Windows server

PKI

Fix the AD CS error where certificate templates aren't available for enrollment. Covers template publishing, permissions, version compatibility, and CA type issues with certutil commands.

PKI

Fix the Windows revocation check error that blocks certificate validation, smart card logon, code signing, and HTTPS. Covers CRL distribution point issues, OCSP failures, and certutil diagnostics.

PKI

Fix the 'RPC server is unavailable' error in Active Directory Certificate Services. Covers certificate enrollment failures, CA unreachable, auto-enrollment broken — with certutil, firewall, and DNS fixes.

SSL/TLS

Master IIS SSL certificate binding — import PFX certificates, configure SNI, manage wildcard certs, automate with PowerShell, and fix common binding issues including disappearing bindings, port conflicts, and certificate dropdown problems.

PKI

Design hybrid PKI architecture combining on-premises AD CS with Azure services. Covers Intune certificate connector, Azure AD App Proxy for NDES, Windows Hello for Business, Intune Cloud PKI, and Azure Key Vault integration.

PKI

Understand AD CS certificate templates — versions V1 through V4, subject name handling, key usage, enrollment permissions, auto-enrollment, and how to prevent ESC1-ESC8 privilege escalation attacks through proper template configuration.

PKI

Fix every common AD CS error — enrollment denied, template not available, RPC server unavailable, CRL failures, auto-enrollment not working, and certificate chain issues. Includes exact certutil commands and event log analysis.

PKI

Understand Microsoft's StrongCertificateBindingEnforcement changes (KB5014754) — what strong certificate mapping means, the enforcement timeline, how to prepare, and how to fix authentication failures after September 2025.

PKI

Design and deploy Microsoft Active Directory Certificate Services (AD CS) with proper hierarchy, role separation, template strategy, CRL distribution, and high availability. Covers 2-tier and 3-tier architectures for enterprise environments.

PKI

Configure Microsoft NDES (Network Device Enrollment Service) for SCEP certificate enrollment. Covers IIS setup, certificate templates, registration authority, challenge passwords, and fixes for every common NDES error.