Revision Summary Date Revision History Revision Class Comments 2/22/2007 0.01 New Version 0.01 release 6/1/2007 1.0 Updated and revised the technical content. 7/3/2007 1.0.1 Editorial Changed language and formatting in the technical content. 7/20/2007 1.1 Minor Clarified the meaning of the technical content. 8/10/2007 1.1.1 Editorial Changed language and formatting in the technical content. 9/28/2007 1.2 Minor Clarified the meaning of the technical content. 10/23/2007 2.0 Updated and revised the technical content. 11/30/2007 3.0 Major Updated and revised the technical content. 1/25/2008 4.0 Major Updated and revised the technical content. 3/14/2008 5.0 Major Updated and revised the
technical content. 5/16/2008 6.0 Major Updated and revised the technical content. 6/20/2008 7.0 Major Updated and revised the technical content. 7/25/2008 7.1 Minor Clarified the meaning of the technical content. 8/29/2008 8.0 Major Updated and revised the technical content. 10/24/2008 9.0 Major Updated and revised the technical content. 12/5/2008 10.0 Major Updated and revised the technical content. 1/16/2009 11.0 Updated and revised the technical content. 2/27/2009 12.0 Updated and revised the technical content. 4/10/2009 13.0 Major Updated and revised the technical content. 5/22/2009 14.0 Updated and revised the technical content.
or formatting of the technical content. 7/12/2012 34.0 Major Updated and revised the technical content. 10/25/2012 35.0 Major Updated and revised the technical content. 1/31/2013 35.0 None No changes to the meaning, language, or formatting of the technical content. 8/8/2013 36.0 Updated and revised the technical content. 11/14/2013 37.0 Updated and revised the technical content. 2/13/2014 38.0 Major Updated and revised the technical content. 5/15/2014 38.0 None No changes to the meaning, language, or formatting of the technical content. 6/30/2015 39.0 Significantly changed the technical content.
RPC Interface UUID for ICertRequestD section A.2.5. RPC Interface UUID for ICertRequestD2 [C706] section A.2.5. CLSID for CCertRequestD (the class that implements the ICertRequestD and ICertRequestD2 interfaces) [C706] section A.2.5.
CertificateUsage OIDs The request OIDs for use in the ExtendedKeyUsage extension, as specified in section 4.2.1.13. 2.5.29.3, 2.5.43.1 ValidityPeriod "Seconds" or "Minutes" or "Hours" or "Days" or "Weeks" or "Months" or The validity period of the request MUST be defined in two values: number and units. For example, number=3 and units=weeks means that the request is for a certificate that will be valid for 3 weeks. This MUST define the units for the validity period. Weeks ValidityPeriodUnits Unsigned integer This value MUST define the number units used for the validity period. The units are defined in the ValidityPeriod attribute. 3 ExpirationDate Date and time This value MUST define the exact request expiration time of the requested certificate in the format defined in section 3.3 of the .<10> L"Tue, 21 Nov 2000 01:06:53 GMT" cdc An Active Directory server FQDN. dcmachine.contoso.com rmd FQDN The requesting machine FQDN. mymachine.contoso.com CertificateTemplate The cn attribute on the Active Directory object that contains the certificate template This MUST define the certificate template that was used by the client to construct the certificate request. ContosoAdministrator SAN collection This value MUST contain a collection of one or more pairs for the SubjectAltName extension. The format for the internal collection MUST be: "name1=value1&name2=value". The supported names for this internal name-value collection are: Guid Email FQDN Dn url ipaddress oid upn spn For all these names, the value MAY be any string. 1.2.3.4=user679 &guid=exampleguid &oid=4.3.2.1 &email=user679@contoso.com
"Microsoft Strong Cryptographic Provider" RSA, 1024 [PKCS1] RSA, 1024 [PKCS1] "Microsoft Enhanced Cryptographic Provider" RSA, 1024 [PKCS1] RSA, 1024 [PKCS1] "Microsoft AES Cryptographic Provider" RSA, 1024 [PKCS1] RSA, 1024 [PKCS1] "Microsoft DSS Cryptographic Provider" Not available DSA, 1024 "Microsoft Base DSS and Diffie-Hellman Cryptographic Provider" Diffie-Hellman, 512 DSA, 1024 [FIPS186] "Microsoft Enhanced DSS and Cryptographic Provider" Diffie-Hellman, 1024 [PKCS3] DSA, 1024 [FIPS186] "Microsoft DSS and Cryptographic Provider" Diffie-Hellman, 512 [PKCS3] "Not available" "Microsoft RSA/Schannel Cryptographic Provider" RSA, 1024, [PKCS1] "Not available" If the value of the strCSP is not on the list or the value in the table equals "Not available", continue with the next item in the list. If the value of the strCSP is on the list, use the mapped algorithm when creating a private key. If no algorithm was selected in step 2, use RSA algorithm and generate a 1024-bit key. Certificate.Template.pKICriticalExtensions The client MUST mark the extensions listed in the Certificate.Template.pKICriticalExtensions datum critical when encoding the extensions in the request. Specifications on the extensions format are in section . Certificate.Template.cn The client MAY use the of the Certificate.Template.cn datum to encode certificate template name as specified in section .<38> Certificate.Template.revision
If the CA implements the Signing_Cert_Certificate column, it MUST validate the status of the requested signing certificate that is pointed to by the PropIndex parameter. It MUST also return an HRESULT value that identifies the status of the signing certificate. Otherwise, it MUST return an empty . If the certificate validation succeeded, the property value SHOULD be S_OK. If the certificate validation failed, the returned HRESULT value SHOULD indicate the error. Certificate validation SHOULD follow the requirements as specified in . The CA MUST return the status in a CERTTRANSBLOB structure. The pb member of the structure MUST point to the returned HRESULT value in little-endian format. The cb member MUST contain the length of a LONG. Possible values include but are not limited to those in the following table. Other common error codes are specified in . Value Meaning Section in RFC 3280 CRYPT_E_REVOCATION_OFFLINE (0x80092013)_ The revocation status cannot be checked because the revocation server is offline. An operational error occurred as specified in sections 3.3, 5.3.1, and 9. CERT_E_EXPIRED (0x800B0101) A required certificate is not within its validity period. A time validity check failed as specified in section 4.1.2.5. CERT_E_REVOKED (0x800B010C) A certificate was explicitly revoked by its issuer. Revocation of certificates by a CA are uniquely tracked as specified in section 5.1.2.6. CERT_E_CHAINING (0x800B010B) A certificate chain cannot be built to a trusted root authority. An error occurred while building name chaining, as specified in sections 4.1.2.4 and 6. CERT_E_UNTRUSTEDROOT (0x800B010A) A certificate chain was processed but An invalid path validation results in this error
Interaction with Active Directory This section provides a recommendation for the Enterprise CA on how to access Active Directory. Server implementations can use an alternative method to read or write the information to the Active Directory that is required for the server processing rules in . The CA SHOULD use LDAP search and modify operations, as specified in sections 4.5 and 4.6, to read and write to the Active Directory. The profile of LDAP as implemented by the Active Directory servers (DCs) as described in section 3.1.1.3. Search Requests for Reading Objects under Enrollment Services or Certificate Templates Container This type of search request is used to read objects under or from the LDAP directory. Input Parameters: InputContainer: Determines which container is being queried. The possible values are Enrollment Services Container and Certificate Templates Container. Output Parameters: CertificateTemplatesandEnrollmentServicesObjects: The set of objects under Enrollment Services Container or Certificate Templates Container in Active Directory. Processing Rules: The CA MUST perform the processing rules in section . In the following sections, the following local variable is used: ActiveDirectory_Connection: An ADConnection handle. For more information, see section 7.2. ContainerDistinguishedName: A distinguished name. Search Requests The CA SHOULD perform search requests demonstrated in the following figure. Figure 3: Retrieving ADConnection handle for reading objects under certificate templates and enrollment services containers The preceding figure describes the algorithm used for retrieving an ADConnection handle for reading objects under certificate templates and enrollment services containers. The following steps describe the flow of the preceding figure: If the CertificateTemplatesAndEnrollmentServices_AD_Connection ADM element is NULL: Invoke the "Initialize ADConnection" task ( section 7.6.1.1) to construct an ADConnection with the following parameters: TaskInputTargetName: NULL TaskInputPortNumber: If the value of the Config_CA_LDAP_Flags datum has 0x0000001 (LDAPF_SSLENABLE) bit set, use port 636. Otherwise, use port 389. Store the returned ADConnection handle in the ActiveDirectory_Connection variable.
CASanitizedL, CASanitizedS, CASanitizedC, CAFullDNSMachineName\CASanitizedCommonName, ExchangeCertName, SignatureCertName, Description Each field in the preceding string is described in the following table. Optional fields that are not populated contain quotation marks (""). All but the first and seventh fields are optional. Field Description CASanitizedCN The sanitized CN from the CA certificate subject. CASanitizedOU Optional. The sanitized OU from the CA certificate subject. CASanitizedO Optional. The sanitized O from the CA certificate subject. CASanitizedL Optional. The sanitized from the CA certificate subject. CASanitizedS Optional. The sanitized from the CA certificate subject. CASanitizedC Optional. The sanitized C from the CA certificate subject. CAFullDNSMachineName\ CASanitizedCommonName A configuration string that contains the CA Domain Name System (DNS) name and the sanitized common name. ExchangeCertName Optional. The file name of the CA exchange certificate. This field is never used and the value is empty. SignatureCertName Optional. The file name of the CA signing certificate. For the first CA signing certificate only, this is stored in the %windir%\System32\CertSrv\CertEnroll directory. Description Optional. This is the CA description. If specified, this is the sanitized CN from the CA certificate subject. For more information about sanitized names, see section . The shared folder can also contain the additional files specified as follows: CA signing certificates: The certificate are encoded by using DER, and the naming convention is "CAComputerDNSName_CASanitizedName(CertIndex).crt". Because the CertIndex value is based on CA certificate renewal, no index value is present for the first certificate. Certificate request Subordinate CAs copy the certificate request file to this folder. This file contains data on the certificate that the subordinate CA requests from its parent CA. The file is encoded by using DER, and the naming convention is
Protocol syntax refers to data elements (such as packets, structures, enumerations, and methods) as well as interfaces. Protocol revision refers to changes made to a protocol that affect the bits that are sent over the wire. The changes made to this document are listed in the following table. For more information, please contact . Section Tracking number (if applicable) and description Major change (Y or N) Change type Common Structures Removed that the BYTE datatype is defined elsewhere because it is defined in section 2.2.1. Y Content update. CATRANSPROP Updated the structure definition to show the name at the top of the definition to the IDL. Y Content update. CAINFO Updated the structure definition to show the name at the top of the definition and to make the member datatypes match the IDL. Y Content update. Common Error Codes : Removed unreferenced error codes from table, and added missing one - 0x8007000D ERROR_INVALID_DATA Content update. ICertRequestD::Request (Opnum 3) Updated the method declaration to make the parameter properties and datatypes match the IDL. Y Content update. Renewing a Certificate Request Using CMS and CMC Request Format 72956 : Revised error code for ERROR_INVALID_DATA from 0x80007000D to 0x8007000D. N Content update. ICertRequestD::GetCACert (Opnum 4) Updated the method declaration to make the parameter properties and datatypes match the IDL. Y Content update. ICertRequestD::Ping (Opnum 5) Updated the method declaration to make the parameter properties and Y Content update.
datatypes match the IDL. ICertRequestD2::Request2 (Opnum 6) Updated the method declaration to make the parameter properties and datatypes match the IDL. Y Content update. ICertRequestD2::GetCAProperty (Opnum 7) Updated the method declaration to make the parameter properties and datatypes match the IDL. Y Content update. ICertRequestD2::GetCAPropertyInfo (Opnum 8) Updated the method declaration to make the parameter properties and datatypes match the IDL. Y Content update. ICertRequestD2::Ping2 (Opnum 9) Updated the method declaration to make the parameter properties and datatypes match the IDL. Y Content update.
Index A Abstract data model client 65 84 server 196 98 Active Directory - server - enterprise CA 195 169 32 Attributes 220 45 220 65 34 C 40 32 39 38 Certificate 45 222 37 35 238 Client basic enrollment 65 66 80 66 65 65 66 80 65 enrollment based on certificate templates 84 86 94 86 84 84 86 94 85 65 37 36 220 26 36 D Data model - abstract client 65 84 server 196 98 34 63 138 E 57 30 63 84 Enterprise 169 59 219 62 Events client 80 94 server 217 169 timer client 80 94 server 217 169 218 218 32 223 G 219 131 139 168 12 H 26
I 223 30 219 219 23 Initialization client 66 86 server 197 106 12 K Key 26 221 219 61 59 41 27 Local events client 80 94 server 217 169 M Message processing client 66 86 server 197 106 Messages 33 33 client 65 84 169 N Name 220 219 27 118 20 O 25 P 30 136 169 31 31 55 225 Protocol Details 65 R 20 23 20 30 42 112 137 53 55 28 63 219 Security attributes 220 220 222 220 220 219 219 key 221 219 name 220 219 219 219 Sequencing rules client 66 86 server 197 106 Server enterprise CA 196 Active Directory 195 169 197 217