TameMyCerts

https://docs.tamemycerts.com/
Admin
TameMyCerts is a policy module for Microsoft Active Directory Certificate Services that enables...
Tokens:36,854
Snippets:330
Trust Score:4.6
Update:1 week ago
Show doc for...
Tokens:
Raw
### Install TameMyCerts with policy directory

Source: https://docs.tamemycerts.com/

Run install.ps1 as local Administrator, specifying the local path for XML configuration files. The script registers the module, creates registry values, and configures the policy module as active. The certification authority service is restarted during installation.

```powershell
.\install.ps1 -PolicyDirectory C:\PolicyFiles
```

--------------------------------

### Set certsvc to delayed-auto start

Source: https://docs.tamemycerts.com/

Use this command to set the Certification Authority service to 'Automatic (Delayed Start)' to circumvent the boot-time startup failure caused by the .NET Runtime not being available.

```powershell
sc.exe config certsvc start=delayed-auto
```

--------------------------------

### Unblock downloaded files

Source: https://docs.tamemycerts.com/

Run this PowerShell command in the directory where the TameMyCerts files were unzipped to remove the Mark of the Web so the installer script can be executed.

```powershell
Get-ChildItem -Path * -Recurse | Unblock-File
```

--------------------------------

### NotAfter configuration example for fixed expiration date

Source: https://docs.tamemycerts.com/

This example sets all certificates to expire on Dec 31, 2022 23:59:59 Europe/Berlin (UTC+1) time. After that date has passed, all certificate requests for this template get denied.

```xml
<NotAfter>2022-12-31T23:59:59.0000000+01:00</NotAfter>
```

--------------------------------

### Directory object rule configuration example

Source: https://docs.tamemycerts.com/

XML configuration for a directory object rule that evaluates the 'description' attribute, requires it to be present, and denies requests if the value matches the regex '^Admin$'.

```xml
<DirectoryServicesMapping>
  <!-- other directives have been removed for this example -->
  <DirectoryObjectRules>
    <DirectoryObjectRule>
      <DirectoryServicesAttribute>description</DirectoryServicesAttribute>
      <Mandatory>true</Mandatory>
      <Patterns>
        <Pattern>
          <Expression>^Admin$</Expression>
          <TreatAs>RegEx</TreatAs>
          <Action>Deny</Action>
        </Pattern>
      </Patterns>
    </DirectoryObjectRule>
  </DirectoryObjectRules>
</DirectoryServicesMapping>
```

--------------------------------

### Example policy restricting commonName to 'Hello World'

Source: https://docs.tamemycerts.com/

A basic policy that requires the commonName field to match the pattern '^Hello World$'. All other requests are denied. This applies to offline certificate templates.

```XML
<CertificateRequestPolicy xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema">
  <Subject>
    <SubjectRule>
      <Field>commonName</Field>
      <Mandatory>true</Mandatory>
      <Patterns>
        <Pattern>
          <Expression>^Hello World$</Expression>
        </Pattern>
      </Patterns>
    </SubjectRule>
  </Subject>
</CertificateRequestPolicy>
```

--------------------------------

### Submit certificate request with StartDate and ExpirationDate

Source: https://docs.tamemycerts.com/

Example certreq command that requests a certificate valid from Mar 1, 2022 08:00 to Mar 1, 2022 16:00. Uses the StartDate and ExpirationDate attributes in RFC 2616 format.

```bash
certreq.exe -config "caserver.tamemycerts.local\TameMyCerts CA" -attrib "CertificateTemplate:TameMyCertsWebServer\nStartDate:Tue, 1 Mar 2022 08:00:00 GMT\nExpirationDate:Tue, 1 Mar 2022 16:00:00 GMT" -submit "MyCertificateRequest.req"
```

--------------------------------

### Basic CertificateRequestPolicy XML template

Source: https://docs.tamemycerts.com/

Starts every policy configuration file. The root element is CertificateRequestPolicy with XML schema namespaces. Directives are placed inside the root element.

```XML
<CertificateRequestPolicy xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema">
  <!-- Directives go here -->
</CertificateRequestPolicy>
```

--------------------------------

### Configure OCSP URIs per template

Source: https://docs.tamemycerts.com/

Use the OnlineCertificateStatusProtocol directive to issue Online Certificate Status Protocol URIs on a per-template basis. The example shows a single OCSP URI.

```xml
<OnlineCertificateStatusProtocol>
  <string>http://ocsp.tamemycerts.com/ocsp</string>
</OnlineCertificateStatusProtocol>
```

--------------------------------

### Suppress unqualified names with SupplementUnqualifiedNames

Source: https://docs.tamemycerts.com/

Shows the configuration to suppress supplementation of unqualified DNS names (e.g. 'host') by setting SupplementUnqualifiedNames to false. The example includes the DirectoryServicesMapping block with SupplementServicePrincipalNames enabled.

```xml
<DirectoryServicesMapping>
  <!-- other directives have been left out for simplicity -->
  <SupplementServicePrincipalNames>true</SupplementServicePrincipalNames>
</DirectoryServicesMapping>
<SupplementUnqualifiedNames>false</SupplementUnqualifiedNames>
```

--------------------------------

### Create Certificate Signing Request with yubico-piv-tool

Source: https://docs.tamemycerts.com/

Creates a Certificate Signing Request using the public key from pubkey.key and saves it to request.csr. Uses the attestation action and verifies the PIN.

```bash
yubico-piv-tool --slot=9a --subject="/CN=this-is-a-test/" --input=pubkey.key --attestation --output=request.csr --action=verify-pin --action=request
```

--------------------------------

### Transfer first SAN dNSName to commonName

Source: https://docs.tamemycerts.com/

Transfers the first dNSName from the Subject Alternative Name (SAN) into the commonName field. This example does not require DirectoryServicesMapping.

```xml
<!-- does not require DirectoryServicesMapping -->
<OutboundSubject>
  <OutboundSubjectRule>
    <Field>commonName</Field>
    <Value>{san:dNSName}</Value>
    <Mandatory>true</Mandatory>
    <Force>true</Force>
  </OutboundSubjectRule>
</OutboundSubject>
```

--------------------------------

### Generate key pair with yubico-piv-tool

Source: https://docs.tamemycerts.com/

Creates a key pair on the YubiKey PIV slot 9a and saves the public key to pubkey.key. Uses ECCP384 algorithm with pin-policy once and touch-policy cached.

```bash
yubico-piv-tool --slot=9a --action=generate --pin-policy=once --touch-policy=cached --algorithm=ECCP384 --output=pubkey.key
```

--------------------------------

### Create YKROOT and YKCA certificate stores

Source: https://docs.tamemycerts.com/

Creates the YKROOT and YKCA certificate stores under the LocalMachine store on the certification authority server. Required for the attestation certificate chain to be built.

```powershell
Set-Location -Path Cert:\LocalMachine
New-Item -Name YKROOT
New-Item -Name YKCA
```

--------------------------------

### New syntax for Patterns (version 1.1)

Source: https://docs.tamemycerts.com/

Shows the XML configuration for SubjectRule using Patterns with Pattern elements and Action directives as used in TameMyCerts version 1.1 and newer. This replaces the old AllowedPatterns and DisallowedPatterns syntax.

```xml
<SubjectRule>
  <Field>commonName</Field>
  <Patterns>
    <Pattern>
      <Expression>^[-_a-zA-Z0-9]*\.tamemycerts\.com$</Expression>
    </Pattern>
    <Pattern>
      <Expression>^.*(porn|gambling).*$</Expression>
      <Action>Deny</Action>
    </Pattern>
  </Patterns>
</SubjectRule>
```

--------------------------------

### Uninstall TameMyCerts

Source: https://docs.tamemycerts.com/

Run install.ps1 as Administrator with the -Uninstall parameter. The script unregisters the module, copies registry settings back, and configures the Windows Default policy module as active. The certification authority service is restarted during uninstallation.

```powershell
.\install.ps1 -Uninstall
```

--------------------------------

### Configure AIA URIs per template

Source: https://docs.tamemycerts.com/

Use the AuthorityInformationAccess directive to issue Authority Information Access URIs on a per-template basis. The example uses token variables like %1, %3, %4, %7, %6, %11.

```xml
<AuthorityInformationAccess>
  <string>http://%1/CertData/%3%4.crt</string>
  <string>ldap:///CN=%7,CN=AIA,CN=Public Key Services,CN=Services,%6%11</string>
</AuthorityInformationAccess>
```

--------------------------------

### Configure CDP URIs per template

Source: https://docs.tamemycerts.com/

Use the CrlDistributionPoints directive to issue Certificate Revocation List Distribution Point URIs on a per-template basis. The example uses token variables like %1, %3, %8, %9, %6, %10.

```xml
<CrlDistributionPoints>
  <string>http://%1/CertData/%3%8%9.crl</string>
  <string>ldap:///CN=%7%8,CN=%3,CN=cdp,CN=Public Key Services,CN=Services,%6%10</string>
</CrlDistributionPoints>
```

--------------------------------

### Enable DirectoryServicesMapping with defaults for user objects (offline template)

Source: https://docs.tamemycerts.com/

Enables the mapping with default values for user objects in an offline template. The empty element uses all default settings.

```xml
<DirectoryServicesMapping />
```

--------------------------------

### Append static string to commonName from name attribute

Source: https://docs.tamemycerts.com/

Builds the commonName from the Active Directory name attribute and appends a static string. For example, if name is "John Doe", the commonName becomes "John Doe is an awesome fellow!".

```xml
<DirectoryServicesMapping />
<OutboundSubject>
  <OutboundSubjectRule>
    <Field>commonName</Field>
    <Value>{ad:name} is an awesome fellow!</Value>
    <Mandatory>true</Mandatory>
    <Force>true</Force>
  </OutboundSubjectRule>
</OutboundSubject>
```

--------------------------------

### Enable DirectoryServicesMapping with defaults for computer objects (offline template)

Source: https://docs.tamemycerts.com/

Enables the mapping with default values for computer objects in an offline template. The element contains child directives to specify the certificate attribute, directory services attribute, and object category.

```xml
<DirectoryServicesMapping>
  <CertificateAttribute>dNSName</CertificateAttribute>
  <DirectoryServicesAttribute>dNSHostName</DirectoryServicesAttribute>
  <ObjectCategory>computer</ObjectCategory>
</DirectoryServicesMapping>
```

--------------------------------

### Enable certificate template auto-enrollment via registry (PowerShell)

Source: https://docs.tamemycerts.com/

Creates the AutoEnrollment registry key and sets the AEPolicy value to 0x1 to enable the certificate AutoEnrollment Process, which is required for TameMyCerts to recognize certificate templates.

```powershell
New-Item -Path HKLM:\Software\Policies\Microsoft\Cryptography\AutoEnrollment
Set-ItemProperty -Path HKLM:\Software\Policies\Microsoft\Cryptography\AutoEnrollment -Name AEPolicy -Value 0x1 -Force
```

--------------------------------

### Build commonName from sn and givenName

Source: https://docs.tamemycerts.com/

Builds the commonName from the Active Directory attributes sn (surname) and givenName, formatted as "surname, givenName". For example, givenName "John" and surname "Doe" produce commonName "Doe, John".

```xml
<DirectoryServicesMapping />
<OutboundSubject>
  <OutboundSubjectRule>
    <Field>commonName</Field>
    <Value>{ad:sn}, {ad:givenName}</Value>
    <Mandatory>true</Mandatory>
    <Force>true</Force>
  </OutboundSubjectRule>
</OutboundSubject>
```

--------------------------------

### Import YubiKey attestation Root CA certificates into YKROOT store

Source: https://docs.tamemycerts.com/

Imports all .cer files in the current directory into the YKROOT certificate store using certutil. Used for YubiKey attestation Root CA certificates.

```powershell
Get-ChildItem -Path *.cer | ForEach-Object -Process { certutil -addstore YKROOT $_.FullName }
```

--------------------------------

### Allow only Autoenrollment with AllowedProcesses

Source: https://docs.tamemycerts.com/

This configuration restricts certificate enrollment to only the Windows Autoenrollment process (taskhostw.exe). All other processes will be denied.

```xml
<AllowedProcesses>
  <string>taskhostw.exe</string>
</AllowedProcesses>
```

--------------------------------

### Accept commonName and dNSName with DNS supplementation

Source: https://docs.tamemycerts.com/

Full configuration that accepts certificate requests with a mandatory commonName and optional dNSName within the tamemycerts.com domain. If no dNSName SAN is present, the commonName value is used to create a SAN extension.

```XML
<Subject>
  <SubjectRule>
    <Field>commonName</Field>
    <Mandatory>true</Mandatory>
    <Patterns>
      <Pattern>
        <Expression>^[-_a-zA-Z0-9]*\.tamemycerts\.com$</Expression>
      </Pattern>
    </Patterns>
  </SubjectRule>
</Subject>
<SubjectAlternativeName>
  <SubjectRule>
    <Field>dNSName</Field>
    <Mandatory>false</Mandatory>
    <Patterns>
      <Pattern>
        <Expression>^[-_a-zA-Z0-9]*\.tamemycerts\.com$</Expression>
      </Pattern>
    </Patterns>
  </SubjectRule>
</SubjectAlternativeName>
<SupplementDnsNames>true</SupplementDnsNames>
```

--------------------------------

### Inspect a certificate request with certutil -dump

Source: https://docs.tamemycerts.com/

Use this command to dump a certificate request file and inspect its contents, including the process name used to create the request. Replace <request-file-name> with the actual file name.

```bash
certutil -dump <request-file-name>
```

--------------------------------

### Event ID 2 Sample Message

Source: https://docs.tamemycerts.com/

Sample log message for Event ID 2, an error event indicating failure to initialize the Windows Default policy module. Placeholder {0} contains the error message.

```text
Error initializing Windows Default policy module:
{0}
```

--------------------------------

### Event ID 1 Sample Message

Source: https://docs.tamemycerts.com/

Sample log message for Event ID 1, an information event indicating the policy module is ready. Placeholder {0} is replaced with the policy module name and version.

```text
{0} policy module version {1} is ready to process incoming certificate requests.
```

--------------------------------

### Old syntax for AllowedPatterns and DisallowedPatterns (version 1.0)

Source: https://docs.tamemycerts.com/

Shows the XML configuration for SubjectRule using AllowedPatterns and DisallowedPatterns as used in TameMyCerts version 1.0. This syntax is replaced in version 1.1.

```xml
<SubjectRule>
  <Field>commonName</Field>
  <AllowedPatterns>
    <string>^[-_a-zA-Z0-9]*\.tamemycerts\.com$</string>
  </AllowedPatterns>
  <DisallowedPatterns>
    <string>^.*(porn|gambling).*$</string>
  </DisallowedPatterns>
</SubjectRule>
```

--------------------------------

### PermitEmptyIdentites directive

Source: https://docs.tamemycerts.com/

Set to true to allow certificate requests that would result in certificates without an identity. By default, TameMyCerts denies such requests and logs an event.

```XML
<PermitEmptyIdentites>true</PermitEmptyIdentites>
```

--------------------------------

### Set CA LogLevel and Restart Service

Source: https://docs.tamemycerts.com/

Commands to set the certification authority's LogLevel registry value and restart the certsvc service to apply the change. The {LogLevel} placeholder should be replaced with a numeric value from the table (e.g., 4 for CERTLOG_VERBOSE).

```bash
certutil -setreg CA\Loglevel {LogLevel}
net stop certsvc
net start certsvc
```

--------------------------------

### Enable SupplementDnsNames directive

Source: https://docs.tamemycerts.com/

Enables the feature to supplement DNS names from the commonName into the SAN extension. This is a minimal configuration.

```XML
<SupplementDnsNames>true</SupplementDnsNames>
```

--------------------------------

### Enable TMC_DENY_IF_NO_POLICY flag with certutil

Source: https://docs.tamemycerts.com/

Use this command in an elevated command prompt to enable the TMC_DENY_IF_NO_POLICY flag (0x1). Adjust the flag value as needed.

```plaintext
certutil -setreg Policy\TmcFlags +0x1
```

--------------------------------

### Old syntax for Subject DN mapping (version 1.5 and lower)

Source: https://docs.tamemycerts.com/

Shows the XML configuration for modifying the Subject Distinguished Name using the DirectoryServicesMapping element, as used in TameMyCerts version 1.5 and lower. This syntax is replaced in version 1.6.

```xml
<DirectoryServicesMapping>
  <!-- other directives have been left out for simplicity -->
  <SubjectDistinguishedName>
    <RelativeDistinguishedName>
      <Field>emailAddress</Field>
      <DirectoryServicesAttribute>mail</DirectoryServicesAttribute>
      <Mandatory>true</Mandatory>
    </RelativeDistinguishedName>
  </SubjectDistinguishedName>
</DirectoryServicesMapping>
```

--------------------------------

### Import YubiKey intermediate CA certificates into YKCA store

Source: https://docs.tamemycerts.com/

Imports all .cer files in the current directory into the YKCA certificate store using certutil. Applies to YubiKeys with Firmware 5.7.4 or newer.

```powershell
Get-ChildItem -Path *.cer | ForEach-Object -Process { certutil -addstore YKCA $_.FullName }
```
Tokens:
Raw