Michael Waterman

Taking the FUD out of PQC

July 2, 2026 / Michael Waterman / 0 Comments

“But Mike… there is no FUD in Post-Quantum Cryptography.”

I’m glad you brought that up, because that’s exactly what this post is about.

When people hear the term Post-Quantum Cryptography (PQC), the conversation often goes in one of two directions. Some claim that quantum computers are still decades away and that there’s nothing to worry about. Others make it sound as if RSA will stop working sometime next Tuesday, neither view tells the whole story. The reality is far more interesting, and far more nuanced than many have you believe, Post-Quantum Cryptography isn’t about fear, uncertainty, or doubt. It’s about understanding the actual risks, separating scientific facts from headlines, and making informed architectural decisions based on evidence rather than speculation.

So, let’s take the FUD out of the discussion. In this blog, we’ll look at what current research actually tells us about quantum computers, why symmetric encryption such as AES is in a very different position than RSA and ECC, who is realistically capable of building a cryptographically relevant quantum computer, and why organizations should begin preparing today, even though the first machine capable of breaking modern public key cryptography is unlikely to appear in your local datacenter anytime soon. Because the real challenge isn’t that quantum computers are coming. The real challenge is making sure your organization is ready when they do.

How Merkle Tree Certificates Work

June 27, 2026 / Michael Waterman / 0 Comments

For more than 35 years, X.509 certificates have formed the foundation of digital trust on the Internet and in many organizations alike. From HTTPS and VPNs to enterprise authentication and code signing, the basic architecture has remained unchanged. As we enter the post-quantum era, however, it may not be the cryptographic algorithms that need the biggest overhaul, but the certificate model itself.

Imagine a Certificate Authority such as Let’s Encrypt issuing hundreds of millions of post-quantum certificates. Every one of those certificates now carries a digital signature that is significantly larger than today’s RSA or ECC signatures. Suddenly, TLS handshakes become larger, certificate chains consume more bandwidth, Certificate Transparency logs grow faster, and browsers have considerably more data to process. Everything just slows down.

The challenge is no longer whether post-quantum cryptography works. The challenge is whether the X.509 certificate architecture can continue to scale in a post-quantum world. This is exactly the problem that Merkle Tree Certificates (MTC) are designed to solve.

AD CS Performance Toolkit

June 15, 2026 / Michael Waterman / 0 Comments

During many of the Active Directory Certificate Services (AD CS) projects I work on, the discussion always turns to performance. “So Mike, how to we need to scale the machines?” Is the virtual hardware powerful enough? Do we have sufficient memory? How many CPU cores should the Certification Authority have? Is our Hardware Security Module (HSM) fast enough? Will disk I/O become a bottleneck? And perhaps the simplest question of all:

How fast is Active Directory Certificate Services actually?

Another challenge I regularly encounter is the need for a realistic Certification Authority database. Whether demonstrating reporting capabilities, validating certificate templates, testing custom PowerShell scripts, or creating a representative lab environment, an empty CA database simply does not reflect production. After searching for a suitable solution, I realized that nothing really existed that combined realistic certificate generation with meaningful performance benchmarking. Existing tools either focused on enrollment or stress testing, but none provided detailed insight into where certificate issuance time was actually spent….so I built one.

The AD CS Benchmark & Performance Analysis Toolkit is a PowerShell-based utility that generates realistic PKCS#10 certificate requests, submits them through the native ICertRequest2 COM interface, optionally creates matching Active Directory objects, and records detailed timing information for every stage of the enrollment process.

Building a Highly Available CRL and AIA Distribution Platform for AD CS

June 4, 2026 / Michael Waterman / 0 Comments

Last time I wrote about the why a Certificate Revocation List (CRL) should be available for the majority of services that make use of certificates. One of those prime examples is the use of smartcards. When revocation can’t be checked, you simply can not logon. Most Microsoft PKI deployments start with a single web server hosting the CRL Distribution Point (CDP) and Authority Information Access (AIA) locations. While this works well for smaller environments or labs, it introduces a single point of failure. If the web server becomes unavailable, certificate revocation checking may fail and certificate validation can be disrupted across the environment.

The Reality Behind PKI Revocation Checking

May 25, 2026 / Michael Waterman / 4 Comments

Last week I attended an interesting PKI training from CQURE. I never really had any formal PKI training before, mostly because I’ve spent years learning it the way many infrastructure engineers do, by breaking things in labs, fixing production issues, and occasionally questioning my life choices while staring at certutil output at 2 AM.

Still, I thought it would be fun to join. Most of the material was already familiar, but I met interesting people, had some good discussions, and definitely learned a few new things along the way. If you want to get into Microsoft PKI, I can genuinely recommend the training. PKI is one of those subjects that somehow manages to be both incredibly boring and extremely fascinating at the same time.

One of the topics we discussed was revocation checking. In the Microsoft world, this usually means Certificate Revocation Lists (CRLs) or the Online Certificate Status Protocol (OCSP). What many people misunderstand, however, is that revocation checking is not some universally enforced security mechanism. Whether revocation is actually checked often depends entirely on the application, service, operating system, or even the exact API being used underneath.

Windows Server 2025 and Post-Quantum PKI

May 15, 2026 / Michael Waterman / 3 Comments

Once upon a time, certificates were issued, systems trusted each other, smartcards authenticated users, VPNs connected remotely, web servers showed reassuring padlocks, and somewhere in a forgotten virtual machine or dusty rack server, a CA happily kept signing certificates while everyone collectively agreed not to touch it unless absolutely necessary. And to be fair, in most cases, that worked surprisingly well. Until suddenly… it didn’t.

Over the last few years, PKI has been pushed far beyond what many environments originally designed it for. Certificate usage exploded. Identity became the new security perimeter. TLS is everywhere. Code signing became critical. Zero Trust architectures increased certificate dependency. And now, on top of all that, the industry is preparing for something that used to sound like science fiction:

Post-Quantum Cryptography. (Insert some dramatic music)

During the recent Windows Server 2025 Summit sessions, Microsoft shared a major update on their Post-Quantum roadmap for Active Directory Certificate Services (AD CS), including the introduction of ML-DSA support in Windows Server 2025 and the first practical steps toward quantum-resilient PKI.

Building Windows images with Packer on Hyper-V

April 29, 2026 / Michael Waterman / 0 Comments

Back in December, I published a blog on building Windows images using Packer on Proxmox. That setup worked well, but like most things in infrastructure, you start tweaking, refining, and eventually rethinking parts of it. if you’re anything like me, this needs to work perfectly…. and that takes a lot of time. Over the past months, I’ve streamlined the entire workflow. Less friction, more consistency, and most importantly, something I can reuse across different Windows versions without thinking twice. And best of all, it’s now fully functional on Microsoft Hyper-V!

In this post, I’ll walk you through my current setup for building Windows Server images on Hyper-V using Packer. This is the version I actually use today as I moved back to Windows Hyper-V for my lab setup, not just something that works, but something that’s predictable and maintainable and was really fun to make.

Monitoring Windows Firewall logs with Azure Monitor

April 21, 2026 / Michael Waterman / 2 Comments

In a previous blog, “On-prem Conditional Access You Never Knew You Had” I explored how the built-in Windows Firewall can be used as a powerful control mechanism to restrict access to systems, effectively bringing conditional access concepts to on-premises environments. The response to that post was overwhelming, with over 23,000 views on Reddit alone. Clearly, many organizations are interested in rethinking how they use the Windows Firewall beyond its default, often permissive configuration, and so should you/ But before you can confidently start restricting access, there is a fundamental question you need to answer:

What is actually being used in your environment?

In many cases, firewall rules have grown organically over time. Ports are opened “temporarily,” (read: we forget, so they will be open forever) exceptions are made for specific systems, and over the years, the rule set becomes difficult to understand, let alone control or optimize. Tightening those rules without proper insight is risky and can easily break critical services.

On-prem conditional access you never knew you had

April 17, 2026 / Michael Waterman / 5 Comments

We often associate Conditional Access with Entra ID, Cloud apps, and Zero Trust.
But long before cloud-native policy engines existed, Windows already had a way to enforce identity-based access between endpoints, and I mean really long ago. I would make the claim that we could go back to February of the year 2000, when Windows 2000 saw the light of day. Years later in the era of Windows Vista and Windows 7, we got the Windows Advanced Firewall and that can do so much more than just block or allow a port, I think it’s a really cool piece of software. The combination of Windows Firewall, Kerberos and IPsec effectively gives you on-prem Conditional Access for east-west traffic. In this post I’ll tell you a bit of history, which problems my blog solves and why you want to start using it. And for the folks that see the word “IPsec”, trust me, I’ll make it easy to use, promise!

Let’s dive in!

Trust me bro, chain validation

April 12, 2026 / Michael Waterman / 0 Comments

Recently I was working on a side project involving Windows AppLocker, or whatever the marketing people decided to call the tool this week. Same engine, different sticker.