ISIS-MTT is a new German standard for Public Key Infrastructure (PKI) interoperability. ISIS-MTT defines data formats and communication protocols to be employed in interoperable PKI-based applications. The standard focuses on security services for authentication. These services include user identification and data integrity, confidentiality, and non-repudiation. The standard was developed by the German government together with banking, industrial, and academic interests.
To make the Windows certification authority (CA) compliant with ISIS-MTT version 1.1, you must complete specific configuration steps. This step-by-step article describes how to enroll certificates that comply with the ISIS-MTT requirements for a stand-alone CA.Note
Your CA must be a server that is running Microsoft Windows Server 2003 Service Pack 1 (SP1), an x64-based version of Windows Server 2003, or a later version of Windows.Important
The configuration changes that are documented in this article must be applied to the CA that enrolls the certificate. In a PKI topology, this is the parent CA of the certificate requester. If a CA certificate is requested from a subordinate CA, the type of CA that requests the certificate is not relevant.
Use the step-by-step directions in this article if the following conditions are true:
- The issuing CA issues ISIS-MTT-compliant certificates to subordinate CAs or to end-entities.
- The issuing CA takes one of the following roles:
- Stand-alone root CA
- Stand-alone subordinate CA
To configure the issuing CA correctly, use the following methods:
back to the topEnforce UTF8 encoding
- Configure the issuing CA to force UTF8 encoding.
- Mark the key usage attribute as critical during certificate submission processing.
- For CA certificates, omit the digital signature entry in the key usage section.
After you configure a CA to force UTF8 encoding, the UTF8 setting applies to all certificates that are issued with this CA. At the CA that must issue ISIS-MTT-compliant certificates, follow these steps:
- Click Start, click Run, type cmd, and then click OK.
- Type the following, and then press ENTER:
certutil -setreg ca\forceteletex +0x20This command sets the flag so that the CA always encodes the subject with UTF8.
- To stop and then restart the CA service, type the following at a command prompt. Press ENTER after each command.
net stop "certificate services"
net start "certificate services"
To undo this change, follow these steps:
- Type the following at a command prompt, and then press ENTER:
certutil -setreg ca\forceteletex -0x20
- To stop and then restart the CA service, type the following commands. Press ENTER after each command.
net stop "certificate services"
net start "certificate services"
Versions of Windows that are earlier than Windows Server 2003 SP1 cannot interpret the "0x20" bit and will ignore it.back to the topSubmit the certificate request
Because stand-alone CAs do not support certificate templates, the key properties must be set during certificate request processing. To do this, follow these steps:
- On the issuing CA, click Start, point to Administrative Tools, and then click Certification Authority.
- Right-click your certificate, and then click Properties.
- Click the Policy Module tab, and then click Properties.
- Click Set the certificate request status to pending. The administrator must explicitly issue the certificate, and then click OK.
- Create a certificate request file to use with the subordinate CA or with the end-entity.
- On the subordinate CA or end-entity, submit the certificate request to the stand-alone CA. To do this, use one of the following methods.
Method 1: Submit the CA by using a Web interface For information about how to submit the CA by using a Web interface, visit the following Microsoft Web site, and then see "To request a certificate from a Windows Server 2003 CA using a PKCS #10 or PKCS #7 file":
Method 2: Submit the CA by using the Certreq command
- At a command prompt, type certreq -submit Path_To_Request_File\Certificate_Request_Filename, and then click OK.
- In the Select a certification authority (CA) you want to use list, click the certificate request file from your issuing CA, and then click OK.
- Note the certificate Request-ID that is returned.
To change the key usage and to mark it as critical, see the "Change the key usage, and then mark it as critical" section. To leave the default key usage, but to mark the key usage as critical, see the “Leave the default key usage, but mark it as critical” section.Note
The ISIS-MTT standard requires that the name of a CA contain the following distinguished name attributes:
- countryName (c)
- organizationName (o)
The requesting CA must choose an appropriate name for the CA.back to the topChange the key usage, and then mark it as critical
By default, the setting for key usage of CA certificates in Windows is different from the setting for key usage of CA certificates in ISIS-MTT. A CA certificate that is compliant with ISIS-MTT carries the following key usage:
Certificate Signing, Off-line CRL Signing, CRL Signing
To apply this key usage if a CA certificate is requested, type the following at a command prompt, and then press ENTER:
echo 03 02 01 06>File_Name.txt
For an explanation of the hexadecimal numbers that are used in this command, see the “Interpret key usage” section.
To modify the pending CA certificate request to set the key usage and to mark it as critical, type the following at a command prompt, and then press ENTER:
certutil -setextension Request_ID_Noted_ In_Step_7_Of_The_Submit_The_Certificate_Request_Section 126.96.36.199 1 @File_Name.txtback to the topLeave the default key usage, but mark it as critical
Use this method only if the key usage was not changed and must be set to critical.
To do this, type the following at a command prompt, and the press ENTER:
certutil -setextension Request_ID_Noted_ In_Step_7_Of_The_Submit_The_Certificate_Request_Section 188.8.131.52 1
For an explanation of the hexadecimal numbers that are used in this command, see the “Interpret key usage” section.back to the topIssue and verify the certificate
back to the topInterpret key usage
- Issue the pending request.
- To verify that the certificate was created correctly, type the following command at a command prompt, and then press ENTER:
certutil -v Path_Of_File/Certificate_File
- View the file output to make sure that the common name is formatted as CERT_RDN_UTF8_STRING.
- Make sure that the key usage is set correctly.
- Make sure that the Critical flag is set for the key usage object identifier 184.108.40.206.
The key usage is represented as a bit string. The first byte is the encoding of the bit string type. This is static 03. The second bit defines the length of the value and is set to 02. The following bits represent the actual value of the bit string where 01 is fixed. The key usage values are defined in the Wincrypt.h include file as follows:
#define CERT_DIGITAL_SIGNATURE_KEY_USAGE 0x80
#define CERT_NON_REPUDIATION_KEY_USAGE 0x40
#define CERT_KEY_ENCIPHERMENT_KEY_USAGE 0x20
#define CERT_DATA_ENCIPHERMENT_KEY_USAGE 0x10
#define CERT_KEY_AGREEMENT_KEY_USAGE 0x08
#define CERT_KEY_CERT_SIGN_KEY_USAGE 0x04
#define CERT_OFFLINE_CRL_SIGN_KEY_USAGE 0x02
#define CERT_CRL_SIGN_KEY_USAGE 0x02
#define CERT_ENCIPHER_ONLY_KEY_USAGE 0x01
For example, the value 03 02 01 86 sets the following key usages with a logical OR
If you want Certificate Revocation List (CRL) signing and certificate signing only, the hexadecimal value must be 03 02 01 06.back to the top