Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Publish-CRL throws: An attempt was made to access an uninitialized object #163

Closed
c3rberus opened this issue Dec 1, 2021 · 6 comments
Closed
Labels
bug Bug. An issue exist in our code. fixed-vNext The item is fixed in development code. Will be available in next release.

Comments

@c3rberus
Copy link

c3rberus commented Dec 1, 2021

Using PSPKI 3.7.2, when trying to run Publish-CRL -CertificationAuthority XXXXIntermediateCAv2 I get the following error:

Exception calling "PublishCRL" with "2" argument(s): "An attempt was made to access an uninitialized object."
At C:\Program Files\WindowsPowerShell\Modules\PSPKI\3.7.2\Server\Publish-CRL.ps1:15 char:4
+             $CA.PublishCRL($DeltaOnly, $UpdateFile)
+             ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (:) [], MethodInvocationException
    + FullyQualifiedErrorId : UninitializedObjectException

If I try this another method, I get this..

PS C:\Windows\system32> Get-CertificationAuthority | Publish-CRL
Exception calling "PublishCRL" with "2" argument(s): "CCertAdmin::PublishCRLs: The parameter is incorrect. 0x80070057
(WIN32: 87 ERROR_INVALID_PARAMETER)"
At C:\Program Files\WindowsPowerShell\Modules\PSPKI\3.7.2\Server\Publish-CRL.ps1:15 char:4
+             $CA.PublishCRL($DeltaOnly, $UpdateFile)
+             ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (:) [], MethodInvocationException
    + FullyQualifiedErrorId : ArgumentException

Any idea why this is happening?

@Crypt32
Copy link
Collaborator

Crypt32 commented Dec 1, 2021

do you receive your CAs when calling Get-CertificationAuthority and are they online and accessible?

@kempd
Copy link

kempd commented Feb 11, 2022

Same issue here, also on v3.7.2
Get-CertificationAuthority results in:

Name                 : <redacted>
DisplayName          : <redacted>
ComputerName         : <redacted>
ConfigString         : <redacted>
DistinguishedName    : CN=<redacted>,CN=Enrollment Services,CN=Public Key 
                       Services,CN=Services,CN=Configuration,<redacted>
Type                 : Enterprise Subordinate CA
IsEnterprise         : True
IsRoot               : False
OperatingSystem      : Microsoft Windows Server 2019 Datacenter
IsAccessible         : True
RegistryOnline       : True
ServiceStatus        : Running
SetupStatus          : ServerInstall, SecurityUpgraded, ServerIsUptoDate
Certificate          : [Subject]
                         <redacted>
                       
                       [Issuer]
                         <redacted>
                       
                       [Serial Number]
                         <redacted>
                       
                       [Not Before]
                         <redacted>
                       
                       [Not After]
                        <redacted>
                       
                       [Thumbprint]
                         <redacted>
                       
BaseCRL              : 
DeltaCRL             : 
EnrollmentServiceURI : 
EnrollmentEndpoints  : {}

Publish-CRL -CertificationAuthority $ca.Name gives the same error as OP.
In my case this is a blank setup.

@jimbju
Copy link

jimbju commented Dec 28, 2022

Getting the same error as OP:

$CAName = 'My CA'
$CAObj = Get-CertificationAuthority -Name $CAName
$CAObj | Publish-CRL
Exception calling "PublishCRL" with "2" argument(s): "CCertAdmin::PublishCRLs: The parameter is incorrect. 0x80070057 (WIN32: 87 ERROR_INVALID_PARAMETER)"
At C:\Program Files\PKI Solutions\PowerShell Modules\PSPKI\Server\Publish-CRL.ps1:15 char:4
+             $CA.PublishCRL($DeltaOnly, $UpdateFile)
+             ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (:) [], MethodInvocationException
    + FullyQualifiedErrorId : ArgumentException

@Crypt32
Copy link
Collaborator

Crypt32 commented Dec 29, 2022

@jimbju what returns your $CAObj variable?

@jimbju
Copy link

jimbju commented Jan 2, 2023

@Crypt32 contents of $CAObj:

DisplayName             ComputerName              IsAccessible ServiceStatus Type                     
-----------                  ------------                       ------------ ------------- ----                     
My CA                       mycacomputername...      True         Running       Enterprise Subordinate CA
$CAObj.GetType()

IsPublic IsSerial Name                                     BaseType                                                                                                     
-------- -------- ----                                     --------                                                                                                     
True     False    CertificateAuthority                     System.Object 

Crypt32 added a commit to PKISolutions/pkix.net that referenced this issue Jun 6, 2023
@Crypt32 Crypt32 added bug Bug. An issue exist in our code. fixed-vNext The item is fixed in development code. Will be available in next release. labels Jun 6, 2023
Crypt32 added a commit to PKISolutions/pkix.net that referenced this issue Jun 9, 2023
* Added new project

* added reference to new project

* added ASN package reference

* code style

* added folders

* moved SysadminsLV.PKI.Cryptography.AlgorithmOid to new project

* enabled latest language features

* replaced OID class extensions with new one and updated usages

* updated new OidExtension usage

* moved AlgorithmIdentifier class to new project and updated usages

* moved SysadminsLV.PKI.BasicCollection<T> to new project

* moved AlgorithmIdentifierCollection to new project

* removed non-existent Close() method.

* Moved NonceStatus enum to new project

* Deprecated OidGroupEnum and replaced with .NET OidGroup enumeration which wasn't available in .NET 4 and updated Oid2 class code to eliminate Windows Server 2003 obsolete code

* moved System.Security.Cryptography.OidMapping to SysadminsLV.PKI.Cryptography.X509Certificates.OidMapping

* moved SysadminsLV.PKI.Cryptography.TspFailureStatus to new project

* code style

* moved SysadminsLV.PKI.Cryptography.TspResponseStatus to new project

* moved SysadminsLV.PKI.Cryptography.TspValidationErrorStatus to new project

* use file-scoped namespaces

* moved System.Security.Cryptography.X509Certificates.AuthorityKeyIdentifierFlags to SysadminsLV.PKI.Cryptography.X509Certificates.AuthorityKeyIdentifierType (breaking)

* moved IssuingDistributionPointScope to new project

* moved System.Security.Cryptography.X509Certificates.X500RdnAttribute and X500RdnAttributeCollection to SysadminsLV.PKI.Cryptography.X509Certificates namespace (breaking)

* code style

* moved System.Security.Cryptography.X509Certificates.X509AlternativeNamesEnum to SysadminsLV.PKI.Cryptography.X509Certificates.X509AlternativeNamesEnum (breaking)

* moved System.Security.Cryptography.X509Certificates.X509AlternativeName and X509AlternativeNameCollection to SysadminsLV.PKI.Cryptography.X509Certificates namespace (breaking) and required dependencies as well

* moved System.Security.Cryptography.X509Certificates.X509ApplicationPoliciesExtension to SysadminsLV.PKI.Cryptography.X509Certificates.X509ApplicationPoliciesExtension (breaking)

* moved System.Security.Cryptography.X509Certificates.X509ApplicationPolicyConstraintsExtension to SysadminsLV.PKI.Cryptography.X509Certificates.X509ApplicationPolicyConstraintsExtension (breaking)

* moved System.Security.Cryptography.X509Certificates.X509ApplicationPolicyMappingsExtension to SysadminsLV.PKI.Cryptography.X509Certificates.X509ApplicationPolicyMappingsExtension (breaking)

* updated X509ApplicationPolicyMappingsExtension to use new OidMappingCollection class and code formatting

* moved System.Security.Cryptography.X509Certificates.X509ArchiveCutoffExtension to SysadminsLV.PKI.Cryptography.X509Certificates.X509ArchiveCutoffExtension (breaking)

* moved System.Security.Cryptography.X509Certificates.X509AuthorityInformationAccessExtension to SysadminsLV.PKI.Cryptography.X509Certificates.X509AuthorityInformationAccessExtension (breaking)

* updated xml-docs

* moved System.Security.Cryptography.X509Certificates.X509SubjectAlternativeNamesExtension to SysadminsLV.PKI.Cryptography.X509Certificates.X509SubjectAlternativeNamesExtension (breaking)

* moved System.Security.Cryptography.X509Certificates.X509AuthorityKeyIdentifierExtension to SysadminsLV.PKI.Cryptography.X509Certificates.X509AuthorityKeyIdentifierExtension (breaking)

* moved System.Security.Cryptography.X509Certificates.X509PolicyQualifierType to SysadminsLV.PKI.Cryptography.X509Certificates.X509PolicyQualifierType (breaking)

* moved System.Security.Cryptography.X509Certificates.X509PolicyQualifier to SysadminsLV.PKI.Cryptography.X509Certificates.X509PolicyQualifier (breaking)

* moved System.Security.Cryptography.X509Certificates.X509PolicyQualifierCollection to SysadminsLV.PKI.Cryptography.X509Certificates.X509PolicyQualifierCollection (breaking)

* moved System.Security.Cryptography.X509Certificates.X509CertificatePolicy to SysadminsLV.PKI.Cryptography.X509Certificates.X509CertificatePolicy (breaking)

* moved System.Security.Cryptography.X509Certificates.X509CertificatePolicyCollection to SysadminsLV.PKI.Cryptography.X509Certificates.X509CertificatePolicyCollection (breaking)

* moved System.Security.Cryptography.X509Certificates.X509CertificatePoliciesExtension to SysadminsLV.PKI.Cryptography.X509Certificates.X509CertificatePoliciesExtension (breaking)

* moved System.Security.Cryptography.X509Certificates.X509CertificatePolicyConstraintsExtension to SysadminsLV.PKI.Cryptography.X509Certificates.X509CertificatePolicyConstraintsExtension (breaking)

* moved System.Security.Cryptography.X509Certificates.X509CertificatePolicyMappingsExtension to SysadminsLV.PKI.Cryptography.X509Certificates.X509CertificatePolicyMappingsExtension (breaking)

* moved System.Security.Cryptography.X509Certificates.X509CertificateTemplateExtension to SysadminsLV.PKI.Cryptography.X509Certificates.X509CertificateTemplateExtension (breaking)

* moved PKI.Enrollment.ClientIdEnum to SysadminsLV.PKI.Cryptography.EnrollmentClientIdType (breaking)

* moved PKI.Cryptography.X509AttributeOid to SysadminsLV.PKI.Cryptography.X509AttributeOid (breaking)

* removed obsolete PKCS7SignedMessage

* 1. Replaced X509Attribute with .NET System.Security.Cryptography.Pkcs.Pkcs9AttributeObject
2. Replaced X509AttributeCollection with SysadminsLV.PKI.Cryptography.Pkcs.Pkcs9AttributeObjectCollection (both are breaking)

* moved X509CertificateTrustListEntry and X509CertificateTrustListEntryCollection to new project.

* refactored Windows-specific methods from X509CertificateTrustList class to extension methods to keep X509CertificateTrustList platform agnostic

* removed obsolete ContentInfo2 class

* moved PKCS classes without changing namespace.

* syntax

* replaced X509CNGKeyUsages with .NET CngKeyUsages

* moved System.Security.Cryptography.X509Certificates.X509CRLEntry to SysadminsLV.PKI.Cryptography.X509Certificates.X509CRLEntry (breaking)

* removed obsolete X509CTL and ManagedCryptUI classes

* moved System.Security.Cryptography.X509Certificates.X509CRLEntryCollection to SysadminsLV.PKI.Cryptography.X509Certificates.X509CRLEntryCollection (breaking)

* moved System.Security.Cryptography.X509Certificates.X509RevocationReasons to SysadminsLV.PKI.Cryptography.X509Certificates.X509RevocationReasons (breaking)

* moved System.Security.Cryptography.X509Certificates.X509RevocationReasonFlag to SysadminsLV.PKI.Cryptography.X509Certificates.X509RevocationReasonFlag (breaking)

* moved System.Security.Cryptography.X509Certificates.X509DistributionPoint to SysadminsLV.PKI.Cryptography.X509Certificates.X509DistributionPoint (breaking)

* moved System.Security.Cryptography.X509Certificates.X509CRLDistributionPointsExtension to SysadminsLV.PKI.Cryptography.X509Certificates.X509CRLDistributionPointsExtension (breaking)

* moved System.Security.Cryptography.X509Certificates.X509CRLNumberExtension to SysadminsLV.PKI.Cryptography.X509Certificates.X509CRLNumberExtension (breaking)

* moved System.Security.Cryptography.X509Certificates.X509CRLReferenceExtension to SysadminsLV.PKI.Cryptography.X509Certificates.X509CRLReferenceExtension (breaking)

* moved X509CrlType to new project

* removed obsolete X509CTLEntry and X509CTLEntryCollection

* moved System.Security.Cryptography.X509Certificates.X509CrossCertificateDistributionPointsExtension to SysadminsLV.PKI.Cryptography.X509Certificates.X509CrossCertificateDistributionPointsExtension (breaking)

* removed unused X509EncodingType

* moved System.Security.Cryptography.X509Certificates.X509FreshestCRLExtension to SysadminsLV.PKI.Cryptography.X509Certificates.X509FreshestCRLExtension (breaking)

* moved System.Security.Cryptography.X509Certificates.X509IssuerAlternativeNamesExtension to SysadminsLV.PKI.Cryptography.X509Certificates.X509IssuerAlternativeNamesExtension (breaking)

* moved X509IssuingDistributionPointsExtension to new project

* moved System.Security.Cryptography.X509Certificates.X509KeySpecFlags to SysadminsLV.PKI.Cryptography.X509Certificates.X509KeySpecFlags (breaking)

* moved System.Security.Cryptography.X509Certificates.X509NameConstraintsExtension to SysadminsLV.PKI.Cryptography.X509Certificates.X509NameConstraintsExtension (breaking)

* moved System.Security.Cryptography.X509Certificates.X509NextCRLPublishExtension to SysadminsLV.PKI.Cryptography.X509Certificates.X509NextCRLPublishExtension and fixed broken usings

* moved System.Security.Cryptography.X509Certificates.X509NonceExtension to SysadminsLV.PKI.Cryptography.X509Certificates.X509NonceExtension (breaking)

* moved X509NtdsSecurityExtension to new project

* moved System.Security.Cryptography.X509Certificates.X509PublishedCrlLocationsExtension to SysadminsLV.PKI.Cryptography.X509Certificates.X509PublishedCrlLocationsExtension (breaking)

* moved System.Security.Cryptography.X509Certificates.X509ServiceLocatorExtension to SysadminsLV.PKI.Cryptography.X509Certificates.X509ServiceLocatorExtension (breaking)

* moved System.Security.Cryptography.X509Certificates.X509CAVersionExtension to SysadminsLV.PKI.Cryptography.X509Certificates.X509CAVersionExtension (breaking)

* moved ContentBlobType to new project

* abstracted MessageSigner with interface

* updated Oid2 class by introducing extension method and moved SignedContentBlob to new project

* removed unused method

* added CryptSigner and updated ICryptSigner to eliminate Oid2 references

* added asymmetric algorithm primitive objects

* updated X509NtdsSecurityExtension by not using SecurityIdentifier class which is not compatible with .NET Standard

* formatting

* extracted windows-specific methods from X509CRL2 to extension methods.

* moved X509ServiceLocatorExtension and X509Extension extensions classes to new project (breaking)

* Moved System.Security.Cryptography.X509Certificates.X509CRL2 to SysadminsLV.PKI.Cryptography.X509Certificates.X509CRL2 and related classes (breaking)

* added an extension method to create a copy of X509ExtensionCollection collection

* moved SysadminsLV.PKI.Utils.CLRExtensions.X509Certificate2CollectionExtensions to SysadminsLV.PKI.CLRExtensions.X509Certificate2CollectionExtensions (breaking)

* removed obsolete and unused class

* removed unused method

* moved System.Security.Cryptography.X509Certificates.X509CRL2Collection to SysadminsLV.PKI.Cryptography.X509Certificates.X509CRL2Collection (breaking)

* updated namespaces and minor formatting

* fixed non-compilable issues after namespace refactoring

* moved SysadminsLV.PKI.Cryptography.Pkcs.SignedPkcs7 to new project (no namespace change)

* moved SysadminsLV.PKI.Cryptography.X509CertificateRequests.X509CertificateRequestPkcs10 to SysadminsLV.PKI.Cryptography.X509Certificates.X509CertificateRequestPkcs10 (breaking)

* formatting

* moved SysadminsLV.PKI.Cryptography.Pkcs to new project (no changes in namespace)

* moved remaining CMS classes and timestamp-related classes to new project, no namespace changes

* formatting

* moved SysadminsLV.PKI.Cryptography.X509Certificates.X509CertificateTrustList to new project (no changes in namespace)

* moved SysadminsLV.PKI.Cryptography.X509Certificates.X509CertificateTrustListBuilder to new project (no changes in namespace)

* moved System.Security.Cryptography.X509CertificateRequests.X509CertificateRequestType to SysadminsLV.PKI.Cryptography.X509Certificates.X509CertificateRequestType (breaking)

* moved SysadminsLV.PKI.Cryptography.X509CertificateRequests.X509CertificateRequestCmc to SysadminsLV.PKI.Cryptography.X509Certificates.X509CertificateRequestCmc (breaking)

* moved System.Security.Cryptography.X509CertificateRequests.X509CertificateRequest to SysadminsLV.PKI.Cryptography.X509Certificates.X509CertificateRequest (breaking)

* cleanup

* moved PKI.OCSP.CertificateStatus to SysadminsLV.PKI.OcspClient.CertificateStatus (breaking)

* moved PKI.OCSP.OCSPResponseStatus to SysadminsLV.PKI.OcspClient.OCSPResponseStatus (breaking)

* moved PKI.OCSP.OCSPResponseType to SysadminsLV.PKI.OcspClient.OCSPResponseType (breaking)

* moved PKI.OCSP.CertID to SysadminsLV.PKI.OcspClient.CertID (breaking)

* formatting

* added ASN.1 package

* moved PKI.OCSP.OCSPSingleResponse to SysadminsLV.PKI.OcspClient.OCSPSingleResponse (breaking)

* moved PKI.OCSP.OCSPSingleResponseCollection to SysadminsLV.PKI.OcspClient.OCSPSingleResponseCollection (breaking)

* moved PKI.OCSP.OCSPSingleRequest to SysadminsLV.PKI.OcspClient.OCSPSingleRequest (breaking)

* moved PKI.OCSP.OCSPSingleRequestCollection to SysadminsLV.PKI.OcspClient.OCSPSingleRequestCollection (breaking)

* simplified namespace prefixes

* moved PKI.OCSP.OCSPResponseComplianceError to SysadminsLV.PKI.OcspClient.OCSPResponseComplianceError (breaking)

* fixed namespace

* formatting

* moved PKI.OCSP.OCSPRequest to SysadminsLV.PKI.OcspClient.OCSPRequest (breaking)
moved PKI.OCSP.OCSPResponse to SysadminsLV.PKI.OcspClient.OCSPResponse (breaking)

* massive cleanup (unlikely breaking) of legacy internal or otherwise unsupported code

* cleanup and corrected usings

* moved extension method classes to corresponding namespaces

* discontinued temporary IOid interface

* made Oid2 class immutable and added Format(bool) method

* moved X509Certificate2.Format() method to new project and namespace (breaking)
moved X500DistinguishedNameExtensions to new project and namespace (breaking)

* formatting

* updated project properties

* removed obsolete and unused MessageSignature class

* added usings to eliminate memory leak

* cleanup

* move project

* -

* removed redundant casts when calling Asn1Reader.MoveNextAndExpectTags and Asn1Reader.MoveNextSiblingAndExpectTags

* renamed PKI project to SysadminsLV.PKI.Win to make it clear that it is Windows-specific with interop and not compatible with cross-platform.

* project GUID fix

* git move PKI folder under src folder

* Completed PKI project move to src folder and project rename

* - xml-docs to class
- renamed type parameter name
- formatting

* added nuspec files to new projects and updated nuspec

* moved certificate context property classes from System.Security.Cryptography.X509Certificates to SysadminsLV.PKI.Cryptography.X509Certificates namespace (breaking)

* moved safe handles to SysadminsLV.PKI.Cryptography.X509Certificates namespace (somewhat breaking)

* moved System.Security.Cryptography.X509Certificates.X509EnrollmentPropertyInfo to SysadminsLV.PKI.Cryptography.X509Certificates.X509EnrollmentPropertyInfo (breaking)

* moved System.Security.Cryptography.Oid2 to SysadminsLV.PKI.Cryptography.Oid2 (breaking)

* cleanup

* moved X509Certificate2.ResolveExtensions extension method to new project.

* updated assembly name

* added draft test project to test new SysadminsLV.PKI

* cleanup

* added tests drafts, they never were tested for correctness and are unreliable. They are added for future implementation and use.

* fixed various issues in CryptSigner

* fixed other CryptSigner issues, tests passed

* added ctors

* fixed bugs found during tests

* file-scoped namespaces

* added package reference

* fixed nuspec file

* removed obsolete property and updated formatting

* updated ASN.1 library and adjusted code to replace deprecated API

* fixed ASN.1 parsing and encoding issues

* updated packages

* updated packages

* updated assembly metdata

* added missing xml-docs

* removed unused folder

* Update README.md

* Update README.md

* Update SysadminsLV.PKI.nuspec

* Update SysadminsLV.PKI.OcspClient.nuspec

* Update SysadminsLV.PKI.Win.nuspec

* Update SysadminsLV.PKI.Win.nuspec

* Update SysadminsLV.PKI.Win.nuspec

* Update SysadminsLV.PKI.OcspClient.nuspec

* Update SysadminsLV.PKI.nuspec

* bump all to 4.0.0

* replaced project dependency with package dependency

* enabled documentation build

* replaced project dependencies with package dependencies

* moved System.Security.Cryptography.X509Certificates.X509CEPEnrollmentPropertyInfo to SysadminsLV.PKI.Cryptography.X509Certificates.X509CEPEnrollmentPropertyInfo namespace (breaking)

* Update README.md

* Drafted ICertificateTemplateSource interface

* added extension methods to read DS-based dictionaries

* optimized CNG key usage calculation for certificate templates

* added tests placeholder

* added DsPropertyCollection class and enabled its usage

* adde CX509CertificateTemplateExtensions

* enabled CX509CertificateTemplateExtensions usage

* added CT precertificate poison extension support

* completed DsCertificateTemplate implementation and added CertEnrollCertificateTemplate implementation of ICertificateTemplateEntry. Untested.

* added registry-based certificate template implementation of ICertificateTemplateEntry interface.

* drafted certificate templates in SysadminsLV.PKI library for future interop with MS-WCCE, MS-XCEP and other cross-platform protocols

* added few more stuff to AdcsCertificateTemplate and minor fixes.

* added CPS URL retrieval in certificate template certificate policies extension

* added Request.RequesterName column to default failed/denied view

* internal API refactoring and bug fixing

* fixed issue when ACE is not found when NTAccount is passed as IdentityReference and casing doesn't match although they are case-insensitive

* fixed SID regex pattern

* added xml-doc comments

* should address PKISolutions/PSPKI#163

* moved Error into proper namespace and renamed Error class to ErrorHelper

* formatting and visibility update

* removed unused classes

* formatting, untabification, internal refactoring

* bump to 4.0.1

* updated package

* updated test packages

* updated packages

* fixed namespace

* removed obsolete APIs

---------

Co-authored-by: Vadims Podans <bokorezi@inbox.lv>
@Crypt32
Copy link
Collaborator

Crypt32 commented Jun 15, 2023

Fixed in v4.0.0

@Crypt32 Crypt32 closed this as completed Jun 15, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Bug. An issue exist in our code. fixed-vNext The item is fixed in development code. Will be available in next release.
Projects
None yet
Development

No branches or pull requests

4 participants