Was this page helpful?
Additional feedback?
1500 characters remaining
Export (0) Print
Expand All

7 Appendix B: Product Behavior

The information in this specification is applicable to the following Microsoft products or supplemental software. References to product versions include released service packs.

Note: Some of the information in this section is subject to change because it applies to a preliminary product version, and thus may differ from the final version of the software when released. All behavior notes that pertain to the preliminary product version contain specific references to it as an aid to the reader.

  • Windows 2000 operating system

  • Windows XP operating system

  • Windows Server 2003 operating system

  • Windows Vista operating system

  • Windows Server 2008 operating system

  • Windows 7 operating system

  • Windows Server 2008 R2 operating system

  • Windows 8 operating system

  • Windows Server 2012 operating system

  • Windows 8.1 operating system

  • Windows Server 2012 R2 operating system

  • Windows 10 operating system

  • Windows Server 2016 Technical Preview operating system

Exceptions, if any, are noted below. If a service pack or Quick Fix Engineering (QFE) number appears with the product version, behavior changed in that service pack or QFE. The new behavior also applies to subsequent service packs of the product unless otherwise specified. If a product edition appears with the product version, behavior is different in that product edition.

Unless otherwise specified, any statement of optional behavior in this specification that is prescribed using the terms SHOULD or SHOULD NOT implies product behavior in accordance with the SHOULD or SHOULD NOT prescription. Unless otherwise specified, the term MAY implies that the product does not follow the prescription.

<1> Section 2.1: The following values are used by the Certificate Services Remote Administration Protocol client and server.

Constant/value

Description

d99e6e71-fc88-11d0-b498-00a0c90312f3

UUID for the ICertAdminD interface

7fe0d935-dda6-443f-85d0-1cfb58fe41dd

UUID for the ICertAdminD2 interface

<2> Section 2.1: On a Windows computer, if NULL authentication identity and credentials is passed, the RPC_C_AUTHN_GSS_NEGOTIATE  security provider uses the identity and credentials from the process token of the process in which the higher layer application is running. This means the account on which the Certificate Services Remote Administration Protocol client is running is the account whose identity will be sent as the identity of the ORPC call.

<3> Section 2.2.2.2:

Windows Server 2003 will use key recovery certificates that contain the following X.509v3 extensions specific to Windows:

  • Application Policies (Policy Identifier = Key Recovery Agent)

  • Certificate Template Information

Key recovery certificates, when issued by a Windows enterprise CA, are automatically written to the configuration container of Active Directory. The actual certificates are published to the userCertificate attribute (1) (as specified in [RFC4523]) of the key recovery agent (KRA) object when issued to a member of the domain administrators group in Active Directory.

<4> Section 3.1.1: Windows implements the version-specific Request, Attribute, Extension, and CRL database tables as detailed in the following tables.

Request Tables

The following table details the Request table for Windows 2000 Server operating system.

Column identifier

Data type

Maximum size of data

Column name (ADM element)*

Column display name

0x1000

0x10001

4 bytes

"Request.RequestID"

(Request_Request_ID)

"Request ID"

0x1001

0x3

65536 bytes

"Request.RawRequest"

(Request_Raw_Request)

"Binary Request"

0x1002

0x3

16384 bytes

"Request.RawOldCertificate"

"Old Certificate"

0x1003

0x4

32768 bytes

"Request.RequestAttributes"

(Request_Request_Attributes)

"Request Attributes"

0x1004

0x1

4 bytes

"Request.RequestType"

(Request_Request_Type)

"Request Type"

0x1005

0x1

4 bytes

"Request.RequestFlags"

(Request_Request_Flags)

"Request Flags"

0x1006

0x1

4 bytes

"Request.Status"

"Request Status"

0x1007

0x1

4 bytes

"Request.StatusCode"

(Request_Status_Code)

"Request Status Code"

0x1008

0x10001

4 bytes

"Request.Disposition"

(Request_Disposition)

"Request Disposition"

0x1009

0x4

8192 bytes

"Request.DispositionMessage"

(Request_Disposition_Message)

"Request Disposition Message"

0x100a

0x2

8 bytes

"Request.SubmittedWhen"

(Request_Submitted_When)

"Request Submission Date"

0x100b

0x2

8 bytes

"Request.ResolvedWhen"

(Request_Resolved_When)

"Request Resolution Date"

0x100c

0x2

8 bytes

"Request.RevokedWhen"

(Request_Revoked_When)

"Revocation Date"

0x100d

0x2

8 bytes

"Request.RevokedEffectiveWhen"

(Request_Revocation_Date)

"Effective Revocation Date"

0x100e

0x1

4 bytes

"Request.RevokedReason"

(Request_Revoked_Reason)

"Revocation Reason"

0x100f

0x4

2048 bytes

"Request.RequesterName"

(Request_Requester_Name)

"Requester Name"

0x1010

0x4

2048 bytes

"Request.RequesterAddress"

"Requester Address"

0x1011

0x4

8192 bytes

"Request.DistinguishedName"

(Request_Distinguished_Name)

"Request Distinguished Name"

0x1012

0x3

4096 bytes

"Request.RawName"

(Request_Raw_Name)

"Request Binary Name"

0x1013

0x1

4 bytes

"Request.NameType"

"Request Name Type"

0x1014

0x4

8192 bytes

"Request.Country"

(Request_Country)

"Request Country/Region"

0x1015

0x4

8192 bytes

"Request.Organization"

(Request_Organization)

"Request Organization"

0x1016

0x4

8192 bytes

"Request.OrgUnit"

(Request_Org_Unit)

"Request Organization Unit"

0x1017

0x4

8192 bytes

"Request.CommonName"

(Request_Common_Name)

"Request Common Name"

0x1018

0x4

8192 bytes

"Request.Locality"

(Request_Locality)

"Request City"

0x1019

0x4

8192 bytes

"Request.State"

(Request_State)

"Request State"

0x101a

0x4

8192 bytes

"Request.Title"

(Request_Title)

"Request Title"

0x101b

0x4

8192 bytes

"Request.GivenName"

(Request_Given_Name)

"Request First Name"

0x101c

0x4

8192 bytes

"Request.Initials"

(Request_Initials)

"Request Initials"

0x101d

0x4

8192 bytes

"Request.SurName"

(Request_SurName)

"Request Last Name"

0x101e

0x4

8192 bytes

"Request.DomainComponent"

(Request_Domain_Component)

"Request Domain Component"

0x101f

0x4

8192 bytes

"Request.EMail"

(Request_Email)

"Request Email Address"

0x1020

0x4

8192 bytes

"Request.StreetAddress"

(Request_Street_Address)

"Request Street Address"

0x1021

0x4

8192 bytes

"Request.UnstructuredName"

(Request_Unstructured_Name)

"Request Unstructured Name"

0x1022

0x4

8192 bytes

"Request.UnstructuredAddress"

(Request_Unstructured_Address)

"Request Unstructured Address"

0x1023

0x4

8192 bytes

"Request.DeviceSerialNumber"

(Request_Device_Serial_Number)

"Request Device Serial Number"

0x2000

0x10001

4 bytes

"RequestID"

(Request_ID)

"Issued Request ID"

0x2001

0x3

16384 bytes

"RawCertificate"

(Raw_Certificate)

"Binary Certificate"

0x2002

0x4

128 bytes

"CertificateHash"

(Certificate_Hash)

"Certificate Hash"

0x2003

0x4

254 bytes

"CertificateType"

(Certificate_Template)

"Certificate Type"

0x2004

0x10004

128 bytes

"SerialNumber"

(Serial_Number)

"Serial Number"

0x2005

0x1

4 bytes

"IssuerNameId"

(Issuer_Name_Id)

"Issuer Name ID"

0x2006

0x2

8 bytes

"NotBefore"

(Not_Before)

"Certificate Effective Date"

0x2007

0x10002

8 bytes

"NotAfter"

(Not_After)

"Certificate Expiration Date"

0x2008

0x3

4096 bytes

"RawPublicKey"

(Raw_Public_Key)

"Binary Public Key"

0x2009

0x4

254 bytes

"PublicKeyAlgorithm"

(Public_Key_Algorithm)

"Public Key Algorithm"

0x200a

0x3

4096 bytes

"RawPublicKeyAlgorithmParameters"

(Raw_Public_Key_Algorithm_Parameters)

"Public Key Algorithm Parameters"

0x200b

0x4

8192 bytes

"DistinguishedName"

(Distinguished_Name)

"Issued Distinguished Name"

0x200c

0x3

4096bytes

"RawName"

(Raw_Name)

"Issued Binary Name"

0x200d

0x1

4 bytes

"NameType"

"Issued Name Type"

0x200e

0x4

8192 bytes

"Country"

(Country)

"Issued Country/Region"

0x200f

0x4

8192 bytes

"Organization"

(Organization)

"Issued Organization"

0x2010

0x4

8192 bytes

"OrgUnit"

(Org_Unit)

"Issued Organization Unit"

0x2011

0x10004

8192 bytes

"CommonName"

(Common_Name)

"Issued Common Name"

0x2012

0x4

8192 bytes

"Locality"

(Locality)

"Issued City"

0x2013

0x4

8192 bytes

"State"

(State)

"Issued State"

0x2014

0x4

8192 bytes

"Title"

(Title)

"Issued Title"

0x2015

0x4

8192 bytes

"GivenName"

(Given_Name)

"Issued First Name"

0x2016

0x4

8192 bytes

"Initials"

(Initials)

"Issued Initials"

0x2017

0x4

8192 bytes

"SurName"

(SurName)

"Issued Last Name"

0x2018

0x4

8192 bytes

"DomainComponent"

(Domain_Component)

"Issued Domain Component"

0x2019

0x4

8192 bytes

"EMail"

(Email)

"Issued Email address"

0x201a

0x4

8192 bytes

"StreetAddress"

(Street_Address)

"Issued Street Address"

0x201b

0x4

8192 bytes

"UnstructuredName"

(Unstructured_Name)

"Issued Unstructured Name"

0x201c

0x4

8192 bytes

"UnstructuredAddress"

(Unstructured_Address)

"Issued Unstructured Address"

0x201d

0x4

8192 bytes

"DeviceSerialNumber"

(Device_Serial_Number)

"Issued Device Serial Number"

0x201e

0x3

16384 bytes

"RawSMIMECapabilities"

"Issued SMIME Capabilities"

* Not all database columns have associated ADM elements.

The following table details the Request table for Windows Server 2003.

Column identifier

Data Type

Maximum size of data

Column name (ADM element)

Column display name

0x1000

0x10001

4 bytes

"Request.RequestID"

(Request_Request_ID)

"Request ID"

0x1001

0x3

65536 bytes

"Request.RawRequest"

(Request_Raw_Request)

"Binary Request"

0x1002

0x3

65536 bytes

"Request.RawArchivedKey"

(Request_Raw_ArchivedKey)

"Archived Key"

0x1003

0x4

8192 bytes

"Request.KeyRecoveryHashes"

(Request_Key_Recovery_Hashes)

"Key Recovery Agent Hashes"

0x1004

0x3

16384 bytes

"Request.RawOldCertificate"

(Request_Raw_Old_Certificate)

"Old Certificate"

0x1005

0x4

32768 bytes

"Request.RequestAttributes"

(Request_Request_Attributes)

"Request Attributes"

0x1006

0x1

4 bytes

"Request.RequestType"

(Request_Request_Type)

"Request Type"

0x1007

0x1

4 bytes

"Request.RequestFlags"

(Request_Request_Flags)

"Request Flags"

0x1008

0x1

4 bytes

"Request.StatusCode"

(Request_Status_Code)

"Request Status Code"

0x1009

0x10001

4 bytes

"Request.Disposition"

(Request_Disposition)

"Request Disposition"

0x100a

0x4

8192 bytes

"Request.DispositionMessage"

(Request_Disposition_Message)

"Request Disposition Message"

0x100b

0x10002

8 bytes

"Request.SubmittedWhen"

(Request_Submitted_When)

"Request Submission Date"

0x100c

0x10002

8 bytes

"Request.ResolvedWhen"

(Request_Resolved_When)

"Request Resolution Date"

0x100d

0x2

8 bytes

"Request.RevokedWhen"

(Request_Revoked_When)

"Revocation Date"

0x100e

0x10002

8 bytes

"Request.RevokedEffectiveWhen"

(Request_Revocation_Date)

"Effective Revocation Date"

0x100f

0x1

4 bytes

"Request.RevokedReason"

(Request_Revoked_Reason)

"Revocation Reason"

0x1010

0x10004

2048 bytes

"Request.RequesterName"

(Request_Requester_Name)

"Requester Name"

0x1011

0x10004

2048 bytes

"Request.CallerName"

(Request_Caller_Name)

"Caller Name"

0x1012

0x4

8192 bytes

"Request.SignerPolicies"

(Request_Signer_Policies)

"Signer Policies"

0x1013

0x4

8192 bytes

"Request.SignerApplicationPolicies"

(Request_Signer_Application_Policies)

"Signer Application Policies"

0x1014

0x1

4 bytes

"Request.Officer"

(Request_Officer)

"Officer"

0x1015

0x4

8192 bytes

"Request.DistinguishedName"

(Request_Distinguished_Name)

"Request Distinguished Name"

0x1016

0x3

4096 bytes

"Request.RawName"

(Request_Raw_Name)

"Request Binary Name"

0x1017

0x4

8192 bytes

"Request.Country"

(Request_Country)

"Request Country/Region"

0x1018

0x4

8192 bytes

"Request.Organization"

(Request_Organization)

"Request Organization"

0x1019

0x4

8192 bytes

"Request.OrgUnit"

(Request_Org_Unit)

"Request Organization Unit"

0x101a

0x4

8192 bytes

"Request.CommonName"

(Request_Common_Name)

"Request Common Name"

0x101b

0x4

8192 bytes

"Request.Locality"

(Request_Locality)

"Request City"

0x101c

0x4

8192 bytes

"Request.State"

(Request_State)

"Request State"

0x101d

0x4

8192 bytes

"Request.Title"

(Request_Title)

"Request Title"

0x101e

0x4

8192 bytes

"Request.GivenName"

(Request_Given_Name)

"Request First Name"

0x101f

0x4

8192 bytes

"Request.Initials"

(Request_Initials)

"Request Initials"

0x1020

0x4

8192 bytes

"Request.SurName"

(Request_SurName)

"Request Last Name"

0x1021

0x4

8192 bytes

"Request.DomainComponent"

(Request_Domain_Component)

"Request Domain Component"

0x1022

0x4

8192 bytes

"Request.EMail"

(Request_Email)

"Request Email Address"

0x1023

0x4

8192 bytes

"Request.StreetAddress"

(Request_Street_Address)

"Request Street Address"

0x1024

0x4

8192 bytes

"Request.UnstructuredName"

(Request_Unstructured_Name)

"Request Unstructured Name"

0x1025

0x4

8192 bytes

"Request.UnstructuredAddress"

(Request_Unstructured_Address)

"Request Unstructured Address"

0x1026

0x4

8192 bytes

"Request.DeviceSerialNumber"

(Request_Device_Serial_Number)

"Request Device Serial Number"

0x2000

0x10001

4 bytes

"RequestID"

(Request_ID)

"Issued Request ID"

0x2001

0x3

16384 bytes

"RawCertificate"

(Raw_Certificate)

"Binary Certificate"

0x2002

0x10004

128 bytes

"CertificateHash"

(Certificate_Hash)

"Certificate Hash"

0x2003

0x10004

254 bytes

"CertificateTemplate"

(Certificate_Template)

"Certificate Template"

0x2004

0x1

4 bytes

"EnrollmentFlags"

(Enrollment_Flags)

"Template Enrollment Flags"

0x2005

0x1

4 bytes

"GeneralFlags"

(General_Flags)

"Template General Flags"

0x2006

0x10004

128 bytes

"SerialNumber"

(Serial_Number)

"Serial Number"

0x2007

0x1

4 bytes

"IssuerNameId"

(Issuer_Name_Id)

"Issuer Name ID"

0x2008

0x2

8 bytes

"NotBefore"

(Not_Before)

"Certificate Effective Date"

0x2009

0x10002

8 bytes

"NotAfter"

(Not_After)

"Certificate Expiration Date"

0x200a

0x4

128 bytes

"SubjectKeyIdentifier"

(Subject_Key_Identifier)

"Issued Subject Key Identifier"

0x200b

0x3

4096 bytes

"RawPublicKey"

(Raw_Public_Key)

"Binary Public Key"

0x200c

0x1

4 bytes

"PublicKeyLength"

(Public_Key_Length)

"Public Key Length"

0x200d

0x4

254 bytes

"PublicKeyAlgorithm"

(Public_Key_Algorithm)

"Public Key Algorithm"

0x200e

0x3

4096 bytes

"RawPublicKeyAlgorithmParameters"

(Raw_Public_Key_Algorithm_Parameters)

"Public Key Algorithm Parameters"

0x200f

0x10004

2048 bytes

"UPN"

(UPN)

"User Principal Name"

0x2010

0x4

8192 bytes

"DistinguishedName"

(Distinguished_Name)

"Issued Distinguished Name"

0x2011

0x3

4096 bytes

"RawName"

(Raw_Name)

"Issued Binary Name"

0x2012

0x4

8192 bytes

"Country"

(Country)

"Issued Country/Region"

0x2013

0x4

8192 bytes

"Organization"

(Organization)

"Issued Organization"

0x2014

0x4

8192 bytes

"OrgUnit"

(Org_Unit)

"Issued Organization Unit"

0x2015

0x10004

8192 bytes

"CommonName"

(Common_Name)

"Issued Common Name"

0x2016

0x4

8192 bytes

"Locality"

(Locality)

"Issued City"

0x2017

0x4

8192 bytes

"State"

(State)

"Issued State"

0x2018

0x4

8192 bytes

"Title"

(Title)

"Issued Title"

0x2019

0x4

8192 bytes

"GivenName"

(Given_Name)

"Issued First Name"

0x201a

0x4

8192 bytes

"Initials"

(Initials)

"Issued Initials"

0x201b

0x4

8192 bytes

"SurName"

(SurName)

"Issued Last Name"

0x201c

0x4

8192 bytes

"DomainComponent"

(Domain_Component)

"Issued Domain Component"

0x201d

0x4

8192 bytes

"EMail"

(Email)

"Issued Email address"

0x201e

0x4

8192 bytes

"StreetAddress"

(Street_Address)

"Issued Street Address"

0x201f

0x4

8192 bytes

"UnstructuredName"

(Unstructured_Name)

"Issued Unstructured Name"

0x2020

0x4

8192 bytes

"UnstructuredAddress"

(Unstructured_Address)

"Issued Unstructured Address"

0x2021

0x4

8192 bytes

"DeviceSerialNumber"

(Device_Serial_Number)

"Issued Device Serial Number"

The following table details the Request table for Windows Server 2008 and Windows Server 2008 R2.

Column identifier

Data type

Maximum size of data

Column name (ADM element)

Column display name

0x1000

0x10001

4 bytes

Request.RequestID

(Request_Request_ID)

"Request ID"

0x1001

0x3

65536 bytes

"Request.RawRequest"

(Request_Raw_Request)

"Binary Request"

0x1002

0x3

65536 bytes

"Request.RawArchivedKey"

(Request_Raw_Archived_Key)

"Archived Key"

0x1003

0x4

8192 bytes

"Request.KeyRecoveryHashes"

(Request_Key_Recovery_Hashes)

"Key Recovery Agent Hashes"

0x1004

0x3

16384 bytes

"Request.RawOldCertificate"

(Request_Raw_Old_Certificate)

"Old Certificate"

0x1005

0x4

32768 bytes

"Request.RequestAttributes"

(Request_Request_Attributes)

"Request Attributes"

0x1006

0x1

4 bytes

"Request.RequestType"

(Request_Request_Type)

"Request Type"

0x1007

0x1

4 bytes

"Request.RequestFlags"

(Request_Request_Flags)

"Request Flags"

0x1008

0x1

4 bytes

"Request.StatusCode"

(Request_Status_Code)

"Request Status Code"

0x1009

0x10001

4 bytes

"Request.Disposition"

(Request_Disposition)

"Request Disposition"

0x100a

0x4

8192 bytes

"Request.DispositionMessage"

(Request_Disposition_Message)

"Request Disposition Message"

0x100b

0x10002

8 bytes

"Request.SubmittedWhen"

(Request_Submitted_When)

"Request Submission Date"

0x100c

0x10002

8 bytes

"Request.ResolvedWhen"

(Request_Resolved_When)

"Request Resolution Date"

0x100d

0x2

8 bytes

"Request.RevokedWhen"

(Request_Revoked_When)

"Revocation Date"

0x100e

0x10002

8 bytes

"Request.RevokedEffectiveWhen"

(Request_Revocation_Date)

"Effective Revocation Date"

0x100f

0x1

4 bytes

"Request.RevokedReason"

(Request_Revoked_Reason)

"Revocation Reason"

0x1010

0x10004

2048 bytes

"Request.RequesterName"

(Request_Requester_Name)

"Requester Name"

0x1011

0x10004

2048 bytes

"Request.CallerName"

(Request_Caller_Name)

"Caller Name"

0x1012

0x4

8192 bytes

"Request.SignerPolicies"

(Request_Signer_Policies)

"Signer Policies"

0x1013

0x4

8192 bytes

"Request.SignerApplicationPolicies"

(Request_Signer_Application_Policies)

"Signer Application Policies"

0x1014

0x1

4 bytes

"Request.Officer"

(Request_Officer)

"Officer"

0x1015

0x4

8192 bytes

"Request.DistinguishedName"

(Request_Distinguished_Name)

"Request Distinguished Name"

0x1016

0x3

4096 bytes

"Request.RawName"

(Request_Raw_Name)

"Request Binary Name"

0x1017

0x4

8192 bytes

"Request.Country"

(Request_Country)

"Request Country/Region"

0x1018

0x4

8192 bytes

"Request.Organization"

(Request_Organization)

"Request Organization"

0x1019

0x4

8192 bytes

"Request.OrgUnit"

(Request_Org_Unit)

"Request Organization Unit"

0x101a

0x4

8192 bytes

"Request.CommonName"

(Request_Common_Name)

"Request Common Name"

0x101b

0x4

8192 bytes

"Request.Locality"

(Request_Locality)

"Request City"

0x101c

0x4

8192 bytes

"Request.State"

(Request_State)

"Request State"

0x101d

0x4

8192 bytes

"Request.Title"

(Request_Title)

"Request Title"

0x101e

0x4

8192 bytes

"Request.GivenName"

(Request_Given_Name)

"Request First Name"

0x101f

0x4

8192 bytes

"Request.Initials"

(Request_Initials)

"Request Initials"

0x1020

0x4

8192 bytes

"Request.SurName"

(Request_SurName)

"Request Last Name"

0x1021

0x4

8192 bytes

"Request.DomainComponent"

(Request_Domain_Component)

"Request Domain Component"

0x1022

0x4

8192 bytes

"Request.EMail"

(Request_Email)

"Request Email Address"

0x1023

0x4

8192 bytes

"Request.StreetAddress"

(Request_Street_Address)

"Request Street Address"

0x1024

0x4

8192 bytes

"Request.UnstructuredName"

(Request_Unstructured_Name)

"Request Unstructured Name"

0x1025

0x4

8192 bytes

"Request.UnstructuredAddress"

(Request_Unstructured_Address)

"Request Unstructured Address"

0x1026

0x4

8192 bytes

"Request.DeviceSerialNumber"

(Request_Device_Serial_Number)

"Request Device Serial Number"

0x2000

0x10001

4 bytes

"RequestID"

(Request_ID)

"Issued Request ID"

0x2001

0x3

16384 bytes

"RawCertificate"

(Raw_Certificate)

"Binary Certificate"

0x2002

0x10004

128 bytes

"CertificateHash"

(Certificate_Hash)

"Certificate Hash"

0x2003

0x10004

254 bytes

"CertificateTemplate"

(Certificate_Template)

"Certificate Template"

0x2004

0x1

4 bytes

"EnrollmentFlags"

(Enrollment_Flags)

"Template Enrollment Flags"

0x2005

0x1

4 bytes

"GeneralFlags"

(General_Flags)

"Template General Flags"

0x2006

0x10004

128 bytes

"SerialNumber"

(Serial_Number)

"Serial Number"

0x2007

0x1

4 bytes

"IssuerNameId"

(Issuer_Name_Id)

"Issuer Name ID"

0x2008

0x2

8 bytes

"NotBefore"

(Not_Before)

"Certificate Effective Date"

0x2009

0x10002

8 bytes

"NotAfter"

(Not_After)

"Certificate Expiration Date"

0x200a

0x4

128 bytes

"SubjectKeyIdentifier"

(Subject_Key_Identifier)

"Issued Subject Key Identifier"

0x200b

0x3

4096 bytes

"RawPublicKey"

(Raw_Public_Key)

"Binary Public Key"

0x200c

0x1

4 bytes

"PublicKeyLength"

(Public_Key_Length)

"Public Key Length"

0x200d

0x4

254 bytes

"PublicKeyAlgorithm"

(Public_Key_Algorithm)

"Public Key Algorithm"

0x200e

0x3

4096 bytes

"RawPublicKeyAlgorithmParameters"

(Raw_Public_Key_Algorithm_Parameters)

"Public Key Algorithm Parameters"

0x200f

0x1

4 bytes

"PublishExpiredCertInCRL"

(Publish_Expired_Cert_In_CRL)

"Publish Expired Certificate in CRL"

0x2010

0x10004

2048 bytes

"UPN"

(UPN)

"User Principal Name"

0x2011

0x4

8192 bytes

"DistinguishedName"

(Distinguished_Name)

"Issued Distinguished Name"

0x2012

0x3

4096 bytes

"RawName"

(Raw_Name)

"Issued Binary Name"

0x2013

0x4

8192 bytes

"Country"

(Country)

"Issued Country/Region"

0x2014

0x4

8192 bytes

"Organization"

(Organization)

"Issued Organization"

0x2015

0x4

8192 bytes

"OrgUnit"

(Org_Unit)

"Issued Organization Unit"

0x2016

0x10004

8192 bytes

"CommonName"

(Common_Name)

"Issued Common Name"

0x2017

0x4

8192 bytes

"Locality"

(Locality)

"Issued City"

0x2018

0x4

8192 bytes

"State"

(State)

"Issued State"

0x2019

0x4

8192 bytes

"Title"

(Title)

"Issued Title"

0x201a

0x4

8192 bytes

"GivenName"

(Given_Name)

"Issued First Name"

0x201b

0x4

8192 bytes

"Initials"

(Initials)

"Issued Initials"

0x201c

0x4

8192 bytes

"SurName"

(SurName)

"Issued Last Name"

0x201d

0x4

8192 bytes

"DomainComponent"

(Domain_Component)

"Issued Domain Component"

0x201e

0x4

8192 bytes

"EMail"

(Email)

"Issued Email address"

0x201f

0x4

8192 bytes

"StreetAddress"

(Street_Address)

"Issued Street Address"

0x2020

0x4

8192 bytes

"UnstructuredName"

(Unstructured_Name)

"Issued Unstructured Name"

0x2021

0x4

8192 bytes

"UnstructuredAddress"

(Unstructured_Address)

"Issued Unstructured Address"

0x2022

0x4

8192 bytes

"DeviceSerialNumber"

(Device_Serial_Number)

"Issued Device Serial Number"

The following table details the Request table for Windows Server 2012, Windows Server 2012 R2, and Windows Server 2016 Technical Preview.

Column identifier

Data type

Maximum size of data

Column name (ADM element)

Column display name

0x1000

0x10001

4 bytes

Request.RequestID

(Request_Request_ID)

"Request ID"

0x1001

0x3

65536 bytes

"Request.RawRequest"

(Request_Raw_Request)

"Binary Request"

0x1002

0x3

65536 bytes

"Request.RawArchivedKey"

(Request_Raw_Archived_Key)

"Archived Key"

0x1003

0x4

8192 bytes

"Request.KeyRecoveryHashes"

(Request_Key_Recovery_Hashes)

"Key Recovery Agent Hashes"

0x1004

0x3

16384 bytes

"Request.RawOldCertificate"

(Request_Raw_Old_Certificate)

"Old Certificate"

0x1005

0x4

32768 bytes

"Request.RequestAttributes"

(Request_Request_Attributes)

"Request Attributes"

0x1006

0x1

4 bytes

"Request.RequestType"

(Request_Request_Type)

"Request Type"

0x1007

0x1

4 bytes

"Request.RequestFlags"

(Request_Request_Flags)

"Request Flags"

0x1008

0x1

4 bytes

"Request.StatusCode"

(Request_Status_Code)

"Request Status Code"

0x1009

0x10001

4 bytes

"Request.Disposition"

(Request_Disposition)

"Request Disposition"

0x100a

0x4

8192 bytes

"Request.DispositionMessage"

(Request_Disposition_Message)

"Request Disposition Message"

0x100b

0x10002

8 bytes

"Request.SubmittedWhen"

(Request_Submitted_When)

"Request Submission Date"

0x100c

0x10002

8 bytes

"Request.ResolvedWhen"

(Request_Resolved_When)

"Request Resolution Date"

0x100d

0x2

8 bytes

"Request.RevokedWhen"

(Request_Revoked_When)

"Revocation Date"

0x100e

0x10002

8 bytes

"Request.RevokedEffectiveWhen"

(Request_Revocation_Date)

"Effective Revocation Date"

0x100f

0x1

4 bytes

"Request.RevokedReason"

(Request_Revoked_Reason)

"Revocation Reason"

0x1010

0x10004

2048 bytes

"Request.RequesterName"

(Request_Requester_Name)

"Requester Name"

0x1011

0x10004

2048 bytes

"Request.CallerName"

(Request_Caller_Name)

"Caller Name"

0x1012

0x4

8192 bytes

"Request.SignerPolicies"

(Request_Signer_Policies)

"Signer Policies"

0x1013

0x4

8192 bytes

"Request.SignerApplicationPolicies"

(Request_Signer_Application_Policies)

"Signer Application Policies"

0x1014

0x1

4 bytes

"Request.Officer"

(Request_Officer)

"Officer"

0x1015

0x4

8192 bytes

"Request.DistinguishedName"

(Request_Distinguished_Name)

"Request Distinguished Name"

0x1016

0x3

4096 bytes

"Request.RawName"

(Request_Raw_Name)

"Request Binary Name"

0x1017

0x4

8192 bytes

"Request.Country"

(Request_Country)

"Request Country/Region"

0x1018

0x4

8192 bytes

"Request.Organization"

(Request_Organization)

"Request Organization"

0x1019

0x4

8192 bytes

"Request.OrgUnit"

(Request_Org_Unit)

"Request Organization Unit"

0x101a

0x4

8192 bytes

"Request.CommonName"

(Request_Common_Name)

"Request Common Name"

0x101b

0x4

8192 bytes

"Request.Locality"

(Request_Locality)

"Request City"

0x101c

0x4

8192 bytes

"Request.State"

(Request_State)

"Request State"

0x101d

0x4

8192 bytes

"Request.Title"

(Request_Title)

"Request Title"

0x101e

0x4

8192 bytes

"Request.GivenName"

(Request_Given_Name)

"Request First Name"

0x101f

0x4

8192 bytes

"Request.Initials"

(Request_Initials)

"Request Initials"

0x1020

0x4

8192 bytes

"Request.SurName"

(Request_SurName)

"Request Last Name"

0x1021

0x4

8192 bytes

"Request.DomainComponent"

(Request_Domain_Component)

"Request Domain Component"

0x1022

0x4

8192 bytes

"Request.EMail"

(Request_Email)

"Request Email Address"

0x1023

0x4

8192 bytes

"Request.StreetAddress"

(Request_Street_Address)

"Request Street Address"

0x1024

0x4

8192 bytes

"Request.UnstructuredName"

(Request_Unstructured_Name)

"Request Unstructured Name"

0x1025

0x4

8192 bytes

"Request.UnstructuredAddress"

(Request_Unstructured_Address)

"Request Unstructured Address"

0x1026

0x4

8192 bytes

"Request.DeviceSerialNumber"

(Request_Device_Serial_Number)

"Request Device Serial Number"

0x1027 *

0x3

4096 bytes

"Request.AttestationChallenge"

(Request_Attestation_Challenge)

"Attestation Challenge"

0x1028 *

0x4

144 bytes

"Request.EndorsementKeyHash"

(Request_Endorsement_Key_Hash)

"Endorsement Key Hash"

0x1029 *

0x4

144 bytes

"Request.EndorsementCertificateHash"

(Request_Endorsement_Certificate_Hash)

"Endorsement Certificate Hash"

0x2000

0x10001

4 bytes

"RequestID"

(Request_ID)

"Issued Request ID"

0x2001

0x3

16384 bytes

"RawCertificate"

(Raw_Certificate)

"Binary Certificate"

0x2002

0x10004

128 bytes

"CertificateHash"

(Certificate_Hash)

"Certificate Hash"

0x2003

0x10004

254 bytes

"CertificateTemplate"

(Certificate_Template)

"Certificate Template"

0x2004

0x1

4 bytes

"EnrollmentFlags"

(Enrollment_Flags)

"Template Enrollment Flags"

0x2005

0x1

4 bytes

"GeneralFlags"

(General_Flags)

"Template General Flags"

0x2006

0x1

4 bytes

"PrivateKeyFlags"

(PrivateKey_Flags)

"Private Key Flags"

0x2007

0x10004

128 bytes

"SerialNumber"

(Serial_Number)

"Serial Number"

0x2008

0x1

4 bytes

"IssuerNameId"

(Issuer_Name_Id)

"Issuer Name ID"

0x2009

0x2

8 bytes

"NotBefore"

(Not_Before)

"Certificate Effective Date"

0x200a

0x10002

8 bytes

"NotAfter"

(Not_After)

"Certificate Expiration Date"

0x200b

0x4

128 bytes

"SubjectKeyIdentifier"

(Subject_Key_Identifier)

"Issued Subject Key Identifier"

0x200c

0x3

4096 bytes

"RawPublicKey"

(Raw_Public_Key)

"Binary Public Key"

0x200d

0x1

4 bytes

"PublicKeyLength"

(Public_Key_Length)

"Public Key Length"

0x200e

0x4

254 bytes

"PublicKeyAlgorithm"

(Public_Key_Algorithm)

"Public Key Algorithm"

0x200f

0x3

4096 bytes

"RawPublicKeyAlgorithmParameters"

(Raw_Public_Key_Algorithm_Parameters)

"Public Key Algorithm Parameters"

0x2010

0x1

4 bytes

"PublishExpiredCertInCRL"

(Publish_Expired_Cert_In_CRL)

"Publish Expired Certificate in CRL"

0x2011

0x10004

2048 bytes

"UPN"

(UPN)

"User Principal Name"

0x2012

0x4

8192 bytes

"DistinguishedName"

(Distinguished_Name)

"Issued Distinguished Name"

0x2013

0x3

4096 bytes

"RawName"

(Raw_Name)

"Issued Binary Name"

0x2014

0x4

8192 bytes

"Country"

(Country)

"Issued Country/Region"

0x2015

0x4

8192 bytes

"Organization"

(Organization)

"Issued Organization"

0x2016

0x4

8192 bytes

"OrgUnit"

(Org_Unit)

"Issued Organization Unit"

0x2017

0x10004

8192 bytes

"CommonName"

(Common_Name)

"Issued Common Name"

0x2018

0x4

8192 bytes

"Locality"

(Locality)

"Issued City"

0x2019

0x4

8192 bytes

"State"

(State)

"Issued State"

0x201a

0x4

8192 bytes

"Title"

(Title)

"Issued Title"

0x201b

0x4

8192 bytes

"GivenName"

(Given_Name)

"Issued First Name"

0x201c

0x4

8192 bytes

"Initials"

(Initials)

"Issued Initials"

0x201d

0x4

8192 bytes

"SurName"

(SurName)

"Issued Last Name"

0x201e

0x4

8192 bytes

"DomainComponent"

(Domain_Component)

"Issued Domain Component"

0x201f

0x4

8192 bytes

"EMail"

(Email)

"Issued Email address"

0x2020

0x4

8192 bytes

"StreetAddress"

(Street_Address)

"Issued Street Address"

0x2021

0x4

8192 bytes

"UnstructuredName"

(Unstructured_Name)

"Issued Unstructured Name"

0x2022

0x4

8192 bytes

"UnstructuredAddress"

(Unstructured_Address)

"Issued Unstructured Address"

0x2023

0x4

8192 bytes

"DeviceSerialNumber"

(Device_Serial_Number)

"Issued Device Serial Number"

* These database columns are available in Windows Server 2012 R2 and Windows Server 2016 Technical Preview.

Extension Tables

The following table details the Extension table for Windows 2000 Server, Windows Server 2003, Windows Server 2008, Windows Server 2008 R2, Windows Server 2012, Windows Server 2012 R2, and Windows Server 2016 Technical Preview.

Column identifier

Data type

Maximum size of data

Column name

Column display name

0x4000

0x1001

4 bytes

"ExtensionRequestId"

(Extension_Request_ID)

"Extension Request Id"

0x4001

0x4

254 bytes

"ExtensionName"

(Extension_Name)

"Extension Name"

0x4002

0x1

4 bytes

"ExtensionFlags"

(Extension_Flags)

"Extension Flags"

0x4003

0x3

4096 bytes

"ExtensionRawValue"

(Extension_Raw_Value)

"Extension Raw Value"

Attribute Tables

The following table details the Attribute table for Windows 2000 Server, Windows Server 2003, Windows Server 2008, Windows Server 2008 R2, Windows Server 2012, Windows Server 2012 R2, and Windows Server 2016 Technical Preview.

Column identifier

Data type

Maximum size of data

Column name

Column display name

0x3000

0x10001

4 bytes

"AttributeRequestId"

(Attribute_Request_ID)

"Attribute Request Id"

0x3001

0x4

254 bytes

"AttributeName"

(Attribute_Name)

"Attribute Name"

0x3002

0x4

8192 bytes

"AttributeValue"

(Attribute_Value)

"Attribute Value"

CRL Tables

The following table details the CRL table for Windows Server 2003, Windows Server 2008, Windows Server 2008 R2, Windows Server 2012, Windows Server 2012 R2, and Windows Server 2016 Technical Preview. (Windows 2000 Server does not have a CRL table.)

Column identifier

Data type

Maximum size of data

Column name (ADM element)

Column display name

0x5000

0x10001

4 bytes

CRLRowId

(CRL_Row_ID)

"CRL Row ID"

0x5001

0x10001

4 bytes

"CRLNumber"

(CRL_Number)

"CRL Number"

0x5002

0x1

4 bytes

"CRLMinBase"

(CRL_Min_Base)

"CRL Minimum Base"

0x5003

0x1

4 bytes

"CRLNameId"

(CRL_Name_Id)

"CRL Name ID"

0x5004

0x1

4 bytes

"CRLCount"

(CRL_Count)

"CRL Count"

0x5005

0x2

8 bytes

"CRLThisUpdate"

(CRL_This_Update)

"CRL This Update"

0x5006

0x10002

8 bytes

"CRLNextUpdate"

(CRL_Next_Update)

"CRL Next Update"

0x5007

0x2

8 bytes

"CRLThisPublish"

(CRL_This_Publish)

"CRL This Publish"

0x5008

0x10002

8 bytes

"CRLNextPublish"

(CRL_Next_Publish)

"CRL Next Publish"

0x5009

0x2

8 bytes

"CRLEffective"

(CRL_Effective)

"CRL Effective"

0x500a

0x10002

8 bytes

"CRLPropagationComplete"

(CRL_Propagation_Complete)

"CRL Propagation Complete"

0x500b

0x10002

8 bytes

"CRLLastPublish"

(CRL_Last_Published)

"CRL Last Published"

0x500c

0x10001

4 bytes

"CRLPublishAttempts"

(CRL_Publish_Attempts)

"CRL Publish Attempts"

0x500d

0x1

4 bytes

"CRLPublishFlags"

(CRL_Publish_Flags)

"CRL Publish Flags"

0x500e

0x10001

4 bytes

"CRLPublishStatusCode"

(CRL_Publish_Status_Code)

"CRL Publish Status Code"

0x500f

0x4

8192 bytes

"CRLPublishError"

(CRL_Publish_Error)

"CRL Publish Error Information"

0x5010

0x3

536870912 bytes

"CRLRawCRL"

(CRL_Raw_CRL)

"CRL Raw CRL"

<5> Section 3.1.1.1.1: Windows uses a DWORD number to represent these values. The following table shows how Windows internal values correspond to the preceding string representations.

Windows value

Abstract data model value

CR_DISP_ERROR

0x00000001

Request failed

CR_DISP_DENIED

0x00000002

Request denied

CR_DISP_ISSUED

0x00000003

Certificate issued

CR_DISP_UNDER_SUBMISSION

0x00000005

Request pending

CR_DISP_REVOKED

0x00000006

Certificate revoked

<6> Section 3.1.1.1.2: These flags are supported in Windows Server 2012 R2 and Windows Server 2016 Technical Preview.

<7> Section 3.1.1.1.2: Request_RequesterName_From_Old_Certificate is supported in Windows Server 2008 R2, Windows Server 2012, Windows Server 2012 R2, and Windows Server 2016 Technical Preview.

<8> Section 3.1.1.4: Windows 2000, Windows Server 2003, Windows Server 2008, Windows Server 2008 R2, Windows Server 2012, Windows Server 2012 R2, and Windows Server 2016 Technical Preview CAs store this CRL in the registry location HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs.

<9> Section 3.1.1.7: The permissions of Officer, Operator, and Auditor are supported on Windows Server 2003 Enterprise Edition operating system, Windows Server 2003 Datacenter Edition operating system, Windows Server 2008 Enterprise operating system, Windows Server 2008 Datacenter operating system, Windows Server 2008 R2 Enterprise Edition, Windows Server 2008 R2 Datacenter Edition, Windows Server 2012, Windows Server 2012 R2, and Windows Server 2016 Technical Preview.

<10> Section 3.1.1.8: The Microsoft CA keeps all CRL publishing locations in a registry multistring value.

              
                   HKLM\SYSTEM\CurrentControlSet\Services\CertSvc\Configuration\
 {CA Name}\CRLPublicationURLs
              
                 

The Microsoft CA uses a numeric prefix that is stored with each entry of the CRL publishing location list in order to indicate which of the ADM elements the URL belongs to, as shown in the following table.

Numeric prefix value

ADM element

0x00000001

Config_CA_CDP_Publish_To_Base

0x00000040

Config_CA_CDP_Publish_To_Delta

0x00000008

Config_CA_CDP_Include_In_CRL_Publish_Locations_Extension

0x00000004

Config_CA_CDP_Include_In_CRL_Freshest_CRL_Extension

0x00000080

Config_CA_CDP_Include_In_CRL_IDP_Extension

Calling the ICertAdminD2::SetConfigEntry method with the pwszNodePath as an EMPTY string, the pwszEntry "CRLPublicationURLs", and the pVariant data that contains the required URLs allows manipulation of this list.

Also, the usual registry manipulation tools that are specified in [MS-RRP] can be used to update these values.

For Config_CA_CDP_Publish_To_Base and Config_CA_CDP_Publish_To_Delta, the default values that are used by the Microsoft CA are a local path on the CA machine,

              
                   {SYSTEM}\CertSrv\CertEnroll\{CATruncatedName}{CRLNameSuffix}
 {DeltaIndicator}.crl
              
                 

a local path in the registry,

              
                   HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs\
              
                 

and the Active Directory path,

              
                   
 ldap: ///CN={CATruncatedName}{CRLNameSuffix},CN={CAServerShortName},
 CN=CDP,CN=Public Key 
 Services,CN=Services,CN=Configuration,DC={contoso},DC=com{CDPObjectClass}
              
                 

where:

  • "{SYSTEM}" is replaced with the system directory of the CA machine, such as "C:\Windows\System32".

  • "{CATruncatedName}" is replaced with the sanitized name of the CA, as defined in [MS-WCCE] sections 1.3.2.4 and 3.1.1.4.1.1.

  • "{DeltaIndicator}" is replaced with NULL for a base CRL and "+" for a delta CRL.

  • "{CRLNameSuffix}" is replaced with NULL if the CRL is signed by the first CA key (a CA key that has a key index of 0) and by "(n)" if the CRL is signed by any subsequent CA key.

  • Where "(n)" is replaced with an integer that is equal to the identifier Signing_Private_Key_Version_ID, as defined in [MS-WCCE] section 3.2.1.1.2 and in the example in [MS-WCCE] section 3.2.1.4.3.2.34.

  • "{CAServerShortName}" is replaced with the name of the host on which the CA is running.

  • "DC={contoso},DC=com" is replaced by the distinguished name (DN) of the forest root domain naming context (NC) of the Active Directory forest in which the Microsoft CA is installed.

    • The forest root domain NC is defined in [MS-ADTS] section 1.1.

    • For example, the DN of the forest root domain NC of a forest called "corp.contoso.com" would be "DC=corp,DC=contoso,DC=com".

  • "{CDPObjectClass}" is replaced with "?certificateRevocationList?base?objectClass=cRLDistributionPoint" for a base CRL and with "?deltaRevocationList?base?objectClass=cRLDistributionPoint" for a delta CRL.

    • The object class cRLDistributionPoint is as defined in [MS-ADSC].

    • The attribute (1) certificateRevocationList is defined in [MS-ADA1].

    • The attribute (1) deltaRevocationList is defined in [MS-ADA1].

The deltaRevocationList attribute (1) is not used by the Windows 2000 version of the CA. The Windows Server 2003, Windows Server 2008, Windows Server 2008 R2, Windows Server 2012, Windows Server 2012 R2, and Windows Server 2016 Technical Preview versions of the CA use both base CRL and delta CRL attributes (1).

Within the certificateRevocationList or deltaRevocationList attribute (1), the CRL is encoded by using Distinguished Encoding Rules (DER).

<11> Section 3.1.1.10: Microsoft CAs persist only a subset of the configuration data. They store the configuration data in the registry in the following locations:

Values under

 HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CertSvc\Configuration\
  

DBSessionCount

ADM Datum: Config_Max_Number_Of_AD_Connections and OnNextRestart_Config_Max_Number_Of_AD_Connections.

Registry Value Type: REG_DWORD

Default Value: 20

Registry Value Mapping to ADM: The value in the registry equals the ADM datum value. The minimum value for this registry is 4 and the maximum value is 1024.

No Value Semantics: The value always exists.

LDAPFlags

ADM Datum: Config_CA_LDAP_Flags and OnNextRestart_Config_CA_LDAP_Flags.

Registry Value Type: REG_DWORD

Default Value: 0

Registry Value Mapping to ADM: The value in the registry equals the ADM datum value.

No Value Semantics: The value always exists.

Version

ADM Datum: Config_Product_Version and OnNextRestart_Config_Product_Version

Registry Value Type: REG_DWORD

Default Value: By default, the value depends on the Windows version:

  • 0x00010001: Windows 2000 Server

  • 0x00020002: Windows Server 2003

  • 0x00030001: Windows Server 2008

  • 0x00040001: Windows Server 2008 R2

  • 0x00050001: Windows Server 2012

  • 0x00050001: Windows Server 2012 R2 without [MSKB-3013769]

  • 0x00060001: Windows Server 2012 R2 with [MSKB-3013769]

  • 0x00070001: Windows Server 2016 Technical Preview

Registry Value Mapping to ADM: The value in the registry equals the ADM datum value.

No Value Semantics: The value always exists.

Values under

 HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CertSvc\Configuration\<CA_CN>

where <CA_CN> is replaced with the common name (CN) of the CA. The values are as follows:

ConfigurationDirectory

ADM Datum: Config_Configuration_Directory (defined in [MS-WCCE]).

Registry Value Type: REG_SZ

Default Value: By default, the value does not exist.

Registry Value Mapping to ADM: The value in the registry equals the ADM datum value.

No Value Semantics: The CA does not implement Config_Configuration_Directory datum (for details, see section 3.2.1.4.3.2.8).

ParentCAMachine

ADM Datum: Config_CA_Parent_DNS (defined in [MS-WCCE]).

Registry Value Type: REG_SZ

Default Value: By default, the value does not exist for the root CA. For the subordinate CA, the value is set to the FQDN of the machine where the parent CA is installed.

Registry Value Mapping to ADM: The value in the registry equals the ADM datum value.

No Value Semantics: The CA does not have a parent CA.

RoleSeparationEnabled

ADM Datum: Config_CA_Role_Separation (defined in [MS-WCCE]).

Registry Value Type: REG_DWORD

Default Value: The value does not exist by default.

Registry Value Mapping to ADM: If the value in the registry is zero, the ADM datum is set to false. For any nonzero registry value, ADM datum is set to true.

No Value Semantics: Same as setting the value to zero.

CAXchgCertHash

ADM Datum: Config_CA_Exchange_Cert (defined in [MS-WCCE]).

Registry Value Type: REG_MULTI_SZ

Default Value: None.

Registry Value Mapping to ADM: Each value is an SHA-1 hash of the corresponding CA exchange certificate. The actual exchange certificates are stored in the Request table.

No Value Semantics: There are no CA exchange certificates configured on the server.

CACertPublicationURLs

   ADM Datum: Multiple, see Registry Value Mapping to ADM.

   Registry Value Type: REG_MULTI_SZ

   Default Value:

1:C:\Windows\system32\CertSrv\CertEnroll\%1_%3%4.crt

3:ldap:///CN=%7,CN=AIA,CN=Public Key Services,CN=Services,%6%11

2:http://%1/CertEnroll/%1_%3%4.crt

0:file://%1/CertEnroll/%1_%3%4.crt

   Registry Value Mapping to ADM: The string format for each string in the list is

<Numeric Prefix Value>:<Some Path>

Where the <Numeric Prefix Value> is a binary OR of the values in the following table and is represented as a decimal value. And where <Some Path> is a string that is composed of literal strings and wild cards, that is defined in the following tables, and that represents an HTTP, FILE, or LDAP URL), or a UNC path.

Numeric prefix value

ADM element

0x00000001

Config_CA_CACert_Publish_To and OnNextRestart_Config_CA_CACert_Publish_To. The CA publishes its signing certificate to this location.

0x00000002

Config_CA_AIA_Include_In_Cert and OnNextRestart_Config_CA_AIA_Include_In_Cert.

0x00000020

Config_CA_OCSP_Include_In_Cert and OnNextRestart_Config_CA_OCSP_Include_In_Cert.

Wild card

Meaning

%1

The NetBIOS name of the server on which the CA is installed.

%2

The FQDN of the server on which the CA is installed.

%3

The name of the CA.

%4

The certificate file name suffix that corresponds to the key index for the CA signing key.

%6

The DN name of the configuration container.

%7

The truncated name of the CA.

%11

The class name for the AD object of the CA.

  No Value Semantics: The ADMs that correspond to the prefixes are empty.

CRLPublicationURLs

  ADM Datum: Multiple, see Registry Value Mapping to ADM.

  Registry Value Type: REG_MULTI_SZ

  Default Value:

65:E:\Windows\system32\CertSrv\CertEnroll\%3%8%9.crl

79:ldap:///CN=%7%8,CN=%2,CN=CDP,CN=Public Key Services,CN=Services,%6%10

6:http://%1/CertEnroll/%3%8%9.crl

0:file://%1/CertEnroll/%3%8%9.crl

  Registry Value Mapping to ADM: The string format for each string in the list is:

<Numeric Prefix Value>:<Some Path>

Where the <Numeric Prefix Value> is a binary OR of the values in the following table and is represented as a decimal value. And <Some Path> is a string that is composed of literal strings and wild cards, that is defined in the following tables, and that represents an HTTP, FILE, or LDAP URL, or a UNC path.

Numeric prefix value

ADM element

0x00000001

Config_CA_CDP_Publish_To_Base and OnNextRestart_Config_CA_CDP_Publish_To_Base

0x00000002

Config_CA_CDP_Include_In_Cert and OnNextRestart_Config_CA_CDP_Include_In_Cert

0x00000040

Config_CA_CDP_Publish_To_Delta and OnNextRestart_Config_CA_CDP_Publish_To_Delta

0x00000008

Config_CA_CDP_Include_In_CRL_Publish_Locations_Extension and OnNextRestart_Config_CA_CDP_Include_In_CRL_Publish_Locations_Extension

0x00000004

Config_CA_CDP_Include_In_CRL_Freshest_CRL_Extension and OnNextRestart_Config_CA_CDP_Include_In_CRL_Freshest_CRL_Extension

0x00000080

Config_CA_CDP_Include_In_CRL_IDP_Extension and OnNextRestart_Config_CA_CDP_Include_In_CRL_IDP_Extension

Wild card

Meaning

%1

The FQDN of the server on which the CA is installed.

%2

The NetBIOS name of the server on which the CA is installed.

%3

The name of the CA.

%4

The certificate name.

%6

The DN name of the configuration container.

%7

The truncated name of the CA.

%8

The signing key identifier, which is enclosed in (), of the CA.

%9

Append + character suffix.

%10

The AD CRL and delta CRL object class.

%11

The class name for the AD object of the CA.

EnrollmentAgentRights

   ADM Datum: Config_Permissions_Enrollment_Agent_Rights (defined in [MS-WCCE]).

   Registry Value Type: REG_BINARY

   Default Value: None.

   Registry Value Mapping to ADM: A binary security descriptor that is defined in section 2.2.1.11.

   No Value Semantics: No Enrollment Agent permissions are defined.

OfficerRights

   ADM Datum: Config_Permissions_Officer_Rights (defined in [MS-WCCE]).

   Registry Value Type: REG_BINARY

   Default Value: None.

   Registry Value Mapping to ADM: A binary security descriptor that is defined in section 2.2.1.11.

   No Value Semantics: No Officer permissions are defined.

Security

ADM Datum: Config_Permissions_CA_Security (defined in [MS-WCCE]), and OnNextRestart_Config_Permissions_CA_Security

    Registry Value Type: REG_BINARY

    Default Value:

  • Standalone CA

    • Builtin Administrators – Owner, Group, Administrator, Officer

    • Everyone: Enroll

  • Enterprise CA

    • Builtin Administrators – Owner, Group, Administrator, Officer

    • Domain Administrators – Administrator, Officer

    • Enterprise Administrators – Administrator, Officer

    • Authenticated Users – Enroll

Registry Value Mapping to ADM: A binary security descriptor with permissions that are defined as follows.

Permission

Bit value

Read

0x00000100

Enroll

0x00000200

Officer

0x00000002

Administrator

0x00000001

Auditor

0x00000004

Operator

0x00000008

    No Value Semantics: None defined.

AuditFilter

ADM Datum: Config_CA_Audit_Filter and OnNextRestart_Config_CA_Audit_Filter

Registry Value Type: REG_DWORD

Default Value: None.

Registry Value Mapping to ADM: Specified in section 3.1.4.2.10.

No Value Semantics: No auditing occurs.

CAType

ADM Datum: Config_CA_Type and OnNextRestart_Config_CA_Type

Registry Value Type: REG_DWORD

Default Value: None.

Provisioning: Populated by the CA installation, based upon a selection made by the administrator.

Registry Value Mapping to ADM:

  • ENUM_ENTERPRISE_ROOTCA = 0x00000000

  • ENUM_ENTERPRISE_SUBCA = 0x00000001

  • ENUM_STANDALONE_ROOTCA = 0x00000003

  • ENUM_STANDALONE_SUBCA = 0x00000004

  • No Value Semantics: Value always present.

CommonName

ADM Datum: Config_CA_Common_Name and OnNextRestart_Config_CA_Common_Name

Registry Value Type: REG_SZ

Default Value: None.

Provisioning: Populated by the CA installation, based upon a selection made by the administrator.

Registry Value Mapping to ADM: Value is set to installed CA name.

No Value Semantics: Value always present.

CRLDeltaNextPublish

ADM Datum: Config_CA_CRL_Delta_Next_Publish and OnNextRestart_Config_CA_CRL_Delta_Next_Publish

Registry Value Type: REG_BINARY

Default Value: Installed filetime plus 1 day.

Registry Value Mapping to ADM: Specified in section 3.1.4.2.14.

No Value Semantics: Value always present is re-created based on calculations specified in section 3.1.4.1.6.

CRLNextPublish

ADM Datum: Config_CA_CRL_Next_Publish and OnNextRestart_Config_CA_CRL_Next_Publish

Registry Value Type: REG_BINARY

Default Value: Installed filetime plus 1 week.

Registry Value Mapping to ADM: Specified in section 3.1.4.2.14.

No Value Semantics: Value is re-created based on calculations specified in section 3.1.4.1.6.

CRLDeltaPeriod and CRLDeltaPeriodUnits

ADM Datum: Config_Delta_CRL_Validity_Period

Registry Value Type: CRLDeltaPeriod is REG_SZ, and CRLDeltaPeriodUnits is REG_DWORD

Default Value: CRLDeltaPeriodUnits = 1; CRLDeltaPeriod = "Days"

Registry Value Mapping to ADM: CRLDeltaPeriod contains the string representation of the "periods of time" in which the Config_Delta_CRL_Validity_Period is expressed. Valid values are Seconds, Minutes, Hours, Days, Weeks, or Months. CRLDeltaPeriodUnits contains the number of those periods of time. For example, see "Default Value" above.

No Value Semantics: Hardcoded default values equal to "Default Value", above, are used

CRLPeriod and CRLPeriodUnits

ADM Datum: Config_Base_CRL_Validity_Period

Registry Value Type: CRLPeriod is REG_SZ, and CRLPeriodUnits is REG_DWORD.

Default Value: CRLPeriodUnits = 1; CRLPeriod = "Weeks".

Registry Value Mapping to ADM: CRLPeriod contains the string representation of the "periods of time" in which the Config_Base_CRL_Validity_Period is expressed. Valid values are Seconds, Minutes, Hours, Days, Weeks, or Months. CRLPeriodUnits contains the number of those periods of time. For example, see "Default Value" above.

No Value Semantics: Hardcoded default values equal to "Default Value" above, are used.

HighSerial

ADM Datum: Config_High_Serial_Number, Config_High_Serial_String, OnNextRestart_Config_High_Serial_Number, and OnNextRestart_Config_High_Serial_String

Registry Value Type: REG_DWORD

Default Value: The value does not exist by default.  It must be created manually using registry methods.

Registry Value Mapping to ADM: Defined in [MS-WCCE] section 3.2.1.4.2.1.4.5.

No Value Semantics: Same as registry value of 0.

InterfaceFlags

ADM Datum: Config_CA_Interface_Flags and OnNextRestart_Config_CA_Interface_Flags.

Registry Value Type: REG_DWORD

Default Value: 0x41

Registry Value Mapping to ADM: Defined in section 3.1.4.2.14.

No Value Semantics: No interface flags in effect.

KRAFlags

ADM Datum: Config_CA_KRA_Flags and OnNextRestart_Config_CA_KRA_Flags.

Registry Value Type: REG_DWORD

Default Value: 0

Registry Value Mapping to ADM: Defined in section 3.1.4.2.14.

No Value Semantics: No KRA flags in effect.

SetupStatus

ADM Datum: Config_Setup_Status and OnNextRestart_Config_Setup_Status.

Registry Value Type: REG_DWORD

Default Value: By default, for a complete CA installation, the value is 1.

Registry Value Mapping to ADM: The value in the registry equals the ADM datum value.

No Value Semantics: Value always present.

SubjectTemplate

ADM Datum: Config_CA_DN_Order_String

Registry Value Type: REG_MULTI_SZ

Default Value: Email

CommonName

OrganizationalUnit

Organization

Locality

State

DomainComponent

Country

Registry Value Mapping to ADM: The value in the registry equals the ADM datum value.

No Value Semantics: Value always present.

CRLDeltaOverlapPeriod and CRLDeltaOverlapUnits

ADM Datum: Config_Delta_CRL_Overlap_Period

Registry Value Type: CRLDeltaOverlapPeriod is REG_SZ, and CRLDeltaOverlapUnits is REG_DWORD.

Default Value: CRLDeltaOverlapUnits = 0; CRLDeltaOverlapPeriod = "Minutes".

Registry Value Mapping to ADM: CRLDeltaOverlapPeriod contains the string representation of the "periods of time" in which the Config_Delta_CRL_Overlap_Period is expressed. Valid values are Seconds, Minutes, Hours, Days, Weeks, or Months. CRLDeltaOverlapUnits contains the number of those periods of time. For example, see "Default Value" above.

No Value Semantics: Hardcoded default values equal to "Default Value", above, are used.

CRLOverlapPeriod and CRLOverlapUnits

ADM Datum: Config_Base_CRL_Overlap_Period

Registry Value Type: CRLOverlapPeriod is REG_SZ, and CRLOverlapUnits is REG_DWORD.

Default Value: CRLOverlapUnits = 0; CRLOverlapPeriod = "Hours"

Registry Value Mapping to ADM: CRLOverlapPeriod contains the string representation of the "periods of time" in which the Config_Base_CRL_Overlap_Period is expressed. Valid values are Seconds, Minutes, Hours, Days, Weeks, or Months. CRLOverlapUnits contains the number of those periods of time. For example, see "Default Value" above.

No Value Semantics: Hardcoded default values equal to "Default Value", above, are used.

CRLAttemptRepublish

ADM Datum: OnNextRestart_Config_CA_CRL_Attempt_Republish

Registry Value Type: REG_DWORD

Default Value: By default the element is absent. Windows instantiates the value upon the first unsuccessful CRL publishing attempt per the processing rules in section 3.1.4.1.6.

Registry Value Mapping to ADM: The value in the registry equals the ADM datum value.

No Value Semantics: Same as value of 0.

Maximum Value: 10

KRACertCount

ADM Datum: Config_CA_KRA_Cert_Count

Registry Value Type: REG_DWORD

Default Value: 0

Registry Value Mapping to ADM: The value in the registry equals the ADM datum value.

No Value Semantics: No KRA certificates available for encryption.

KRACertHash

ADM Datum: Config_CA_KRA_Cert_List

Registry Value Type: REG_MULTI_SZ

Default Value: Empty by default.

Registry Value Mapping to ADM: Each of the multiple values in the registry is the hash of one of the KRA certificates in the list.

No Value Semantics: No KRA certificates available for encryption.

UseDS

ADM Datum: Config_CA_Use_DS and OnNextRestart_Config_CA_Use_DS

Registry Value Type: REG_DWORD

Default Value: For an enterprise CA (Config_CA_Type of 0 or 1), the value is 1. For a standalone CA (Config_CA_Type of 3 or 4), the value is 0.

Registry Value Mapping to ADM: The value in the registry equals the ADM datum value.

No Value Semantics: Value always present.

CNGHashAlgorithm

ADM Datum: Config_CSP_CNG_Hash_Algorithm and OnNextRestart_Config_CSP_CNG_Hash_Algorithm

Registry Value Type: REG_SZ

Default Value: None

Provisioning: If the administrator has selected a CNG provider as the Config_CSP_Provider, this value is populated by the CA installation, based upon another selection made by the administrator. If the administrator has selected a CryptoAPI CSP as the Config_CSP_Provider, this value is provisioned with no value (null).

Registry Value Mapping to ADM: The value in the registry equals the ADM datum value.

No Value Semantics: If there is no Config_CSP_CNG_Hash_Algorithm value, then this means the CA uses a CryptoAPI CSP and not a CNG provider. In this case, Config_CSP_Hash_Algorithm will contain the identifier of the CA hash algorithm.

HashAlgorithm

ADM Datum: Config_CSP_Hash_Algorithm and OnNextRestart_Config_CSP_Hash_Algorithm

Registry Value Type: REG_DWORD

Default Value: None

Provisioning: If the administrator has selected a CryptoAPI CSP as the Config_CSP_Provider, this value is populated by the CA installation, based upon another selection made by the administrator. If the administrator has not selected a CryptoAPI CSP as the Config_CSP_Provider, this value is initialized to 0xffffffff.

Registry Value Mapping to ADM: The value in the registry is either 0xffffffff or the algid (algorithm identifier) that corresponds to the hash algorithm used by the CA.

0xffffffff – no value. The CA has been installed with a CNG provider, so Config_CSP_CNG_Hash_Algorithm contains the name of the CA hash algorithm.

Algids of supported hash algorithms are as follows:

MD2                     0x8001

MD5                     0x8003

SHA1                    0x8004

SHA256               0x8012

SHA384               0x8013

SHA512               0x8014

No Value Semantics: The element always exists.

Provider

ADM Datum: Config_CSP_Provider and OnNextRestart_Config_CSP_Provider

Registry Value Type: REG_SZ

Default Value: Populated by the CA installation, based upon a selection made by the administrator.

Registry Value Mapping to ADM: The value in the registry equals the ADM datum value.

No Value Semantics: Element always exists.

Values under:

 HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CertSvc\Configuration\<CA_CN>\PolicyModules\CertificateAuthority_MicrosoftDefault.Policy\RequestDisposition

where <CA_CN> is replaced with the common name (CN) of the CA. The values are as follows:

RequestDisposition

ADM Datum: OnNextRestart_Config_CA_Requests_Disposition

Registry Value Type: REG_DWORD

Default Value: For an enterprise CA (Config_CA_Type of 0 or 1), the value is 0x00000001. For a standalone CA (Config_CA_Type of 3 or 4), the value is 0x00000101.

Registry Value Mapping to ADM: The value of the registry equals the value of the OnNextRestart_Config_CA_Requests_Disposition datum.

No Value Semantics: The OnNextRestart_Config_CA_Requests_Disposition datum value is set to 0x00000101 (REQDISP_PENDINGFIRST | REQDISP_ISSUE). 

ProviderType

ADM Datum: Config_CSP_ProviderType and OnNextRestart_Config_CSP_ProviderType

Registry Value Type: REG_DWORD

Default Value: Populated by the CA installation based upon the selection of Provider made by the administrator. A value of 0 means the provider is a CNG provider. A nonzero value means the provider is a legacy CryptoAPI CSP.

Registry Value Mapping to ADM: The value in the registry equals the ADM datum value.

No Value Semantics: Element always exists.

Values under:

  
 HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CertSvc\Configuration\<CA_CN>\PolicyModules\CertificateAuthority_MicrosoftDefault.Policy\EditFlags
  

where <CA_CN> is replaced with the CN of the CA. The values are as follows:

EditFlags

ADM Datum: Multiple, see Registry Value Mapping to ADM.

Registry Value Type: REG_DWORD

Default Value: The flags that are defined here for this value are not set by default.

Registry Value Mapping to ADM: 0x00000020 – If this bit is set, Config_CA_Accept_Request_Attributes_ValidityTime (defined in [MS-WCCE]) is set to true. Otherwise, it is set to false.

0x00008000 – If this bit is set, Config_CA_Accept_Request_Attributes_Extensions (defined in [MS-WCCE]) is set to true. Otherwise, it is set to false.

0x00040000 – If this bit is set, Config_CA_Accept_Request_Attributes_SAN (defined in [MS-WCCE]) is set to true. Otherwise, it is set to false.

0x00080000 – If this bit is set, Config_AD_Connection_Referral (defined in [MS-WCCE]) is set to true. Otherwise, it is set to false

0x02000000 – If this bit is set, Config_CA_Allow_RenewOnBehalfOf_Requests is set to true.

No Value Semantics: All ADM elements that are controlled by this value are set to false.

Values under:

 HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CertSvc\Configuration\<CA_CN>\CRLFlags

where <CA_CN> is replaced with the CN of the CA. The values are as follows:

CRLEditFlag

ADM Datum: Config_CA_Accept_Request_Attributes_Other (defined in [MS-WCCE])

Registry Value Type: REG_DWORD

Default Value: The flags that are defined here for this value are not set by default.

Registry Value Mapping to ADM: 0x00010000 – If this bit is set, Config_CA_Accept_Request_Attributes_Other (defined in [MS-WCCE]) is set to true. Otherwise, it is set to false.

No Value Semantics: All ADM elements that are controlled by this value are set to false.

Values under:

 HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CertSvc\Configuration\<CA_CN>\ExitModules\CertificateAuthority_MicrosoftDefault.Exit\PublishCertFlags

where <CA_CN> is replaced with the CN of the CA. The values are as follows:

PublishCertFlags

ADM Datum: Config_CA_Accept_Request_Attributes_CertPath (defined in [MS-WCCE])

Registry Value Type: REG_DWORD

Default Value: The flags that are defined here for this value are not set by default.

Registry Value Mapping to ADM: 0x00000001 – If this bit is set, Config_CA_Accept_Request_Attributes_CertPath (defined in [MS-WCCE]) is set to true. Otherwise, it is set to false.

No Value Semantics: All ADM elements that are controlled by this value are set to false.

Values under:

 HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CertSvc\Configuration\<CA_CN>\ExitModules

where <CA_CN> is replaced with the CN of the CA. The values are as follows:

Active

ADM Datum: See "Registry Value Mapping to ADM."

Registry Value Type: REG_MULTI_SZ

Default Value: CertificateAuthority_MicrosoftDefault.Exit

Registry Value Mapping to ADM: The names of the COM classes implementing the ICertExit interface and used as exit algorithms on the CA comprise Config_CA_Exit_Algorithm_Implementation_List and OnNextRestart_Config_CA_Exit_Algorithm_Implementation_List.

The number of entries in this value sets the Config_CA_Exit_Count.

No Value Semantics: No exit algorithms are installed on the CA.

Values under:

 HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CertSvc\Configuration\<CA_CN>\PolicyModules

where <CA_CN> is replaced with the CN of the CA. The values are as follows:

Active

ADM Datum: Config_CA_Policy_Algorithm_Implementation and OnNextRestart_Config_CA_Policy_Algorithm_Implementation

Registry Value Type: REG_SZ

Default Value: CertificateAuthority_MicrosoftDefault.Policy

Registry Value Mapping to ADM: The registry value contains the name of the COM class that implements the ICertPolicy interface and should be used at the policy algorithm on the CA.

No Value Semantics: Unsupported; a Windows CA always has at least one policy module.

<12> Section 3.1.1.10: Config_CA_Allow_RenewOnBehalfOf_Requests is supported in Windows Server 2008 R2, Windows Server 2012, Windows Server 2012 R2, and Windows Server 2016 Technical Preview.

<13> Section 3.1.3: The DCOM security descriptor is accessed from the registry location HKLM\SOFTWARE\Microsoft\Ole\:

  • Value: MachineAccessRestriction

  • Values added

  • COM_RIGHTS_EXECUTE | COM_RIGHTS_EXECUTE_LOCAL | COM_RIGHTS_EXECUTE_REMOTE

  • and

  • Value: MachineLaunchRestriction

  • Values added

  • COM_RIGHTS_EXECUTE | COM_RIGHTS_ACTIVATE_LOCAL | COM_RIGHTS_ACTIVATE_REMOTE

  • where

  • COM_RIGHTS_EXECUTE maps to the value of 1

  • COM_RIGHTS_EXECUTE_LOCAL maps to the value of 2

  • COM_RIGHTS_EXECUTE_REMOTE maps to the value of 4

  • COM_RIGHTS_ACTIVATE_LOCAL maps to the value of 8

  • COM_RIGHTS_ACTIVATE_REMOTE maps to the value of 16

<14> Section 3.1.3: The Microsoft Windows CA, upon CA service startup, reads the configuration values from the registry location "HKLM\SYSTEM\CurrentControlSet\Services\CertSvc\".

<15> Section 3.1.4.1: The supported clients are Windows 2000 Professional operating system, Windows XP, Windows Vista with Admin Pack, Windows 7, Windows 8, Windows 8.1, and Windows 10. The supported servers are Windows 2000 Server, Windows Server 2003, Windows Server 2008, Windows Server 2008 R2, Windows Server 2012, Windows Server 2012 R2, and Windows Server 2016 Technical Preview.

<16> Section 3.1.4.1: In Windows 2000, Windows Server 2003, Windows Server 2008, Windows Server 2008 R2, Windows Server 2012, Windows Server 2012 R2, and Windows Server 2016 Technical Preview, the error is E_ACCESSDENIED (0x80070005).

<17> Section 3.1.4.1: In Windows Server 2003, Windows Server 2008, Windows Server 2008 R2, Windows Server 2012, Windows Server 2012 R2, and Windows Server 2016 Technical Preview, the error is E_ACCESSDENIED (0x80070005). Windows 2000 does not return an error.

<18> Section 3.1.4.1: In Windows Server 2003, Windows Server 2008, Windows Server 2008 R2, Windows Server 2012, Windows Server 2012 R2, and Windows Server 2016 Technical Preview, the error is E_ACCESSDENIED (0x80070005). Windows 2000 does not return an error.

<19> Section 3.1.4.1.3: The Windows Server 2003 CA places 0x80094004 in the pdwDisposition parameter and returns successfully. Windows Server 2008, Windows Server 2008 R2, Windows Server 2012, Windows Server 2012 R2, and Windows Server 2016 Technical Preview CAs place 0 in the pdwDisposition parameter and return 0x80094004 as the error code.

<20> Section 3.1.4.1.4: Windows 2000, Windows XP, Windows Server 2003, Windows Vista, and Windows Server 2008 set the Request_Status_Code to 0x0 (S_OK).

<21> Section 3.1.4.1.6: In a Windows 2000 CA, CRL creation can be disabled by setting the Config_Base_CRL_Validity_Period to 0. In a Windows 2000 CA, if the Microsoft default exit module "CertificateAuthority_MicrosoftDefault.Exit" is not active (that is, not included in the ADM element Config_CA_Exit_Algorithm_Implementation_List), then no CRLs are published. The setting Config_CA_Exit_Algorithm_Implementation_List has no effect on PublishCRL behavior of Windows Server 2003, Windows Server 2008, Windows Server 2008 R2, Windows Server 2012, Windows Server 2012 R2, or Windows Server 2016 Technical Preview. If CRLs are disabled, certificates issued by the CA cannot be used for applications that require CRL–based revocation checking.

<22> Section 3.1.4.1.6: The Windows 2000 CA does not have a CRL table; therefore, it does not create or update a CRL table entry.

<23> Section 3.1.4.1.6: The Microsoft CA for Windows uses a default clock skew (Config_CA_Clock_Skew_Minutes) of 10 minutes. The Microsoft CA defines this value in the registry as follows:

 HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services
 \CertSvc\Configuration{CA Name}\ClockSkewMinutes  (REG_DWORD)
  

<24> Section 3.1.4.1.6: By default, the Config_Base_CRL_Overlap_Period and Config_Delta_CRL_Overlap_Period values are not defined. The Microsoft CA keeps these overlap periods in the following registry values:

 HKLM\SYSTEM\CurrentControlSet\Services\CertSvc\Configuration\{CA Name}\
 REG_SZ        CRLOverlapPeriod
 REG_DWORD     CRLOverlapPeriodUnits
 REG_SZ        CRLDeltaOverlapPeriod
 REG_DWORD     CRLDeltaOverlapPeriodUnits
  

<25> Section 3.1.4.1.6: The Microsoft CA for Windows uses a default clock skew (Config_CA_Clock_Skew_Minutes) of 10 minutes. The Microsoft CA defines this value in the registry as follows:

 HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\CertSvc\Configuration{CA Name}\ClockSkewMinutes  (REG_DWORD)

<26> Section 3.1.4.1.6: Differing from [RFC3280] section 5, a Windows 2000 CA does not populate the CRL number extension.

<27> Section 3.1.4.1.6: A Windows 2000 CA does not create delta CRLs.

<28> Section 3.1.4.1.6: The Microsoft CA keeps this list of CDP locations in a registry multistring value.

 HKLM\SYSTEM\CurrentControlSet\Services\CertSvc\Configuration\
 {CA Name}\CRLPublicationURLs

A specific protocol method does not exist to manipulate this list. Instead, the Microsoft CA uses the typical registry manipulation tools.

The default values used by the Microsoft CA are a local path on the CA machine,

 {SYSTEM}\CertSrv\CertEnroll\

a local path in the registry,

 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs\

and the Active Directory path,

 ldap: ///CN={CAName}{CRLNameSuffix},CN={CAServerName},CN=CDP,CN=Public Key Services,CN=Services,CN=Configuration,DC={contoso},DC=com

where:

  • SYSTEM is replaced with the system directory of the CA machine, such as "C:\Windows\System32".

  • CAName is replaced with the sanitized name of the CA, as defined in [MS-WCCE] sections 1.3.2.4 and 3.1.1.4.1.1.

  • {CRLNameSuffix} is replaced with NULL if the CRL is signed by the first CA key (CA key with key index 0) and by "(n)" if the CRL is signed by any subsequent CA key, with {n} being an integer equal to the identifier (Signing_Private_Key_Version_ID, as defined in [MS-WCCE] section 3.2.1.1.3) of the CA certificate private key.

  • CAServerName is replaced with the name of the host on which the CA is running.

  • DC={contoso},DC=com is replaced with the name space of the Active Directory domain in which the Microsoft CA is installed.

<29> Section 3.1.4.1.6: For the Microsoft CA, the error code will be in the form of a 2-byte WIN32 error code (as specified in [MS-ERREF] section 2.2), such as 0x2098, which means "Insufficient access rights to perform the operation". This will then be converted to an HRESULT (4 byte) error code (as specified in [MS-ERREF] section 2.1), such as 0x80072098. Note that the first 2 bytes, the "0x8007" portion of the HRESULT value, have nothing to do with the error condition and are determined by the Severity and Facility bits, as defined in [MS-ERREF] section 2.1.

<30> Section 3.1.4.1.6: The Microsoft CA publishes CRLs to LDAP paths in Active Directory as follows:

The path the server expects is

 ldap: ///CN={CAName}{CRLNameSuffix},CN={CAServerShortName},CN=CDP,CN=Public Key Services,CN=Services,CN=Configuration,DC={contoso},DC=com{CDPObjectClass}

where:

"{CAName}" is replaced with the sanitized name of the CA, as defined in [MS-WCCE] sections 1.3.2.4 and 3.1.1.4.1.1.

"{DeltaIndicator}" is replaced with NULL for a base CRL and "+" for a delta CRL.

"{CRLNameSuffix}" is replaced with NULL if the CRL is signed by the first CA key (CA key with key index 0) and by "(n)" if the CRL is signed by any subsequent CA key.

where "n" is replaced with an integer equal to the identifier (Signing_Private_Key_Version_ID, as defined in [MS-WCCE] section 3.2.1.1.2) of the CA certificate private key.

"{CAServerName}" is replaced with the name of the host on which the CA is running.

"DC={contoso},DC=com" is replaced with the DN of the forest root domain naming context (NC) of the Active Directory forest in which the Microsoft CA is installed.

The forest root domain NC is defined in section 1.1 of [MS-ADTS].

For example, the DN of the forest root domain NC of a forest called "corp.contoso.com" is "DC=corp,DC=contoso,DC=com".

{CDPObjectClass} is replaced with "?certificateRevocationList?base?objectClass=cRLDistributionPoint" for a base CRL and with "?deltaRevocationList?base?objectClass=cRLDistributionPoint" for a delta CRL.

The object class cRLDistributionPoint is as defined in [MS-ADSC]. The attribute (1) certificateRevocationList is defined in [MS-ADA1].

The attribute (1) deltaRevocationList is defined in [MS-ADA1].

The deltaRevocationList attribute (1) is not used by the Windows 2000 version of the CA. The Windows Server 2003, Windows Server 2008, Windows Server 2008 R2, Windows Server 2012, Windows Server 2012 R2, and Windows Server 2016 Technical Preview versions of the CA use both base CRL and delta CRL attributes (1).

Within the certificateRevocationList or deltaRevocationList attribute (1), the CRL is encoded by using DER.

For any ldap:/// write operation, if the LDAP write operation returns an error that indicates the LDAP server is down or otherwise unavailable, the Microsoft Windows Server 2003, Windows Server 2008, Windows Server 2008 R2, Windows Server 2012, Windows Server 2012 R2, and Windows Server 2016 Technical Preview CA will attempt to rebind (creating a new LDAP handle) and reattempt the LDAP write one time. The Microsoft CA in Windows 2000 does not perform this LDAP handle caching and single retry with a new LDAP handle.

<31> Section 3.1.4.1.6: The CA for Windows Server 2003, Windows Server 2008, Windows Server 2008 R2, Windows Server 2012, Windows Server 2012 R2, or Windows Server 2016 Technical Preview will perform this one-time retry logic for LDAP if the LDAP call returns one of the following ldap error codes: LDAP_SERVER_DOWN (0x51), or LDAP_UNAVAILABLE (0x34), or LDAP_TIMEOUT (0x55). The Windows 2000 CA does not perform this one-time LDAP retry logic.

<32> Section 3.1.4.1.6: The Windows 2000 CA does not have a CRL table. Therefore, it does not create or update data elements for a CRL table.

<33> Section 3.1.4.1.7: The Windows 2000 CA retrieves the most recent base CRL from the registry location HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs\. The Windows Server 2003, Windows Server 2008, Windows Server 2008 R2, Windows Server 2012, Windows Server 2012 R2, and Windows Server 2016 Technical Preview versions of the CA retrieve the most recent base CRL (CRLRawCRL) from the CRL table.

<34> Section 3.1.4.1.8: Windows allows serial numbers longer than 20 octets.

<35> Section 3.1.4.1.8: The parameter value 0xfffffffd is valid only on a Windows Server 2008, Windows Server 2008 R2, Windows Server 2012, Windows Server 2012 R2, or Windows Server 2016 Technical Preview CA. If this value is used on a Windows Server 2003 CA, the CA fails with return code ERROR_INVALID_PARAMETER (0x80070057).

<36> Section 3.1.4.1.8: The parameter value 0xfffffffe is valid only on a Windows Server 2008, Windows Server 2008 R2, Windows Server 2012, Windows Server 2012 R2, or Windows Server 2016 Technical Preview CA. If this value is used on a Windows Server 2003 CA, the CA fails with return code ERROR_INVALID_PARAMETER (0x80070057).

<37> Section 3.1.4.1.10: Windows Server 2003, Windows Server 2008, Windows Server 2008 R2, Windows Server 2012, Windows Server 2012 R2, and Windows Server 2016 Technical Preview send the column identifiers as the following DWORD array.

              
 {0x00001000, 0x00001010, 0x0000100b, 0x00001008, 0x0000100a, 
  0x00002003, 0x0000101a, 0x00001022, 0x00001019, 0x00001018, 
  0x0000101b,0x0000101c, 0x00001017, 0x00001001}

These identifiers correspond to the following columns in the Request table:

"Request.RequestID", "Request.RequesterName", "Request.SubmittedWhen", "Request.StatusCode", "Request.DispositionMessage", "CertificateTemplate", "Request.CommonName", "Request.EMail", "Request.OrgUnit", "Request.Organization", "Request.Locality", "Request.State", "Request.Country", "Request.RawRequest"

Windows 2000 Server sends the column identifiers as the following DWORD array.

              
 {0x00001000, 0x0000100f, 0x00002004, 0x00002006, 0x00002007, 
  0x00002011, 0x00002019, 0x00002010, 0x0000200f, 0x00002012
  0x00002013, 0x0000200e, 0x00002001}
              

These identifiers correspond to the following columns in the Request table:

"Request.RequestID", "Request.RequesterName", "SerialNumber", "NotBefore", "NotAfter", "CommonName", "EMail", "OrgUnit", "Organization", "Locality", "State", "Country", "RawCertificate"

<38> Section 3.1.4.1.10: Windows Server 2003, Windows Server 2008, Windows Server 2008 R2, Windows Server 2012, Windows Server 2012 R2, and Windows Server 2016 Technical Preview send the column identifiers as the following DWORD array.

              
 {0x00001000, 0x00001010, 0x00002006, 0x00002008, 0x00002009, 
  0x00002003, 0x00002016, 0x0000201e, 0x00002015, 0x00002014, 
  0x00002017, 0x00002018, 0x00002013, 0x00002001}

These identifiers correspond to the following columns in the Request table:

"Request.RequestID", "Request.RequesterName", "SerialNumber", "NotBefore", "NotAfter", "CertificateTemplate", "CommonName", "EMail", "OrgUnit","Organization", "Locality", "State", "Country", "RawCertificate"

Windows 2000 Server sends the column identifier as the following DWORD array.

 {0x00001000, 0x0000100f, 0x00002004, 0x00002006, 0x00002007, 
  0x00002011, 0x00002019, 0x00002010, 0x0000200f, 0x00002012, 
  0x00002013, 0x0000200e, 0x00002001}

These identifiers correspond to the following columns in the Request table:

"Request.RequestID", "Request.RequesterName", "SerialNumber", "NotBefore", "NotAfter", "CommonName", "EMail", "OrgUnit","Organization", "Locality", "State", "Country", "RawCertificate"

<39> Section 3.1.4.1.10: Windows Server 2003, Windows Server 2008, Windows Server 2008 R2, Windows Server 2012, Windows Server 2012 R2, and Windows Server 2016 Technical Preview send the column identifiers as the following DWORD array.

              
 {0x00001000, 0x00001010, 0x0000100b, 0x00001008, 0x0000100a, 
  0x00002003, 0x0000101a, 0x00001022, 0x00001019, 0x00001018, 
  0x0000101b, 0x0000101c, 0x00001017, 0x00001001, }

These identifiers correspond to the following columns in the Request table:

"Request.RequestID", "Request.RequesterName", "Request.SubmittedWhen", "Request.StatusCode", "Request.DispositionMessage", "CertificateTemplate", "Request.CommonName", "Request.EMail", "Request.OrgUnit", "Request.Organization", "Request.Locality", "Request.State", "Request.Country", "Request.RawRequest"

Windows 2000 Server sends the column identifiers as the following DWORD array.

              
 {0x00001000, 0x0000100f, 0x0000100a, 0x00001009, 0x00001017,
  0x0000101f, 0x00001016, 0x00001015, 0x00001018, 0x00001019,
  0x00001014, 0x00001001}

These identifiers correspond to the following columns in the Request table:

"Request.RequestID", "Request.RequesterName", "Request.SubmittedWhen", "Request.DispositionMessage", "Request.CommonName", "Request.EMail", "Request.OrgUnit", "Request.Organization", "Request.Locality", "Request.State", "Request.Country", "Request.RawRequest"

<40> Section 3.1.4.1.10: Windows Server 2003, Windows Server 2008, Windows Server 2008 R2, Windows Server 2012, Windows Server 2012 R2, and Windows Server 2016 Technical Preview send the column identifiers as the following DWORD array.

              
 {0x00004000, 0x00004001, 0x00004002, 0x00004003}

These identifiers correspond to the following columns in the Extension table:

"ExtensionRequestId", "ExtensionName", "ExtensionFlags", "ExtensionRawValue"

Windows 2000 Server returns E_INVALIDARG for this value of the iColumnSetDefault parameter.

<41> Section 3.1.4.1.10: Windows Server 2003, Windows Server 2008, Windows Server 2008 R2, Windows Server 2012, Windows Server 2012 R2, and Windows Server 2016 Technical Preview send the column identifiers as the following DWORD array.

              
 {0x00003000, 0x00003001, 0x00003002}

These identifiers correspond to the following columns in the Attribute table:

"AttributeRequestId", "AttributeName", "AttributeValue"

Windows 2000 Server returns E_INVALIDARG for this value of the iColumnSetDefault parameter.

<42> Section 3.1.4.1.10: Windows Server 2003, Windows Server 2008, Windows Server 2008 R2, Windows Server 2012, Windows Server 2012 R2, and Windows Server 2016 Technical Preview send the column identifiers as the following DWORD array.

              
 {0x00005000, 0x00005001, 0x00005002, 0x00005003, 0x00005004,
  0x00005005, 0x00005006, 0x00005007, 0x00005008, 0x00005009,
  0x0000500a, 0x0000500b, 0x0000500c, 0x0000500d, 0x0000500e,
  0x0000500f, 0x00005010}

These identifiers correspond to the following columns in the CRL table:

"CRLRowId", "CRLNumber", "CrlMinBase", "CRLNameId", "CrlCount", "CRLThisUpdate", "CRLNextUpdate", "CRLThisPublish", "CRLNextPublish", "CRLEffective", "CRLPropagationComplete", "CRLLastPublish", "CRLPublishAttempts", "CRLPublishFlags", "CRLPublishStatusCode", "CRLPublishError", "CRLRawCRL"

Windows 2000 Server returns E_INVALIDARG for this value of the iColumnSetDefault parameter.

<43> Section 3.1.4.1.10: Windows Server 2003, Windows Server 2008, Windows Server 2008 R2, Windows Server 2012, Windows Server 2012 R2, and Windows Server 2016 Technical Preview send the column identifiers as the following DWORD array.

              
 {0x00001000, 0x00001010, 0x00002006, 0x00002008, 0x00002009,
  0x00002003, 0x00002016, 0x0000201e, 0x00002015,
  0x00002014, 0x00002017, 0x00002018, 0x00002013, 0x00002001,
  0x0000100d, 0x0000100e, 0x0000100f}

These identifiers correspond to the following columns in the Request table:

"Request.RequestID", "Request.RequesterName", "SerialNumber", "NotBefore", "NotAfter", "CertificateTemplate", "OrgUnit", "DomainComponent", "Organization", "Country", "CommonName", "Locality", "RawName", "RawCertificate", "Request.RevokedWhen", "Request.RevokedEffectiveWhen", "Request.RevokedReason"

Windows 2000 Server returns E_INVALIDARG for this value of the iColumnSetDefault parameter.

<44> Section 3.1.4.1.18: In Windows Server 2003, Windows Server 2008, Windows Server 2008 R2, Windows Server 2012, Windows Server 2012 R2, and Windows Server 2016 Technical Preview, the error is E_ACCESSDENIED (0x80070005). Windows 2000 does not return an error.

<45> Section 3.1.4.1.18: In Windows Server 2003, Windows Server 2008, Windows Server 2008 R2, Windows Server 2012, Windows Server 2012 R2, and Windows Server 2016 Technical Preview, the Windows CA defines local configuration to restrict programmatic access to some backup-related methods from a remote computer.

The Windows CA enforces this restriction based on the value of the following registry key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CertSvc\Configuration\{CA Name}\InterfaceFlags

Value

Meaning

0x00000000

The CA does not restrict access to the methods listed for the following servers.

0x00000040

The CA restricts access to the methods listed for the following servers.

<46> Section 3.1.4.1.19: In Windows Server 2003, Windows Server 2008,  Windows Server 2008 R2, Windows Server 2012, Windows Server 2012 R2, and Windows Server 2016 Technical Preview, the error is E_ACCESSDENIED (0x80070005). Windows 2000 does not return an error.

<47> Section 3.1.4.1.19: In Windows Server 2003, Windows Server 2008, Windows Server 2008 R2, Windows Server 2012, Windows Server 2012 R2, and Windows Server 2016 Technical Preview, the Windows CA defines local configuration to restrict programmatic access to some backup-related methods from a remote computer.

The Windows CA enforces this restriction based on the value of the following registry key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CertSvc\Configuration\{CA Name}\InterfaceFlags

Value

Meaning

0x00000000

The CA does not restrict access to the methods listed for the following servers.

0x00000040

The CA restricts access to the methods listed for the following servers.

<48> Section 3.1.4.1.20: In Windows Server operating system, the Windows CA defines local configuration to restrict programmatic access to some backup-related methods from a remote computer.

The Windows CA enforces this restriction based on the value of the following registry key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CertSvc\Configuration\{CA Name}\InterfaceFlags

Value

Meaning

0x00000000

The CA does not restrict access to the methods listed for the following servers.

0x00000040

The CA restricts access to the methods listed for the following servers.

<49> Section 3.1.4.1.20: In Windows Server 2003 the error is ERROR_UNEXPECTED_ERROR (0x8000FFFF). In Windows Server 2008, Windows Server 2008 R2, Windows Server 2012, Windows Server 2012 R2, and Windows Server 2016 Technical Preview, the error is E_ACCESSDENIED (0x80070005). Windows 2000 does not return an error.

<50> Section 3.1.4.1.21: In Windows Server 2003, Windows Server 2008, Windows Server 2008 R2, Windows Server 2012, Windows Server 2012 R2, and Windows Server 2016 Technical Preview, the Windows CA defines local configuration to restrict programmatic access to some backup-related methods from a remote computer.

The Windows CA enforces this restriction based on the value of the following registry key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CertSvc\Configuration\{CA Name}\InterfaceFlags

Value

Meaning

0x00000000

The CA does not restrict access to the methods listed for the following servers.

0x00000040

The CA does restrict access to the methods listed for the following servers.

<51> Section 3.1.4.1.21: In Windows Server 2003, the error is ERROR_UNEXPECTED_ERROR (0x8000FFFF). In Windows Server 2008, Windows Server 2008 R2, Windows Server 2012, Windows Server 2012 R2, and Windows Server 2016 Technical Preview, the error is E_ACCESSDENIED (0x80070005). Windows 2000 does not return an error.

<52> Section 3.1.4.1.22: In Windows Server 2003, Windows Server 2008, Windows Server 2008 R2, Windows Server 2012, Windows Server 2012 R2, and Windows Server 2016 Technical Preview, the Windows CA defines local configuration to restrict programmatic access to some backup-related methods from a remote computer.

The Windows CA enforces this restriction based upon the value of the following registry key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CertSvc\Configuration\{CA Name}\InterfaceFlags

Value

Meaning

0x00000000

The CA does not restrict access to the methods listed for the following servers.

0x00000040

The CA restricts access to the methods listed for the following servers.

<53> Section 3.1.4.1.22: Windows 2000 does not return an error. In Windows Server 2003, the error is ERROR_UNEXPECTED_ERROR (0x8000FFFF). In Windows Server 2008, Windows Server 2008 R2, Windows Server 2012, Windows Server 2012 R2, and Windows Server 2016 Technical Preview, the error is E_ACCESSDENIED (0x80070005).

<54> Section 3.1.4.1.23: In Windows Server 2003, Windows Server 2008, Windows Server 2008 R2, Windows Server 2012, Windows Server 2012 R2, and Windows Server 2016 Technical Preview, the Windows CA defines local configuration to restrict programmatic access to some backup-related methods from a remote computer.

The Windows CA enforces this restriction based on the value of the following registry key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CertSvc\Configuration\{CA Name}\InterfaceFlags

Value

Meaning

0x00000000

The CA does not restrict access to the methods listed for the following servers.

0x00000040

The CA restricts access to the methods listed for the following servers.

<55> Section 3.1.4.1.23: In Windows Server 2003, the error is ERROR_UNEXPECTED_ERROR (0x8000FFFF). In Windows Server 2008, Windows Server 2008 R2, Windows Server 2012, Windows Server 2012 R2, and Windows Server 2016 Technical Preview, the error is E_ACCESSDENIED (0x80070005). Windows 2000 does not return an error.

<56> Section 3.1.4.1.24: In Windows Server 2008, Windows Server 2008 R2, Windows Server 2012, Windows Server 2012 R2, and Windows Server 2016 Technical Preview, the error is E_ACCESSDENIED (0x80070005). Windows Server 2003 and Windows 2000 do not return an error.

<57> Section 3.1.4.1.25: In Windows Server 2003, the error is ERROR_UNEXPECTED_ERROR (0x8000FFFF). In Windows Server 2008, Windows Server 2008 R2, Windows Server 2012, Windows Server 2012 R2, and Windows Server 2016 Technical Preview, the error is E_ACCESSDENIED (0x80070005). Windows 2000 does not return an error.

<58> Section 3.1.4.1.25: In Windows Server 2003, Windows Server 2008, Windows Server 2008 R2, Windows Server 2012, Windows Server 2012 R2, and Windows Server 2016 Technical Preview, the Windows CA defines local configuration to restrict programmatic access to some backup-related methods from a remote computer.

The Windows CA enforces this restriction based upon the value of the following registry key:HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CertSvc\Configuration\{CA Name}\InterfaceFlags

Value

Meaning

0x00000000

The CA does not restrict access to the methods listed for the following servers.

0x00000040

The CA restricts access to the methods listed for the following servers.

<59> Section 3.1.4.1.26: The Microsoft CA maintains local configuration to allow or prevent the importing of foreign certificates, regardless of the value of dwFlags. The configuration is stored in the registry at the location that is specified in the following code example. If the registry value is set to 1, the ImportCertificate method works as documented. If it is set to 0, the FLAG_ALLOW_IMPORT_FOREIGN flag that is passed as a parameter has no effect, and 0x800b0107 is returned.

              
 HKLM\SYSTEM\CurrentControlSet\Services\CertSvc\Configuration\{CA Name}
 \KRAFlags (REG_DWORD)

<60> Section 3.1.4.1.26: The Microsoft CA maintains local configuration to allow or prevent the importing of foreign certificates regardless of the value of dwFlags. The configuration is stored in the registry at the location specified in the following code example. If the registry value is set to 1, the ImportCertificate method works as documented. If it is set to 0, the FLAG_ALLOW_IMPORT_FOREIGN flag that is passed as a parameter does not have an effect, and 0x800b0107 is returned.

              
 HKLM\SYSTEM\CurrentControlSet\Services\CertSvc\Configuration\{CA Name}
 \KRAFlags (REG_DWORD)

<61> Section 3.1.4.1.27: In Windows Server 2008, Windows Server 2008 R2, Windows Server 2012, Windows Server 2012 R2, and Windows Server 2016 Technical Preview, the error is E_ACCESSDENIED (0x80070005). Windows Server 2003 and Windows 2000 do not return an error.

<62> Section 3.1.4.1.28: In Windows Server 2008, Windows Server 2008 R2, Windows Server 2012, Windows Server 2012 R2, and Windows Server 2016 Technical Preview, the error is E_ACCESSDENIED (0x80070005). Windows Server 2003 and Windows 2000 do not return an error.

<63> Section 3.1.4.2: The supported clients are Windows XP, Windows Vista, Windows 7, Windows 8, Windows 8.1, and Windows 10. The supported servers are Windows Server 2003, Windows Server 2008, Windows Server 2008 R2, Windows Server 2012, Windows Server 2012 R2, and Windows Server 2016 Technical Preview.

<64> Section 3.1.4.2: In Windows 2000, Windows Server 2003, Windows Server 2008, Windows Server 2008 R2, Windows Server 2012, Windows Server 2012 R2, and Windows Server 2016 Technical Preview, the error is E_ACCESSDENIED (0x80070005).

<65> Section 3.1.4.2: In Windows Server 2003, Windows Server 2008, Windows Server 2008 R2, Windows Server 2012, Windows Server 2012 R2, and Windows Server 2016 Technical Preview, the error is E_ACCESSDENIED (0x80070005). Windows 2000 does not return an error.

<66> Section 3.1.4.2.1: The Microsoft CA keeps this list in a registry multistring value.

 HKLM\SYSTEM\CurrentControlSet\Services\CertSvc\Configuration\
 {CA Name}\CRLPublicationURLs

A specific protocol method does not exist to manipulate this list. Instead, the Microsoft CA uses typical registry manipulation tools.

The default values that are used by the Microsoft CA are a local path on the CA machine,

 {SYSTEM}\CertSrv\CertEnroll\

a local path in the registry,

 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs\

and the Active Directory path,

              
 ldap: ///CN={CAName}{index},CN={CAServerName},CN=CDP,
 CN=Public Key Services,CN=Services,CN=Configuration,DC={contoso},DC=com
              

where:

  • SYSTEM is replaced with the system directory of the CA machine, such as "C:\Windows\System32".

  • CAName is replaced with the sanitized name of the CA, as defined in [MS-WCCE] sections 1.3.2.4 and 3.1.1.4.1.1.

  • {CRLNameSuffix} is replaced with NULL if the CRL is signed by the first CA key (the CA key that has a key index 0) and by "(n)" if the CRL is signed by any subsequent CA key, with {n} being an integer equal to the identifier (Signing_Private_Key_Version_ID, as defined in [MS-WCCE] section 3.2.1.1.3) of the CA certificate private key.

  • CAServerName is replaced with the name of the host on which the CA is running.

  • DC={contoso},DC=com is replaced with the namespace of the Active Directory domain in which the Microsoft CA is installed.

<67> Section 3.1.4.2.1: The Microsoft CA keeps this list in the following registry multistring value. Note that the value is the same as that specified in the preceding Windows behavior note.

 HKLM\SYSTEM\CurrentControlSet\Services\CertSvc\Configuration\
 {CA Name}\CRLPublicationURLs

<68> Section 3.1.4.2.5: This rule applies to a Windows Server 2008, Windows Server 2008 R2, Windows Server 2012, Windows Server 2012 R2, or Windows Server 2016 Technical Preview CA. In Windows 2000 and Windows Server 2003, a CA will not enforce that cColumn is greater than 0. Rather, when cColumn is equal to zero, it will set pcColumn equal to zero, pctbColumnInfo->cb equal to 0, pctbColumnInfo->pb will point to a zero-length item, and the function will return successfully.

<69> Section 3.1.4.2.14: The Windows CA uses subkeys that use the following key as a node path:

  
 HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CertSvc\Configuration\<CA_
 CN>
  

where <CA_CN> is replaced with the CN of the CA.

<70> Section 3.1.4.2.14: The Windows CA uses a registry value name under the registry key that is composed by adding the value of the pwszNodePath parameter to the registry key:

  
 HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CertSvc\Configuration\<CA_
 CN>
  

where <CA_CN> is replaced with the CA's common name (CN).

<71> Section 3.1.4.2.14:  Windows Server 2012 R2 without [MSKB-3013769] sends 0x00050001, whereas Windows Server 2012 R2 with [MSKB-3013769] sends 0x00060001.

Show:
© 2016 Microsoft