Prepare for Microsoft's Full Enforcement of Certificate-Based Authentication

What's the Fuss About?​

The Phases of Change: Patch Your Servers!​

• Compatibility Mode: This arrived with the May 10, 2022 Security Update. If authentication works but triggers warnings due to weak certificate mappings, your KDC is operating in this mode. Administrators need to painfully comb through event logs for any warning signs pointing to issues with certificate mappings.
• Weak mappings are still accepted (but logged with warnings).
• Strong mappings get the green light, no problem.
• Enforcement Mode (Defaulting February 2025):
• If a certificate cannot latch onto a strong mapping, authentication will be outright denied.
• You can return to Compatibility mode using the StrongCertificateBindingEnforcement registry key—until September 2025.
• Full Enforcement Mode (September 2025 Deadline):
• This is the raise-your-shields defense strategy. Weak mappings will no longer survive, registry key settings will no longer work, and it'll be strong mappings or bust from this date forward.

What Exactly is Strong Mapping?​

Weak (Insecure) Mappings:​

• X509IssuerSubject: Based on certificate issuer and subject names.
• X509SubjectOnly: Only considers the certificate’s subject.
• X509RFC822 (Email Address): Maps certificates based on email.
  These cannot be trusted because identifiers, like email addresses, are easy to duplicate or manipulate.

Strong (Secure) Mappings:​

• X509IssuerSerialNumber: Relies on the issuer and serial number of the certificate. Highly recommended.
• X509SKI: Leverages Subject Key Identifiers (SKI).
• X509SHA1PublicKey: Utilizes the SHA1 hash of the certificate’s public key. Another reliable option.

How to Prepare for Full Enforcement​

Step 1: Audit and Verify Your Configurations​

• Event ID 39: No strong mapping available. Replace or map certificates explicitly.
• Event ID 40: User certificates predate the associated account (uh-oh!).
• Event ID 41: SID mismatches between certificate and Active Directory.

Step 2: Map Certificates Correctly​

Set-ADUser 'UserAccount' -Replace @{
altSecurityIdentities = "X509:<I>DC=com,DC=contoso,CN=CONTOSO-CA<SR>12345678"
}

Step 3: Update Windows Servers​

• Windows Server 2016, 2019, 2022
• Legacy versions with Extended Security Updates (ESU), such as Server 2008 R2 and 2012 R2, also require configuration updates.

Big Registry Key Players​

1. Key Distribution Center (KDC) Registry Key​

• 1: Allows weak mapping as a fallback (Compatibility Mode).
• 2: Full Enforcement—only strong mappings are accepted.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Kdc

2. Certificate Backdating Compensation​

• Max Value = 50 years (0x5E0C89C0).

Anticipating Common Issues​

• Authentication Failure?
  Check Active Directory timestamps against certificates or verify the certificate Secure Identifier (SID) extension matches the user account SID.
• TLS Certificate Mapping:
  Post-enforcement, services like IIS rely on Kerberos S4U2Self requests for authentication. Monitor these on the corresponding application server logs, not just domain controllers.

Strong Mapping Default Changes​

What NOT to Do​

• Using Disabled Mode (removed in April 2023).
• Setting StrongCertificateBindingEnforcement to 0.
• Disabling SID extensions, as it impairs Kerberos protections.

Frequently Asked Questions​

• Do I need to renew all certificates?
• No, not unless you're switching to certificates containing the ObjectSID extension.
• What happens on February 11, 2025?
• Devices move automatically to Audit or Full Enforcement mode, depending on the registry key setup.

In Conclusion​