of certificate that the client needs. CertificateUsage OIDs The request OIDs for use in the ExtendedKeyUsage extension, as specified in section 4.2.1.13. 2.5.29.3, 2.5.43.1 ValidityPeriod "Seconds" or "Minutes" or or "Days" or "Weeks" or "Months" or "Years" The validity period of the request MUST be defined in two values: number and units. For example, number=3 and units=weeks means that the request is for a certificate that will be valid for 3 weeks. This value MUST define the units for the validity period. Weeks ValidityPeriodUnits Unsigned integer This value MUST define the number units used for the validity period. The units are defined in the ValidityPeriod attribute. 3 ExpirationDate Date and time This MUST define the exact request expiration time of the requested certificate in the format defined in section 3.3 of the .<10> L"Tue, 21 Nov 2000 01:06:53 GMT" cdc An Active Directory FQDN. dcmachine.contoso.com rmd FQDN The requesting machine FQDN. mymachine.contoso.com CertificateTemplate The cn attribute on the Active Directory object that contains the certificate template This value MUST define the certificate template that was used by the client to construct the certificate request. ContosoAdministrator SAN collection This MUST contain a collection of one or more pairs for the SubjectAltName extension. The format for the internal collection MUST be: "name1=value1&name2=value". The supported names for this internal name-value collection are: Guid FQDN 1.2.3.4=user679 &guid=exampleguid &oid=4.3.2.1 &email=user679@contoso.com
Dn url ipaddress oid upn spn For all these names, the value MAY be any string. In addition to these names, the name MAY be any OID. If it is an OID, the value MUST be encoded as defined in the following table. challenge Password This attribute MUST be passed only with a Netscape KEYGEN request format. The value of the attribute MUST be the challenge (password) string associated with the request. For specifications, see section . mypassword requestername \account The identity of the user whose information MUST be used to construct the subject information of an issued certificate. It is used along with a ROBO for a different subject. Note: Unlike the other attributes in this table, this attribute can be passed only within a request format and cannot be passed using the pwszAttributes parameter. Contoso\tester Other (see section for possible values) See section 2.2.2.6.4.2 for possible values A valid RDN string SHOULD be used to pass subject names for a certificate request generated by using the KEYGEN format on a Netscape browser. US certfile UNC path The client requests that the server publish the issued certificate to the path that is specified in the for this attribute.<11> c:\mycert.cer RequestId ULONG The request ID of the request that is pending the attestation Challenge Response.<12> 1, 158, etc. When the SAN value in the preceding table, which is a list of name-value pairs, includes an OID as the name, the value of that OID MUST be encoded in one of the formats in the following table. In the following encoding, the format tag (for example, "{asn}") is a literal string. Possible SAN values. Format Meaning Example¹
"Microsoft Base Cryptographic Provider" RSA, 512 RSA, 512 [PKCS1] "Microsoft Strong Cryptographic Provider" RSA, 1024 [PKCS1] RSA, 1024 [PKCS1] "Microsoft Enhanced Cryptographic Provider" RSA, 1024 RSA, 1024 [PKCS1] "Microsoft AES Cryptographic Provider" RSA, 1024 RSA, 1024 [PKCS1] "Microsoft DSS Cryptographic Provider" Not available DSA, 1024 "Microsoft Base DSS and Diffie-Hellman Cryptographic Provider" Diffie-Hellman, 512 DSA, 1024 [FIPS186] "Microsoft Enhanced DSS and Cryptographic Provider" Diffie-Hellman, 1024 DSA, 1024 [FIPS186] "Microsoft DSS and Cryptographic Provider" Diffie-Hellman, 512 [PKCS3] "Not available" "Microsoft RSA/Schannel Cryptographic Provider" RSA, 1024, [PKCS1] "Not available" If the value of the strCSP is not on the list or the value in the table equals "Not available", continue with the next item in the list. If the value of the strCSP is on the list, use the mapped algorithm when creating a private key. If no algorithm was selected in step 2, use RSA algorithm and generate a 1024-bit key. Certificate.Template.pKICriticalExtensions The client MUST mark the extensions listed in the Certificate.Template.pKICriticalExtensions datum critical when encoding the extensions in the request. Specifications on the extensions format are in section . Certificate.Template.cn
Config_CA_Exit_Count datum. 0x05 0x00000000 0x00000004 0x06 0x00000000 0x00000004 0x07 0x00000000 0x00000004 0x08 0x00000000 0x00000004 0x09 0x00000000 0x00000004 0x0a 0x00000000 0x00000001 0x0b 0x00000000 0x00000001 0x0c The minimum index is 0. The maximum index is one less than the count of rows in the Signing_Cert table. An index of 0xFFFFFFFF is allowed and indicates the maximum valid index. 0x00000003 0x0d The minimum index is 0. The maximum index is one less than the count of rows in the Signing_Cert table. An index of 0xFFFFFFFF is allowed and indicates the maximum valid index. 0x00000003 0x0e 0x00000000 0x00000001 0x0f 0x00000000. An index of 0xFFFFFFFF is also valid and implies an index of 0x00000000. 0x00000003 0x10 0x00000000. An index of 0xFFFFFFFF is also valid and implies an index of 0x00000000. 0x00000003 0x11 The minimum index is 0. The maximum index is one less than the count of rows in the Signing_Cert table. An index of 0xFFFFFFFF is allowed and indicates the maximum valid index. 0x00000003 0x12 The minimum index is 0. The maximum index is one less than the count of rows in the Signing_Cert table. 0x00000003 0x13 ANY 0x00000001 0x14 ANY 0x00000001
CERT_E_REVOKED (0x800B010C) A certificate was explicitly revoked by its issuer. Revocation of certificates by a CA are uniquely tracked as specified in section 5.1.2.6. CERT_E_CHAINING (0x800B010B) A certificate chain cannot be built to a trusted root authority. An error occurred while building name chaining, as specified in sections 4.1.2.4 and 6. CERT_E_UNTRUSTEDROOT (0x800B010A) A certificate chain was processed but terminated in a root certificate, which is not trusted by the trust provider. An invalid path validation results in this error as specified in section 6.2. CRYPT_E_NO_REVOCATION_DLL (0x80092011) No DLL or exported function was found to verify revocation. An operational error occurred as specified in sections 3.3, 5.3.1, and 9. Specifically, this error code is included to indicate that the revocation library is missing. CRYPT_E_NO_REVOCATION_CHECK (0x80092012) The revocation status for the certificate cannot be verified. An operational error occurred as specified in sections 3.3, 5.3.1, and 9.
Index A Abstract data model client 65 84 server 196 98 Active Directory - server - enterprise CA 195 170 31 Attributes 221 45 221 65 34 C 40 31 38 37 Certificate 45 223 37 35 240 Client basic enrollment 65 66 80 66 65 65 66 80 65 enrollment based on certificate templates 84 86 94 86 84 84 86 94 85 65 37 36 221 26 36 D Data - abstract client 65 84 server 196 98 34 63 138 E 57 29 63 84 Enterprise 169 59 220 62 Events local client 80 94 server 218 169 timer client 80 94 server 218 169 219 219 31 224 G 220 131 139 168 12 H 25 I
224 29 220 220 23 Initialization client 66 86 server 197 106 12 K Key 26 222 220 61 59 41 27 Local events client 80 94 server 218 169 M Message processing client 66 86 server 197 106 Messages 33 33 client 65 84 169 Name 221 220 27 118 20 O 24 P 29 136 169 31 31 55 226 Protocol Details 65 R 20 23 20 30 42 112 137 53 55 28 63 220 Security attributes 221 221 223 221 221 220 220 key 222 220 name 221 220 220 220 Sequencing rules client 66 86 server 197 106 Server enterprise CA 196 Active Directory 195 170 197 218 197 169