AD FS 3.0 and CNG Certificates

Question

Microsoft announced that they will be deprecating publically signed SHA1 (non-CNG) certificates on January 1st, 2017 yet are specifically requiring publicly signed non-CNG certificates for use
with an AD FS 3.0 (2012 R2) configuration. Does anyone know why Microsoft is doing that? Will AD FS be updated before that date to allow for CNG certificates or will we be up a creek when we go to try to renew an AD FS SHA1 certificate if it expires after
January 1st, 2017?
Microsoft Announcement:
http://blogs.technet.com/b/pki/archive/2013/11/12/sha1-deprecation-policy.aspx
AD FS 3.0 Certificate Requirements:
http://technet.microsoft.com/en-us/library/dn554247.aspx#BKMK_1

Answer 1

> I am not finding anything in my research to support that the algorithm's available for use are independant of the Provider selected.
It depends on a number of factors. If application uses built-in hash and signature functions (so application is not required to implement them) which are implemented in CryptCreateHash and CryptSignHash function, then algorithm is provider-dependend.
CryptSignHash must work in conjunction with CryptCreateHash (there is no raw hash support). Otherwise, provider must either implement its own hashing and signature functions, or implement signature functions which would allow raw hash signing. This is a sort
of design limitation, which makes freedom very complex.
When Microsoft designed CNG architecture, they greatly reviewed the whole design and made it very convenient. They now ships NCryptSignHash function, which uses raw hash value as input parameter. That is, key provider may not support this particular
hash algorithm (for example, one of GOST algorithms) and will be able to sign the hash (which is calculated out of band by the application, not by provider) and use NCryptVerifySignature to verify the signature.
> In what situation could an Issuing CA issuing a non-CNG certificate if the Root CA is set up using a CNG provider?
there is no relation between key providers on each CA server, because this information is not shared and is not used anywhere except private key access.
> If a request is submitted using a template that is configured to use a Legacy CSP, but there is not an Issuing CA configured to fulfill that request and available, the request will fail, will it not?
it depends. If template use ECC public key algorithm, CA server (which handles requests from that template) must support ECC because of internal processing rules and requirements.
this thread is heading to offtopic, so I would summarize initial question:
you can use legacy CSP for ADFS certificates and it doesn't matter whether the signing CA uses CNG or not. ADFS does support SHA2 signature algorithms, therefore you can utilize SHA2 signature in your certificates.
My weblog: en-us.sysadmins.lv
PowerShell PKI Module: pspki.codeplex.com
PowerShell Cmdlet Help Editor pscmdlethelpeditor.codeplex.com
Check out new: SSL Certificate Verifier
Check out new:
PowerShell FCIV tool.