Revision Summary Date Revision History Revision Class Comments 2/22/2007 0.01 New Version 0.01 release 6/1/2007 1.0 Major Updated and revised the technical content. 7/3/2007 1.0.1 Editorial Changed language and formatting in the technical content. 7/20/2007 1.1 Minor Clarified the meaning of the technical content. 8/10/2007 1.1.1 Editorial Changed language and formatting in the technical content. 9/28/2007 1.2 Minor Clarified the meaning of the technical content. 10/23/2007 2.0 Major Updated and revised the technical content. 11/30/2007 3.0 Major Updated and revised the technical content. 1/25/2008 4.0 Major Updated and revised the technical content. 3/14/2008 5.0 Major Updated and revised the
technical content. 5/16/2008 6.0 Updated and revised the technical content. 6/20/2008 7.0 Major Updated and revised the technical content. 7/25/2008 7.1 Minor Clarified the meaning of the technical content. 8/29/2008 8.0 Major Updated and revised the technical content. 10/24/2008 9.0 Major Updated and revised the technical content. 12/5/2008 10.0 Major Updated and revised the technical content. 1/16/2009 11.0 Updated and revised the technical content. 2/27/2009 12.0 Major Updated and revised the technical content. 4/10/2009 13.0 Major Updated and revised the technical content. 5/22/2009 14.0 Major Updated and revised the technical content.
7/2/2009 15.0 Major Updated and revised the technical content. 8/14/2009 16.0 Major Updated and revised the technical content. 9/25/2009 17.0 Updated and revised the technical content. 11/6/2009 18.0 Major Updated and revised the technical content. 12/18/2009 19.0 Major Updated and revised the technical content. 1/29/2010 20.0 Major Updated and revised the technical content. 3/12/2010 21.0 Major Updated and revised the technical content. 4/23/2010 22.0 Updated and revised the technical content. 6/4/2010 23.0 Major Updated and revised the technical content. 7/16/2010 24.0 Major Updated and revised the technical content. 8/27/2010 25.0 Major Updated and revised
the technical content. 10/8/2010 26.0 Major Updated and revised the technical content. 11/19/2010 27.0 Major Updated and revised the technical content. 1/7/2011 28.0 Major Updated and revised the technical content. 2/11/2011 29.0 Major Updated and revised the technical content. 3/25/2011 30.0 Major Updated and revised the technical content. 5/6/2011 31.0 Updated and revised the technical content. 6/17/2011 31.1 Minor Clarified the meaning of the technical content. 9/23/2011 32.0 Major Updated and revised the technical content. 12/16/2011 33.0 Updated and revised the technical content. 3/30/2012 33.0 None No changes to the meaning, language,
or formatting of the technical content. 7/12/2012 34.0 Major Updated and revised the technical content. 10/25/2012 35.0 Major Updated and revised the technical content. 1/31/2013 35.0 None No changes to the meaning, language, or formatting of the technical content. 8/8/2013 36.0 Major Updated and revised the technical content. 11/14/2013 37.0 Updated and revised the technical content. 2/13/2014 38.0 Major Updated and revised the technical content. 5/15/2014 38.0 None No changes to the meaning, language, or formatting of the technical content. 6/30/2015 39.0 Major Significantly changed the technical content.
10/16/2015 39.0 None No changes to the meaning, language, or formatting of the technical content. 7/14/2016 40.0 Major Significantly changed the technical content. 6/1/2017 40.0 None No changes to the meaning, language, or formatting of the technical content. 9/15/2017 41.0 Major Significantly changed the technical content.
RPC Interface UUID for ICertRequestD section A.2.5. RPC Interface UUID for ICertRequestD2 [C706] section A.2.5. CLSID for CCertRequestD (the class that implements the ICertRequestD and ICertRequestD2 interfaces) [C706] section A.2.5.
Element type Encoding type Meaning FILE_ELEMENT_CERT_TYPE (0x00000020) X509_ASN_ENCODING (0x00000001) The element contains ASN.1-encoded X.509 , as defined in . CERT_FRIENDLY_NAME_PROP_ID (0x0000000d) X509_ASN_ENCODING (0x00000001) A friendly name can be associated with the certificate. The friendly name is specified as a Unicode character string. CERT_DESCRIPTION_PROP_ID (0x0000000b) X509_ASN_ENCODING (0x00000001) This property allows the user to describe the use for the certificate. CERT_ENHKEY_USAGE_PROP_ID (0x00000009) X509_ASN_ENCODING (0x00000001) A specific set of enhanced key usages can be enabled or disabled for a certificate. The ASN.1 representation for is described in [RFC3280] section 4.2.1.13. CERT_CROSS_CERT_DIST_POINTS_PROP_ID (0x00000017) X509_ASN_ENCODING (0x00000001) The Cross-Certificate Distribution Points extension can be used to specify the download URL for that are associated with a particular certificate. The ASN.1 definition for Cross-Certificate Distribution Points is: CrossCertDistPoints ::= SEQUENCE { syncDeltaTime INTEGER (0..4294967295) OPTIONAL, } ::= SEQUENCE OF GeneralNames GeneralNames ::= AltNames For the definition of AltNames, see [RFC3280] section 4.2.1.7, the definition of GeneralNames. terminated
Common Error Codes The following codes are used by this protocol to indicate specific error conditions. Other error values might be used and are implementation-specific. Return value/code Description 0x80070002 ERROR_FILE_NOT_FOUND The system cannot find the specified file. 0x8007000D ERROR_INVALID_DATA The data is not valid. 0x80074004 CERTSRV_E_PROPERTY_EMPTY A required property value is empty. 0x80070057 E_INVALIDARG The parameter is incorrect. 0x80091004 CRYPT_E_INVALID_MSG_TYPE The cryptographic message type is not valid. 0x8009200E CRYPT_E_NO_SIGNER The signed cryptographic message does not have a signer for the specified signer index. Directory Service Schema Elements This protocol accesses the schema classes and that are listed in the following table. For the syntactic specifications of the following class or class/attribute pairs, refer to Active Directory Domain Services (AD DS) in , , , and . Class Attribute certificationAuthority cACertificate cn Computer cn distinguishedName dNSHostName objectGuid msPKI-PrivateKeyRecoveryAgent cn userCertificate
If the CA implements the Signing_Cert_Certificate column, it MUST validate the status of the requested signing certificate that is pointed to by the PropIndex parameter. It MUST also return an HRESULT value that identifies the status of the signing certificate. Otherwise, it MUST return an empty . If the certificate validation succeeded, the property value SHOULD be S_OK. If the certificate validation failed, the returned HRESULT value SHOULD indicate the error. Certificate validation SHOULD follow the requirements as specified in . The CA MUST return the status in a CERTTRANSBLOB structure. The pb member of the structure MUST to the returned HRESULT value in format. The cb member MUST contain the length of a LONG. Possible values include but are not limited to those in the following table. Other common error codes are specified in . Meaning Section in RFC 3280 CRYPT_E_REVOCATION_OFFLINE (0x80092013)_ The status cannot be checked because the revocation server is offline. An operational error occurred as specified in sections 3.3, 5.3.1, and 9. CERT_E_EXPIRED (0x800B0101) A required certificate is not within its validity period. A time validity check failed as specified in section 4.1.2.5. CERT_E_REVOKED (0x800B010C) A certificate was explicitly revoked by its issuer. Revocation of certificates by a CA are uniquely tracked as specified in section 5.1.2.6. CERT_E_CHAINING (0x800B010B) A certificate chain cannot be built to a root authority. An occurred while building name chaining, as specified in sections 4.1.2.4 and 6. CERT_E_UNTRUSTEDROOT (0x800B010A) A certificate chain was processed but terminated in a , which is An invalid path validation results in this as specified in section 6.2.
the Windows service shipped with Windows Server 2003. 3 ClientIdWizard2003 The client application in the enrollment wizard shipped with Windows Server 2003. 4 ClientIdCertReq2003 The client application in certreq.exe shipped with Windows Server 2003. 5 ClientIdDefaultRequest The client application that uses Windows Vista and later enrollment classes. 6 ClientIdAutoEnroll The client application in the Windows autoenrollment service shipped with Windows Vista and later. 7 ClientIdRequestWizard The client application in the enrollment wizard shipped with Windows Vista and later. 8 ClientIdEOBO The client application that makes requests. 9 ClientIdCertReq The client application in certreq.exe shipped with Windows Vista, Windows 7, Windows 8, Windows 8.1, and Windows 10.
A Abstract data model client 65 84 server 196 98 Active Directory - server - enterprise CA 195 169 32 Attributes 220 45 220 65 34 C 40 32 39 38 Certificate 45 222 37 35 238 Client basic enrollment 65 66 80 66 65 65 66 80 65 enrollment based on certificate templates 84 86 94 86 84 84 86 94 85 65 37 36 220 26 36 D Data model - abstract client 65 84 server 196 98 34 63 138 E 57 30 63 84 Enterprise 169 59 219 62 Events local client 80 94 server 217 169 timer client 80 94 server 217 169 218 218 32 223 G 219 131 139 168 12 H 26
I 223 30 219 219 23 Initialization client 66 86 server 197 106 12 K Key 26 221 219 61 59 41 27 Local events client 80 94 server 217 169 M Message processing client 66 86 server 197 106 Messages 33 33 Modes client 65 84 169 Name 220 219 27 118 20 O 25 P 30 136 169 31 31 55 225 Protocol Details 65 R 20 23 20 30 42 112 137 53 55 28 63 219 Security attributes 220 220 222 220 220 219 219 key 221 219 name 220 219 219 219 Sequencing rules client 66 86 server 197 106 Server enterprise CA 196 Active Directory 195 169 197 217