Ramblings on IT and Security
Feedback on my earlier IIS caching article challenged an assumption I made: does a CRL’s own validity and publication fields ensure timely retrieval, regardless of HTTP caching? I built a lab to experiment with publication, download, storage and validation. Spoiler: My findings show that HTTP cache headers influence Edge’s CRL reuse, read more on how I got to this conclusion below.
Continue readingSo, this turned out to be an interesting quest. I had reinstalled my lab Enterprise (issuing) CA, configured the server, issued new CA certificates, and created a new Remote Desktop certificate template. The next step should have been simple: publish the template.
Except it wasn’t. When I tried to publish the template, it didn’t show up.
Continue readingI know, I know, last time I promised that this blog post would be about renewing the issuing CA certificate, but I have something cool today as well. I ran into an issue with my lab CA that made me dive into a rabbit hole filled with advanced certutil commands and direct access to the database. Instead of treating this as an incident and forget all the commands I’ve used to view and alter information I thought I would share the information.
When working with Active Directory Certificate Services (AD CS), most people interact with the Certification Authority through the MMC console. It provides a clear view of issued certificates, pending requests, and revoked certificates. It’s the easiest way. However, behind that interface sits a database that’s per default located in the directory: “C:\WINDOWS\system32\CertLog” and has the name of your CA, in my case “Corp-Enterprise-CA.edb“.
A couple of days ago I had to deal with a situation where our vulnerability tool was complaining that the root certificate store wasn’t updated for a while. This process runs every 7 days, so it takes some time before you will notice any error messages, as was in my case. After doing some research it turned out that the update service for the Microsoft root certificate program was blocked. That in turn triggered me to dig into the more technical side of the Microsoft Root certificate program.
Continue reading© 2026 Michael Waterman
Theme by Anders Noren — Up ↑