the registry value is set to 1, the ImportCertificate method works as documented. If it is set to 0, the FLAG_ALLOW_IMPORT_FOREIGN flag that is passed as a parameter has no effect, and 0x800b0107 is returned.

HKLM\SYSTEM\CurrentControlSet\Services\CertSvc\Configuration\{CA Name}
\KRAFlags (REG_DWORD)

<60> Section 3.1.4.1.26: The Microsoft CA maintains local configuration to allow or prevent the importing of foreign certificates regardless of the value of dwFlags. The configuration is stored in the registry at the location specified in the following code example. If the registry value is set to 1, the ImportCertificate method works as documented. If it is set to 0, the FLAG_ALLOW_IMPORT_FOREIGN flag that is passed as a parameter does not have an effect, and 0x800b0107 is returned.

HKLM\SYSTEM\CurrentControlSet\Services\CertSvc\Configuration\{CA Name}
\KRAFlags (REG_DWORD)

<61> Section 3.1.4.1.27: In Windows Server 2008, Windows Server 2008 R2, and Windows Server 8 Beta, the error is E_ACCESSDENIED (0x80070005). Windows Server 2003 and Windows 2000 do not return an error.

<62> Section 3.1.4.1.28: In Windows Server 2008, Windows Server 2008 R2, and Windows Server 8 Beta, the error is E_ACCESSDENIED (0x80070005). Windows Server 2003 and Windows 2000 do not return an error.

<63> Section 3.1.4.2: The supported clients are Windows XP, Windows Vista, Windows 7, and Windows 8 Consumer Preview. The supported servers are Windows Server 2003, Windows Server 2008, Windows Server 2008 R2, and Windows Server 8 Beta.

<64> Section 3.1.4.2: In Windows 2000, Windows Server 2003, Windows Server 2008, Windows Server 2008 R2, and Windows Server 8 Beta, the error is E_ACCESSDENIED (0x80070005).

<65> Section 3.1.4.2: In Windows Server 2003, Windows Server 2008, Windows Server 2008 R2, and Windows Server 8 Beta, the error is E_ACCESSDENIED (0x80070005). Windows 2000 does not return an error.

<66> Section 3.1.4.2.1: The Microsoft CA keeps this list in a registry multistring value.

HKLM\SYSTEM\CurrentControlSet\Services\CertSvc\Configuration\
{CA Name}\CRLPublicationURLs

A specific protocol method does not exist to manipulate this list. Instead, the Microsoft CA uses typical registry manipulation tools.

The default values that are used by the Microsoft CA are a local path on the CA machine,

{SYSTEM}\CertSrv\CertEnroll\

a local path in the registry,

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs\

and the Active Directory path,

ldap: ///CN={CAName}{index},CN={CAServerName},CN=CDP,
CN=Public Key Services,CN=Services,CN=Configuration,DC={contoso},DC=com

where:

• SYSTEM is replaced with the system directory of the CA machine, such as "C:\Windows\System32".

• CAName is replaced with the sanitized name of the CA, as defined in [MS-WCCE] sections 1.3.2.3 and 3.1.1.4.1.1.

• {CRLNameSuffix} is replaced with NULL if the CRL is signed by the first CA key (the CA key that has a key index 0) and by "(n)" if the CRL is signed by any subsequent CA key, with {n} being an integer equal to the identifier (Signing_Private_Key_Version_ID, as defined in [MS-WCCE] section 3.2.1.1.3) of the CA certificate private key.

• CAServerName is replaced with the name of the host on which the CA is running.

• DC={contoso},DC=com is replaced with the namespace of the Active Directorydomain in which the Microsoft CA is installed.

<67> Section 3.1.4.2.1: The Microsoft CA keeps this list in the following registry multistring value. Note that the value is the same as that specified in the preceding Windows behavior note.

HKLM\SYSTEM\CurrentControlSet\Services\CertSvc\Configuration\
{CA Name}\CRLPublicationURLs

<68> Section 3.1.4.2.5: This rule applies only to a Windows Server 2008, Windows Server 2008 R2, or Windows Server 8 Beta CA. In Windows 2000 and Windows Server 2003, a CA will not enforce that cColumn is greater than 0. Rather, when cColumn is equal to zero, it will set pcColumn equal to zero, pctbColumnInfo->cb equal to 0, pctbColumnInfo->pb will point to a zero-length item, and the function will return successfully.

<69> Section 3.1.4.2.14: The Windows CA uses subkeys that use the following key as a node path:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CertSvc\Configuration\<CA_
CN>

where <CA_CN> is replaced with the CN of the CA.

<70> Section 3.1.4.2.14: The Windows CA uses a registry value name under the registry key that is composed by adding the value of the pwszNodePath parameter to the registry key:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CertSvc\Configuration\<CA_
CN>

where <CA_CN> is replaced with the CA's common name (CN).