Tag: PKI (Page 3 of 3)

Building High-Available LDAPS Architectures

January 31, 2026 / Michael Waterman / 7 Comments

If you’re running Active Directory, like I said in a previous blog, that’s the majority of readers, you’re almost certainly using LDAPS, the secure version of LDAP. Not just because it’s “best practice,” but because plaintext LDAP over port 389 is a really bad idea, furthermore Microsoft has blocked access when you’re trying to connect to just LDAP on port 389 without any form of security.

While Microsoft has not removed the ability to use LDAP on port 389, recent security hardening features (such as LDAP channel binding and LDAP signing) can be configured to reject simple bind operations that are not signed or encrypted. In practice, many organizations today do not support clear-text LDAP unless it is secured (for example, via LDAPS). That’s why enabling LDAPS and proper security policies is highly recommended.

Unfortunately most environments treat LDAPS like a checkbox: “Yeah, we enabled LDAPS, installed a certificate, moved on.”

And that’s fine… until it isn’t. If your LDAP clients, VPN gateways, firewalls, RADIUS/NPS servers, Linux services, identity proxies, SaaS connectors, security appliances (the list goes on) depend on LDAPS, then what happens when the one Domain Controller you pointed them at suddenly goes offline?

PKI – Part 6: Demystifying the CAPolicy.inf file

May 18, 2025 / Michael Waterman / 2 Comments

Ever heard of the capolicy.inf file? It’s like a digital instruction manual for a Certificate Authority (CA) server. It pre-configures the CA and has a say in how certificates are set up or renewed. In other words, it’s a behind-the-scenes helper that ensures everything is governed with digital certificates. In this blog post, I’ll break down what this file does and why it matters in plain and simple terms.

PKI – Part 5: Creating Unique Object Identifiers (OIDs)

May 10, 2025 / Michael Waterman / 5 Comments

Introduction: Why OIDs matter in PKI

When building or managing a Public Key Infrastructure (PKI), precision and uniqueness are not optional, they’re very essential. Don’t be one of many, be your unique self! One key element that reflects this is the Object Identifier (OID). OIDs are globally unique values used to identify everything from certificate policies and application purposes to custom certificate extensions and cryptographic algorithms.

PKI – Part 4: Understanding Cryptographic Providers

October 13, 2023 / Michael Waterman / 4 Comments

Introduction

In the realm of Public Key Infrastructure (PKI), where the keys to digital security are exchanged, stored, and safeguarded, cryptographic providers play a pivotal role. These providers are the guardians of cryptographic keys, ensuring the integrity, confidentiality, and authenticity of digital communications. They are the invisible sentinels that underpin the very foundation of trust in the digital world.

PKI – Part 3: The role of hash functions in PKI

September 15, 2023 / Michael Waterman / 0 Comments

With Public Key Infrastructure (PKI), cryptographic hash functions play a pivotal, yet often understated role, operating ceaselessly to secure the integrity and authenticity of digital data as it navigates through contemporary communication networks. To appreciate fully the indispensable role they occupy in PKI, it is essential first to delineate the fundamental principles of hash functions and to understand why they are frequently analogized as the digital fingerprints within the cybersphere.

PKI – Part 2: Choosing the key length and algorithm

September 8, 2023 / Michael Waterman / 3 Comments

As I advance into the heart of PKI in this second installment, the focal point shifts towards two important decisions that anyone involved in setting up a PKI must deal with, choosing the appropriate key length and the cryptographic algorithm. These choices are far from arbitrary, for they are the foundation of a secure and efficient PKI. The selection at this stage will determine the resilience against cyber treats for the foreseeable future.

(updated on 05-05-2025)

PKI – Part 1: Introduction to Public Key Infrastructure

August 30, 2023 / Michael Waterman / 0 Comments

In the intricate realm of modern digital communication, trust and security form the bedrock upon which data integrity, confidentiality, and authentication rest. Public Key Infrastructure, commonly referred to as PKI, stands as an elegant solution to the complex challenge of establishing and maintaining this foundation of trust in a digital age.