AD CS database schema

Using certutil we can query the schema of the Certification Authority database:

certutil -schema


If the AD CS role is not installed locally but on a remote computer the -config flag is required:

certutil -config <CAConfigString> -schema

The commands above return the column names (useful for any certutil database query using the -view flag), the column friendly name, the data type and the maximum length in bytes, including an "Indexed" comment on those indexed columns (useful for query design).
Querying the database schema is useful prior to preparing a CA database query, in order to understand the columns available in the database, their data types and whether they are indexed or not.
The CA database has 4 different tables, and certutil -schema returns by default the schema of the Request and Certificate table, but adding a parameter to the command will display the schema of the other 3 tables available:

Extension table - Ext

certutil -schema Ext


The extension table contains all the extensions of the certificates (and requests, even if certificates were not issued), where ExtensionRequestId matches the Request.RequestId column of the Request and Certificate table, but in the Extension table there are as many rows with the same ExtensionRequestId as extensions in the certificate with that Request.RequestId.
 
Attribute table - Attrib

certutil -schema Attrib


Similar to the Extensions table, the Attribute table contains all attributes (one per row) with the AttributeRequestId matching the Request.RequestId of a request.

CRL table - CRL

certutil -schema CRL


The CRL table contains the published CRLs and their information.

By default, a CA database query using certutil -view will display data from Certificate and Request, Extension and Attribute tables, linked by the Request.RequestId value. For example:

certutil -view -restrict "Request.RequestID=28354"

will display data from the Request and Certificate table where Request.RequestId=28354, data from the Extension table where ExtensionRequestId=28354 and data from the Attribute table where AttributeRequestId=28354. In order to get the data only from the Extension or Attribute tables that must be specified in the query and the correct column name must be used, e.g.:

certutil -view -restrict "ExtensionRequestId=28354" Ext

certutil -view -restrict "AttributerequestId=28354" Attrib

Comments

Popular posts from this blog

Decoding OCSP GET requests

Signing a CSR with an Enrollment Agent certificate

Compacting an AD CS database