technical content. 5/16/2008 6.0 Major Updated and revised the technical content. 6/20/2008 7.0 Updated and revised the technical content. 7/25/2008 7.1 Minor Clarified the meaning of the technical content. 8/29/2008 8.0 Major Updated and revised the technical content. 10/24/2008 9.0 Major Updated and revised the technical content. 12/5/2008 10.0 Major Updated and revised the technical content. 1/16/2009 11.0 Major Updated and revised the technical content. 2/27/2009 12.0 Major Updated and revised the technical content. 4/10/2009 13.0 Major Updated and revised the technical content. 5/22/2009 14.0 Major Updated and revised the technical content.
7/2/2009 15.0 Major Updated and revised the technical content. 8/14/2009 16.0 Updated and revised the technical content. 9/25/2009 17.0 Major Updated and revised the technical content. 11/6/2009 18.0 Major Updated and revised the technical content. 12/18/2009 19.0 Major Updated and revised the technical content. 1/29/2010 20.0 Updated and revised the technical content. 3/12/2010 21.0 Major Updated and revised the technical content. 4/23/2010 22.0 Updated and revised the technical content. 6/4/2010 23.0 Major Updated and revised the technical content. 7/16/2010 24.0 Major Updated and revised the technical content. 8/27/2010 25.0 Major Updated and revised
the technical content. 10/8/2010 26.0 Major Updated and revised the technical content. 11/19/2010 27.0 Updated and revised the technical content. 1/7/2011 28.0 Updated and revised the technical content. 2/11/2011 29.0 Major Updated and revised the technical content. 3/25/2011 30.0 Major Updated and revised the technical content. 5/6/2011 31.0 Major Updated and revised the technical content. 6/17/2011 31.1 Minor Clarified the meaning of the technical content. 9/23/2011 32.0 Major Updated and revised the technical content. 12/16/2011 33.0 Updated and revised the technical content. 3/30/2012 33.0 None No changes to the meaning, language,
or formatting of the technical content. 7/12/2012 34.0 Major Updated and revised the technical content. 10/25/2012 35.0 Major Updated and revised the technical content. 1/31/2013 35.0 None No changes to the meaning, language, or formatting of the technical content. 8/8/2013 36.0 Major Updated and revised the technical content. 11/14/2013 37.0 Major Updated and revised the technical content. 2/13/2014 38.0 Major Updated and revised the technical content. 5/15/2014 38.0 None No changes to the meaning, language, or formatting of the technical content. 6/30/2015 39.0 Major Significantly changed the technical content.
10/16/2015 39.0 None No changes to the meaning, language, or formatting of the technical content. 7/14/2016 40.0 Major Significantly changed the technical content. 6/1/2017 40.0 None No changes to the meaning, language, or formatting of the technical content. 9/15/2017 41.0 Significantly changed the technical content. 12/1/2017 41.0 None No changes to the meaning, language, or formatting of the technical content. 3/16/2018 42.0 Major Significantly changed the technical content.
The client SHOULD use the Certificate.Template.pKIDefaultCSPs datum to determine the algorithm and the size to be used to generate the as follows. For more details about the definition of the intNum and strCSP strings used in the processing rules below, see section 2.8. Sort the list by the intNum value in an ascending order. For each item in the list: Map the strCSP string to an algorithm name and key size the table below: strCSP Algorithm, key size when Value = 0x1 (AT_KEYEXCHANGE) Algorithm, key size when Value = 0x2 (AT_SIGNATURE) "Microsoft Base Cryptographic Provider" RSA, 512 RSA, 512 "Microsoft Strong Cryptographic Provider" RSA, 1024 [PKCS1] RSA, 1024 [PKCS1] "Microsoft Enhanced Cryptographic Provider" RSA, 1024 [PKCS1] RSA, 1024 "Microsoft AES Cryptographic Provider" RSA, 1024 [PKCS1] RSA, 1024 [PKCS1] "Microsoft DSS Cryptographic Provider" Not available DSA, 1024 "Microsoft Base DSS and Diffie-Hellman Cryptographic Provider" Diffie-Hellman, 512 DSA, 1024 [FIPS186] "Microsoft Enhanced DSS and Cryptographic Provider" Diffie-Hellman, 1024 [PKCS3] DSA, 1024 [FIPS186] "Microsoft DSS and Cryptographic Provider" Diffie-Hellman, 512 [PKCS3] "Not available" "Microsoft RSA/Schannel Cryptographic Provider" RSA, 1024, [PKCS1] "Not available" If the of the strCSP is not on the list or the value in the table equals "Not available", continue with the next item in the list. If the value of the strCSP is on the list, use the mapped algorithm when creating a private key. If no algorithm was selected in step 2, use algorithm and generate a 1024-bit key.
dwFlags Packed Data Requirements The dwFlags consists of a set of flags and values that MUST define the pctbRequest parameter and the expected content of the pctbCertChain parameter. This field MUST contain packed data specified as follows. 0 1 2 3 4 5 6 7 8 9 1 0 1 2 3 4 5 6 7 8 9 2 0 1 2 3 4 5 6 7 8 9 3 0 1 ExtendedFlags Flags RequestType Padding2 ExtendedFlags: This bit-field defines extended options for the server’s request processing. 0 1 2 3 4 5 6 7 0 0 0 0 0 A 0 0 Where the bits are defined as follows: Value Description A If this bit is set, the server MUST process the request as a new Certificate Transparency request, in accordance with section . Flags (1 byte): This bit-field MUST define options for the server's request processing and the response. 0 1 2 3 4 5 6 7 0 0 Z 0 X Y 0 0 Where the bits are defined as follows: Value Description X If this bit is set, the response MUST include the for all the returned in the pctbCertChain and pctbEncodedCert parameters. Y If this bit is set, then the response MUST be a CMC full response. If it is not set, the response MUST be a . This bit supported by the ICertRequestD2::Request2 method only. Z If this bit is set, this is a renewal request on behalf of another user. The processing for this type of request are specified in section . RequestType (1 byte): RequestType MUST define the possible formats of the certificate request submitted in the pctbRequest parameter (format types are specified in ). Value Meaning 0x00 The client relies on to determine the request type. See section for more details. 0x01 The request format MUST be a PKCS #10 request structure. 0x02 The request format MUST be a Netscape request structure.
MUST be a binary object that contains the certificate chain for a signing certificate and the CRL for the certificates in the chain identified by the PropIndex parameter. MUST be a binary object for a chain containing CRLs for the CA's current exchange certificate from the Current_CA_Exchange_Cert datum. The PropIndex parameter MUST be 0x00000000 or 0xFFFFFFFF. MUST be an HRESULT that identifies the result of certificate validation, as specified in [RFC3280], by the CA for the CA signing certificates identified by the PropIndex parameter. MUST be a , by index, from a CA. For more information about , see .
Returning the Certificate as a CMS Certificate Response 8334 : For the 'certificates' field, clarified that the return of a precertificate by the CA must be given priority when a request is pending with an issued precertificate. Major dwFlags Packed Data Requirements 8334 : Changed name of 'Padding1' field to 'Extended Flags' in 'dwFlags Packed Data' and provided definition for bit setting 'A' that indicates the server must process the request as a new Certificate Transparency Request. Major 3.2.1.4.3.1.1 dwFlags Packed Data Requirements 8334 : Added 2 new values/meanings for the RequestType field in the dwFlags bit field definition: 0x05 The request format MUST be a response to the attestation CAChallenge. 0x06 The request format MUST be a SignedCertificateTimestampList structure.
Index A Abstract data model client 65 84 server 198 98 Active Directory - server - enterprise CA 197 171 32 Attributes 222 45 222 65 34 C 40 32 39 38 Certificate 45 224 37 35 240 Client basic enrollment 65 66 81 66 65 65 66 81 65 enrollment based on certificate templates 84 86 95 86 84 84 86 95 86 65 37 36 222 26 36 D Data - abstract client 65 84 server 198 98 34 63 140 E 57 30 63 84 Enterprise 171 59 221 62 Events local client 81 95 server 219 171 timer client 81 95 server 219 171 220 220 32 225 G 221 133 142 170 12 H 26
I 225 30 221 221 23 Initialization client 66 86 server 199 107 12 K Key 26 223 221 61 59 41 28 Local events client 81 95 server 219 171 M Message processing client 66 86 server 199 107 Messages 33 33 Modes client 65 84 171 Name 222 221 28 119 20 O 25 P 30 137 171 31 31 55 227 Protocol Details 65 R 20 23 20 30 42 113 139 53 55 28 63 221 Security attributes 222 222 224 222 222 221 221 key 223 221 name 222 221 221 221 Sequencing client 66 86 server 199 107 Server enterprise CA 198 Active Directory 197 171 199 219