While configuring a new Microsoft Active Directory Certificate Services (AD CS) environment on Windows Server 2025 in Azure, I ran into an unexpected problem while configuring certificate templates. The Certification Authority (CA) itself was working correctly and was configured to use the “Legacy Cryptographic Service Provider“. Cryptography API: Next Generation (CNG) was also functioning normally, and certificate templates could be created using the default settings and succesfully create certificates. But…
Continue readingMonth: July 2026
One of the questions I get asked most often during assignments or workshops isn’t really about Certificate Revocation Lists (CRLs), OCSP, certificate templates or PKI in general. It’s much simpler than that.
“What’s a certificate anyway?”
Well actually, I sometimes start with the question, “So, can anyone explain to me what a certificate is or what it represents?”. You would think, it seems like an easy question to answer. Some people will tell you it’s your public key. Others will say it’s your digital identity. While both answers contain some truth, rarely the complete story is told. A digital certificate is much more than a single piece of information. It contains an identity, a public key, validity information, a collection of extensions, and much more. More importantly, all of that information is cryptographically protected by a trusted Certificate Authority (CA).
In other words, a certificate is a digitally signed document that binds an identity to a public key, with a couple of extensions. That digital signature allows anyone who trusts the issuing CA to verify that the certificate has not been modified and that the binding between the identity and the public key is authentic. But what exactly is inside a certificate? What does a Certificate Authority actually sign? And why does changing just a single character invalidate the entire certificate?
Let’s take a look under the hood of an X.509 certificate.
Continue reading
“But Mike… there is no FUD in Post-Quantum Cryptography.”
I’m glad you brought that up, because that’s exactly what this post is about.
When people hear the term Post-Quantum Cryptography (PQC), the conversation often goes in one of two directions. Some claim that quantum computers are still decades away and that there’s nothing to worry about. Others make it sound as if RSA will stop working sometime next Tuesday, neither view tells the whole story. The reality is far more interesting, and far more nuanced than many have you believe, Post-Quantum Cryptography isn’t about fear, uncertainty, or doubt. It’s about understanding the actual risks, separating scientific facts from headlines, and making informed architectural decisions based on evidence rather than speculation.
So, let’s take the FUD out of the discussion. In this blog, we’ll look at what current research actually tells us about quantum computers, why symmetric encryption such as AES is in a very different position than RSA and ECC, who is realistically capable of building a cryptographically relevant quantum computer, and why organizations should begin preparing today, even though the first machine capable of breaking modern public key cryptography is unlikely to appear in your local datacenter anytime soon. Because the real challenge isn’t that quantum computers are coming. The real challenge is making sure your organization is ready when they do.
Continue reading