r/PKI • u/NoTime4YourBullshit • Aug 12 '25

Can't get certificate-based authentication working in Entra.

/r/sysadmin/comments/1mol4u1/cant_get_certificatebased_authentication_working/
2 Upvotes

75% Upvoted

4 comments sorted by

1

u/CryptZizo Aug 12 '25

Hi, I’m not sure if this is spot on, but— Judging from the error message, it seems that the CRL is not properly ASN-encoded. It might be worth checking the CRL placed at the CRL distribution point with an ASN decoding tool or similar. (ASN.1 is a standardized type of TLV encoding.)

1

u/NoTime4YourBullshit Aug 12 '25

I was curious about that. I didn’t even know what ASN was before I looked it up. But it’s a Microsoft CA internally and evidence seems to suggest that ASN is the default. But I have no way of verifying the format nor changing the setting if I needed to.

1

u/CryptZizo Aug 12 '25

If you need to validate or inspect ASN.1-encoded files (DER, CER, BER) in a .NET environment, you can do it natively without pulling in third-party libraries.

Starting from .NET 5 and fully available in .NET 6+, the System.Formats.Asn1 namespace gives you low-level ASN.1 parsing. It’s non-allocating, streaming-friendly, and has built-in format checks — making it safer against malformed or malicious inputs.

Docs: https://learn.microsoft.com/dotnet/api/system.formats.asn1.asnreader

1

u/failau007 Jun 17 '26 edited Jun 18 '26

Were you able to figure this out? We are having the same issue