0

Is it possible to make a Windows Server Certificate Authority accept a PKCS10 certificate request that is unsigned? I get the following error Error Verifying Request Signature or Signing Certificate The request is not supported. 0x80070032 (WIN32: 50 ERROR_NOT_SUPPORTED). I would like for the CA to skip the signature check and just accept the request.

Improve this question

1 Answer 1

Reset to default
0

No, Microsoft ADCS does not support requests without a single trusted signature. That is, the request must be signed directly (signature is created by requester) or by external signers. In this case, a PKCS#10 request must be embedded in PKCS#7/CMC request and signed with authorized signing certificate.

With CertEnroll you can utilize IX509CertificateRequestCmc COM interface:

  1. load existing unsigned request to IX509CertificateRequestPkcs10 interface
  2. load PKCS10 request to IX509CertificateRequestCmc interface by using InitializeFromInnerRequestTemplateName method
  3. use IX509CertificateRequestCmc::SignerCertificates to provide external signer information (certificate)
  4. load CMC request into IX509Enrollment interface
  5. call IX509Enrollment::CreateRequest to sign and create signed request.

By the end, you will get a signed CMC request with embedded unsigned PKCS#10 request and which you can submit to CA server.

Improve this answer
11
  • Thank you for the detailed explanation. By "authorised signing certificate" do you mean the certificate of an entity that is trusted by the CA (say, a RA/sub-CA)?
    – Ivan Stanev
    May 21, 2018 at 7:48
  • Signer is entity who owns signing certificate which is suitable for external request signing. Signing certificate must be trusted by CA and signer entity is eligible to request certificates against a template specified in the InitializeFromInnerRequestTemplateName method call.
    – Crypt32
    May 21, 2018 at 8:03
  • I tried to follow your guide, but I keep on getting the error "Error Verifying Request Signature or Signing Certificate The request is not supported. 0x80070032 (WIN32: 50 ERROR_NOT_SUPPORTED)". If you could point me in the right direction as to what is going on it would be much appreciated! Here's the code I used (.NET): pastebin.com/uhHeARgC
    – Ivan Stanev
    May 21, 2018 at 15:16
  • Can you post the outpur of the following command: certutil -dump path\reqfile.req?
    – Crypt32
    May 21, 2018 at 15:32
  • Here is the dump: pastebin.com/S9Z4GX8a I actually got a different error by trying a different approach with the code: "Error Verifying Request Signature or Signing Certificate The certificate is not valid for the requested usage. 0x800b0110 (-2146762480 CERT_E_WRONG_USAGE)". The code that generated this error is here: pastebin.com/BTVugNHV
    – Ivan Stanev
    May 21, 2018 at 15:55

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .