Space for Claus Jespersen

Sometimes I find lots of failed requests on the Issuing CA servers that are related to problems with non-ASCII characters.

The error may be "The string contains a character not in the 7 bit ASCII character set".

Typically this error occurs if a certificate request contains a non-ASCII character in the subject name.

A certificate template can be set to "Common Name" or "Fully Distinquesed Name" in relation to the subject name attribute.
Common name supports Unicode, but a FQDN DNS name does not when used in a certificate, so overall, I recommend agains using non-ASCII characters in computer names or in subjects in general. In some contries (like Denmark) this may give problems if a computer name holds an non-ASCII international character. The easiest way is to rename the computer and issue a new certificate and potentially clean up the certificate database afterwards.

Also notice that if a full FQDN is placed in the CN (Common Name) field, the string can't be more than 64 characters long.

I often find that customers don't know the status of their PKI Infrastructure.

I would be nice to get an overview of issued certs from each CA as well as the number of failed requests and the number of revoked certificates.

Even though these statistics are not directly available from the CA GUI, they can be obtained from command line using the following commands:

To get issued certs from a CA, issue the following command on the CA server

certutil –template -v | find “Template=” > templatefil.txt

for /f “tokens=1,2 delims=[(,)]” %i in (templatefil.txt) do echo %i “ “ %j >> issuingcastat.txt && certutil –restrict “Certificate Template=%j,Disposition=20” –view –out serialnumber | find “Rows” >> issuingcastat.txt

for /f “tokens=1,2 delims=[(,)]” %i in (templatefil.txt) do echo %i “ “ %j >> issuingcastatrevoked.txt && certutil –restrict “Certificate Template=%j,Disposition=21” –view –out serialnumber | find “Rows” >> issuingcastatrevoked.txt

for /f “tokens=1,2 delims=[(,)]” %i in (templatefil.txt) do echo %i “ “ %j >> issuingcastatfailed.txt && certutil –restrict “Certificate Template=%j,Disposition=30” –view –out serialnumber | find “Rows” >> issuingcastatfailed.txt

for /f “tokens=1,2 delims=[(,)]” %i in (templatefil.txt) do echo %i “ “ %j >> issuingcastatdenied.txt && certutil –restrict “Certificate Template=%j,Disposition=31” –view –out serialnumber | find “Rows” >> issuingcastatdenied.txt

To see how many certificates that are in AD, you can make a script the walks through all users in AD and searches for certificates of given types.

To clean up certs in the db, you could use:

certutil -deleterow <date> request|cert|crl

Even though this command can remove entries from the db, you would need to run a utility to shrink the database afterwards.

jet compress utility can be used for this purpose

Eseutil.exe /d <db path>\<CAName>.edb /t

The db path can be found by issuing

certutil -databaselocations

Just a short note about Bitlocker in relation to certificates. I often meet customers who tend to believe that Bitlocker uses certificates from an Enterprise Microsoft CA to encrypt data. This is not the case. Bitlocker does not use certificates to encrypt data.