Re-signing a certificate from a different CA with certutil

The certutil -sign verb allows, according to the documentation, to re-sign a certificate, but I was wondering whether "re-sign" includes signing a certificate that has previously been signed by another Certification Authority.
The use case I had in mind was accepting self-signed certificates as a form of certificate signing requests. There are a number of software products out there that, out of the box, provide the ability to generate a self-signed certificate to be used for testing or for the initial setup before a certificate signed by a CA is configured. So I wanted to test whether those self-signed certificates (assuming they are securely generated during installation and not simply included with the software) could be used as a request to a CA.
The idea would then be to get a self-signed certificate and try to sign it with an AD CS Certification Authority using certutil -sign. For testing purposes I exported one of the trusted Root CAs in the system (a self-signed certificate) and tried to run:

certutil -sign RootCA.cer RootCAReSign.cer now+1:00

But what I got is:







"No certificate available" - "No certificates meet the application criteria"

I then tried to re-sign a certificate previously signed by that same CA, to make sure the CA and the command were correct, and it worked. So it looks like the "re-sign" capability in certutil -sign really refers to signing again by the same CA.

Not clear what the application criteria for certificate matching is, though. I have tested two different scenarios:
- With a CA where the CA certificate was renewed after expiration using the same DN for the CA and a new private key, and the certutil command would only show me as option the CA that originally signed the certificate
- With a CA where the CA certificate was renewed after expiration using the same DN for the CA and the same private key, and the certutil command allows me to sign with either CA and even if I choose the expired CA certificate the output (re-signed certificate) is not constrained by that expiration.
The above makes me think that certificate matching is performed based on the Issuer DN (since that will remain the same in the new re-signed certificate) and the Authority Key Identifier.

Comments

Post a Comment

Popular posts from this blog

Decoding OCSP GET requests

Many clients default to OCSP requests via HTTP GET, encoding the request details as part of the URL. These kind of requests can be found in the logs: http://ocsp.ekaitza.net/ocsp/MFQwUjBQME4wTDAJBgUrDgMCGgUABBQ1uvBCJo3G3TPBvK%2BGVqszOaLAawQUb38ZjesMwNeYLEzdGvP%2FZi9TlkACE3cAEdYaIhMmuymSdxoAAAAR1ho%3D As per RFC 6960 , the request is constructed as: GET {url}/{url-encoding of base-64 encoding of the DER encoding of the OCSPRequest} So in order to find out the details of the request we have to: 1. Remove the URL encoding This can be done with different tools, depending on the OS/platform being used.Given the input above: MFQwUjBQME4wTDAJBgUrDgMCGgUABBQ1uvBCJo3G3TPBvK%2BGVqszOaLAawQUb38ZjesMwNeYLEzdGvP%2FZi9TlkACE3cAEdYaIhMmuymSdxoAAAAR1ho%3D the output would be: MFQwUjBQME4wTDAJBgUrDgMCGgUABBQ1uvBCJo3G3TPBvK+GVqszOaLAawQUb38ZjesMwNeYLEzdGvP/Zi9TlkACE3cAEdYaIhMmuymSdxoAAAAR1ho= We can then create a text file with it, e.g.:  $ echo "MFQwUjBQME4wTDAJBgUrDgMCGgUABBQ1uvBCJo3G3TPBvK+GVqsz...
Read more

Signing a CSR with an Enrollment Agent certificate

Image
Often certificate templates in AD CS are configured to require a set of authorised signatures for issuance: This is useful e.g. when issuance approval is delegated to a component outside of AD CS roles, such as some CA management or registration authority portal software. Combined with the template security settings this can prevent requests from being raised directly from the CA without going through a custom standard request process, and depending on the level of security required, multiple signatures can be enforced and optionally also additional CA certificate manager approval. In order to produce each of this signatures an "Enrollment Agent" certificate is used, a certificate with the "Certificate Request Agent (1.3.6.1.4.1.311.20.2.1)"  Enhanced Key Usage. Sometimes it is required to raise requests directly towards the CA, e.g. using the RPC/DCOM interface from the command line, but it is not desirable and/or possible to change the template configuration, so t...
Read more

Compacting an AD CS database

Given the healthy trend towards decreasing certificate validity periods, it is very likely that the size of an AD CS Certification Authority database will grow following that same trend. Despite regular maintenance activities including deletion of records such as failed, denied etc. it could be that at some point the CA database reaches a problematic size. Deleting records from an AD CS CA database will internally free up the space previously occupied by those records but will not decrease the size of the database file itself. I.e. new records will reuse the freed up space but the total space used by the database file will not decrease. This helps keeping the database size under control but does not help if the size had already increased over acceptable limits; in this case the database must be compacted. The CA is often a critical resource, so it is recommended to keep various backups of different nature, to try to make sure we can recover it in case something goes wrong. Here a ...
Read more