Issue generating certs - Githubissues

ishackigozi commented 2 years ago

Hello, I am having issues enrolling a cerification. I get this error below.

sscep: data payload size: 755 bytes sscep: successfully encrypted payload sscep: envelope size: 1262 bytes sscep: creating outer PKCS#7 sscep: PKCS#7 data written successfully sscep: payload size: 2790 bytes sscep: connecting to xxxxxxx:80 sscep: server response status code: 200, MIME header: application/x-pki-message sscep: valid response from server sscep: reading outer PKCS#7 sscep: PKCS#7 payload size: 1033 bytes sscep: PKCS#7 contains 1 bytes of enveloped data sscep: verifying signature sscep: signature ok sscep: reply transaction id: 5C4E9F9BC67E4BE960D7362E2454A01F sscep: reply message type is good sscep: senderNonce in reply: F41AF4E53EF6AA4D965A3D0899914972 sscep: recipientNonce in reply: D035CAA8DC187607524BBF44FD6350C6 sscep: pkistatus: FAILURE sscep: reason: Transaction not permitted or supported sscep: illegal size of payload

Any ideas why this could be happening. Before it was working now it is not.

ishackigozi commented 2 years ago

sscep: pkistatus: FAILURE sscep: reason: Transaction not permitted or supported sscep: illegal size of payload

Can someone please help me understand why the enrollment process is failing. It was working previously?

gotthardp commented 2 years ago

Hello. Could you please provide more debugging information:

Do you have logs from the server?
Can you run the client with -v or -d to provide more output?

ishackigozi commented 2 years ago

root@SRA1501000133:/tmp/corp# cat openssl.cnf [req] prompt = no string_mask=nombstr distinguished_name = req_distinguished_name attributes=req_attributes [req_attributes] challengePassword=217E35D175 [req_distinguished_name] OU=SRA CN=xxxxxxxx [ x509v3_EXT ] subjectAltName=DNS:xxxxxx

sudo sscep enroll -v -u "http://xxxxxxxx/certsrv/mscep/mscep.dll/pkiclient.exe" -c CA.cert-0 -e CA.cert-1 -k local.key -r local.csr -l local.cert sscep: starting sscep, version 0.10.0 sscep: new transaction sscep: transaction id: D41D8CD98F00B204E9800998ECF8427E sscep: hostname: xxxxxxxxx sscep: directory: certsrv/mscep/mscep.dll/pkiclient.exe sscep: port: 80 sscep: SCEP_OPERATION_GETCAPS sscep: connecting to xxxxxxxx:80 sscep: server response status code: 200, MIME header: text/plain POSTPKIOperation Renewal SHA-512 SHA-256 SHA-1 DES3 sscep: Read request with transaction id: A6DE68F0A0A7486F312F06A70D87B234 sscep: generating selfsigned certificate sscep: requesting certificate with serial number 0 and issuer xxxxxxxxxx sscep: SCEP_OPERATION_ENROLL sscep: sending certificate request sscep: request data dump -----BEGIN CERTIFICATE REQUEST----- MIIC7zCCAdcCAQAwRTEMMAoGA1UECxMDU1JBMTUwMwYDVQQDEyxTUkExNTAxMDAw MTMzLm5hLmNvcnAuc2Ftc3VuZ2VsZWN0cm9uaWNzLm5ldDCCASIwDQYJKoZIhvcN AQEBBQADggEPADCCAQoCggEBAJ0/ZSaiMvIqop2LeaiksKG2GU2JJjkyb5g+IgIc cPzO9qH9g737bAFrq65N/bW8+w/5boUZTo907jUy6RFFUrliUc2b6/oVr/+jfKvA 6KpjmcykKQpfZk0EN3s4vUtAvjEZuulQ+vBAphJr2OqprCuY4Ws/+t8JbJO7baLe QvrTb0qvcYgaixxZtU4b2LueqGBozsC/qFCvmaBVQDLD4bLiIZgswoHx8CaSZksn 2uwA2HI66Rqh6oJmul9mI4W7w9dtkG0W7lclaSM8Em78tyaMa06WJQj3kX8wVtuq X+QUK9e8FfFJKLCcWULpQWPZKXatvM/lSRRPQhClj9nxwYECAwEAAaBlMBkGCSqG SIb3DQEJBzEMEwoyMTdFMzVEMTc1MEgGCSqGSIb3DQEJDjE7MDkwNwYDVR0RBDAw LoIsU1JBMTUwMTAwMDEzMy5uYS5jb3JwLnNhbXN1bmdlbGVjdHJvbmljcy5uZXQw DQYJKoZIhvcNAQELBQADggEBAHST/6F1C89k4mepM/YnvlpWieqNLAX6liv+91+k aN31eZp8jh2XgmmOaeQIxa1lOYfD8pw3ZXKBDzAfNmz20Leltw8K8G3hywDgi6kf JwNqQadiVmZabBL2tjHoIXhDe3BcsOgk6mUeqJFPjD9oWsptylqIVxgJYe1NSPnK qazi4KPY+QeWOM3PVeQHeiXY8aa2ICkaV1fJ2biH/eSiqbH2HPa0dP02ckacwrrd ixwaV90H/xU+Q9DZuVJu1l7qYwcFYwabvQgmsBCB7SO9QKXNo7E8wMQl214psOaJ lTegNzM2zfaj5wOevD0dvswrLXNxXlQovTrFGhEDmFxgUKQ= -----END CERTIFICATE REQUEST----- sscep: data payload size: 755 bytes sscep: successfully encrypted payload sscep: envelope size: 1262 bytes sscep: creating outer PKCS#7 sscep: PKCS#7 data written successfully sscep: payload size: 2790 bytes sscep: connecting to xxxxxxxxxxxxxxx:80 sscep: server response status code: 200, MIME header: application/x-pki-message sscep: valid response from server sscep: reading outer PKCS#7 sscep: PKCS#7 payload size: 1033 bytes sscep: PKCS#7 contains 1 bytes of enveloped data sscep: verifying signature sscep: signature ok sscep: reply transaction id: A6DE68F0A0A7486F312F06A70D87B234 sscep: reply message type is good sscep: senderNonce in reply: 4D906C1C406DF347BCE2C83C2F1A1592 sscep: recipientNonce in reply: 3F76EB1E00F35F3B8359BDA223C8EF8B sscep: pkistatus: FAILURE sscep: reason: Transaction not permitted or supported sscep: illegal size of payload

ishackigozi commented 2 years ago

Above is the openssl.conf. The only thing that fails is the enrollment portion. sscep enroll -v -u "http://xxxxxxxx/certsrv/mscep/mscep.dll/pkiclient.exe" -c CA.cert-0 -e CA.cert-1 -k local.key -r local.csr -l local.cert

gotthardp commented 2 years ago

And do you have logs from the server, too? This is a server-generated error, so the server may provide more information about what went wrong.

ishackigozi commented 2 years ago

Hello, Thanks for the response, I have reached out to the team that maintains the server and will try and waiting for the logs.

ishackigozi commented 2 years ago

root@1501000133:/tmp/corp# bash -x corpCertCreate.sh

fileName=/usr/share/corpcertcreated
test -f /usr/share/corpcertcreated
'[' 1 -eq 1 ']'
echo 'make sscep executable and moving to /usr/bin' make sscep executable and moving to /usr/bin
sudo rm -rf /usr/bin/sscep
sudo cp /tmp/corp/sscep /usr/bin/sscep
sudo chmod 755 /usr/bin/sscep ++ hostname
hostName=SRA1501000133
cd /tmp/corp +++ readlink -f corpCertCreate.sh ++ dirname /tmp/corp/corpCertCreate.sh
scriptDirectory=/tmp/corp
echo 'Your working directory is ' /tmp/corp Your working directory is /tmp/corp
echo 'creating openssl config' creating openssl config
echo '[req]'
echo 'prompt = no'
echo string_mask=nombstr
echo 'distinguished_name = req_distinguished_name'
echo attributes=req_attributes
echo '[req_attributes]'
echo challengePassword=217E35D175
echo '[req_distinguished_name]'
echo OU=SRA
echo CN=1501000133
echo '[ x509v3_EXT ]'
echo subjectAltName=DNS:1501000133
echo 'generating Key' generating Key
openssl genrsa -out local.key 2048 Generating RSA private key, 2048 bit long modulus (2 primes) .....................................................................................................+++++ ..................................+++++ e is 65537 (0x010001)
echo 'generating csr' generating csr
openssl req -new -key local.key -out local.csr -config openssl.cnf -reqexts x509v3_EXT
sudo sscep getca -v -u http://xxxxxx/certsrv/mscep/mscep.dll/pkiclient.exe -c CA.cer sscep: starting sscep, version 0.10.0 sscep: new transaction sscep: transaction id: SSCEP transactionId sscep: hostname: xxxxx sscep: directory: certsrv/mscep/mscep.dll/pkiclient.exe sscep: port: 80 sscep: SCEP_OPERATION_GETCAPS sscep: connecting to xxx:80 sscep: server response status code: 200, MIME header: text/plain POSTPKIOperation Renewal SHA-512 SHA-256 SHA-1 DES3 sscep: SCEP_OPERATION_GETCA sscep: connecting to xx:80 sscep: server response status code: 200, MIME header: application/x-x509-ca-ra-cert sscep: valid response from server

sscep: found certificate with subject: /C=xx/L=xx/O=xx/CN=xx issuer: /DC=xx/DC=xx/DC=xx/CN=xx basic constraints: (not included) usage: Digital Signature SHA512 fingerprint: E5:E5:9A:8D:CB:C3:EE:77:1F:5F:81:28:D4:07:B5:65:61:40:0D:59:8E:88:32:2A:6F:EE:CC:A6:80:84:4A:F6:B:55:A2:09:C5:61:78:2A:2B:7B:8F:76:DB:D9:1C sscep: certificate written as CA.cert-0

sscep: found certificate with subject: /xx/L=xx/O=xx/CN=xx issuer: /DC=xx/DC=xx/DC=xx/CN=xx basic constraints: (not included) usage: Key Encipherment SHA512 fingerprint: D0:42:4C:63:D9:A2:A1:5F:C6:F5:D4:EA:DB:B7:CB:B0:CD:21:EF:07:82:21:C3:5F:63:6D:D7:23:57:3D:91:EE:D:34:84:CF:09:C7:A4:B3:2A:69:3E:02:DC:A1:D5 sscep: certificate written as CA.cert-1

sscep: found certificate with subject: /CN=xxxxxxx issuer: /CN=xxxxxxxxx basic constraints: CA:TRUE usage: Digital Signature, Certificate Sign, CRL Sign SHA512 fingerprint: 50:5A:03:85:5D:C0:74:D9:65:4E:84:87:34:0F:11:07:B0:9D:25:5F:8F:C9:40:EC:92:A0:F5:4F:7A:AC:70:C4:C:DB:55:C8:9C:A8:28:01:C7:10:B4:2B:95:EC:34 sscep: certificate written as CA.cert-2

sscep: found certificate with subject: /DC=xx/DC=xx/DC=xx/CN=xxx issuer: /CN=xxx basic constraints: CA:TRUE usage: Digital Signature, Certificate Sign, CRL Sign SHA512 fingerprint: D4:86:FE:9B:E4:4D:B8:B5:5B:27:5C:43:E8:E5:10:38:E1:1B:EF:33:F6:77:2A:97:1E:10:85:5E:22:2B:A6:F1:7:A9:85:9F:09:BA:8E:85:FB:AF:8E:72:A7:7B:02 sscep: certificate written as CA.cert-3

echo 'generating device cert' generating device cert
sudo sscep enroll -v -u http://xxxxxxxxxxxxxx/certsrv/mscep/mscep.dll/pkiclient.exe -c CA.ce.cert sscep: starting sscep, version 0.10.0 sscep: new transaction sscep: transaction id: D41D8CD98F00B204E9800998ECF8427E sscep: hostname: xxxxxxxxxxx sscep: directory: certsrv/mscep/mscep.dll/pkiclient.exe sscep: port: 80 sscep: SCEP_OPERATION_GETCAPS sscep: connecting to xxxxxxx:80 sscep: server response status code: 200, MIME header: text/plain POSTPKIOperation Renewal SHA-512 SHA-256 SHA-1 DES3 sscep: Read request with transaction id: 69E67FF50D5924556CC3284F0B7857C0 sscep: generating selfsigned certificate sscep: requesting certificate with serial number 0 and issuer /C=xx/L=xx/O=xx/CN=xx sscep: SCEP_OPERATION_ENROLL sscep: sending certificate request sscep: request data dump -----BEGIN CERTIFICATE REQUEST----- MIIC7zCCAdcCAQAwRTEMMAoGA1UECxMDU1JBMTUwMwYDVQQDEyxTUkExNTAxMDAw MTMzLm5hLmNvcnAuc2Ftc3VuZ2VsZWN0cm9uaWNzLm5ldDCCASIwDQYJKoZIhvcN AQEBBQADggEPADCCAQoCggEBAMqjVNlWf24Omr1zw/ZZnx/sg8SDtrrSZTAdntrh AT4CLjg1ytDryVuELtLUe8OfTnsBTy2nPVjAkgKhoZwN5EKh/0L5Saf9QyZS7BOf swJaMiYIp63y38mD6prAXN4LBqJa1VLlGaNQQvrgonabya1AsLFNcmYpsiSMFuDN suyfTrSnmsTTYIQkQlbOJ+X2aulXHBDpiZmR57JvFbNZkG3zFOEkO8MBv5yuAN4f k7V895vSjoZvmd9hDVQuYAdmXut9JbNJPUGR2pax3PoYeYHf4E4S5bHmf6C9xFpI rwhD74+uLBWFi80/7kKgr3T+Rr2o3/xkfxoVP9xMp+neOhkCAwEAAaBlMBkGCSqG SIb3DQEJBzEMEwoyMTdFMzVEMTc1MEgGCSqGSIb3DQEJDjE7MDkwNwYDVR0RBDAw LoIsU1JBMTUwMTAwMDEzMy5uYS5jb3JwLnNhbXN1bmdlbGVjdHJvbmljcy5uZXQw DQYJKoZIhvcNAQELBQADggEBAA/e1bew+gztfCqPfUXgz650h9fXz+jD7gpFOfoj cWijkxab7Efjbk1US0TRW3XUmnMBoqK/f0G/d0hjyzH5urYsMow6KkClwuTdfvOq JbLewrOP/Kz5BkvGDBy1wS0BK5QB7p6kvqddBpYBKG+DXYN1uuatQ/0sRl4bN0B0 Hvrg6wKySUVVHvMPoiL/mMMpGSACRBOurZVQaT9O2naCFZMqYeQGo6Gk8iZGtmtE q+wjxVmZfauYoHZu85/CtQY/gITsWyHDDXBx2FlO6xXbiW1ijaXRxk0+WqK28qgS aBt3gLlGduivSE8mM1cHmqONVjrVKCgR3YxHAJLZS4ww1r4= -----END CERTIFICATE REQUEST----- sscep: data payload size: 755 bytes sscep: successfully encrypted payload sscep: envelope size: 1262 bytes sscep: creating outer PKCS#7 sscep: PKCS#7 data written successfully sscep: payload size: 2790 bytes sscep: connecting to xxxxxxxxxxxxxxxxxxx:80 sscep: server response status code: 200, MIME header: application/x-pki-message sscep: valid response from server sscep: reading outer PKCS#7 sscep: PKCS#7 payload size: 1033 bytes sscep: PKCS#7 contains 1 bytes of enveloped data sscep: verifying signature sscep: signature ok sscep: reply transaction id: 69E67FF50D5924556CC3284F0B7857C0 sscep: reply message type is good sscep: senderNonce in reply: 43B0079CA99B2649974EDAA8FC51F329 sscep: recipientNonce in reply: 05B2E09CAFAF3FF4E1893AAAD1449635 sscep: pkistatus: FAILURE sscep: reason: Transaction not permitted or supported sscep: illegal size of payload

ishackigozi commented 2 years ago

That is the detailed log from the client. Unfortunately, I have not got anything yet from the server team.

gotthardp commented 2 years ago

Let's wait for the server team then. There is not much we can do without the server logs.

ishackigozi commented 2 years ago

Hello, I have recieved the server logs today.

2022-03-28 21:51:28 10.40.87.82 GET /certsrv/mscep/mscep.dll/pkiclient.exe operation=GetCACert&message=CAIdentifier 80 - 105.165.69.22 - - 200 0 0 177 --

2022-03-28 21:51:29 10.40.87.82 GET /certsrv/mscep/mscep.dll/pkiclient.exe operation=PKIOperation&message=MIIKrQYJKoZIhvcNAQcCoIIKnjCCCpoCAQExDjAMBggqhkiG9w0CBQUAMIIE/gYJ%0AKoZIhvcNAQcBoIIE7wSCBOswggTnBgkqhkiG9w0BBwOgggTYMIIE1AIBADGCAa8w%0AggGrAgEAMIGSMHsxEzARBgoJkiaJk/IsZAEZFgNuZXQxIjAgBgoJkiaJk/IsZAEZ%0AFhJzYW1zdW5nZWxlY3Ryb25pY3MxFDASBgoJkiaJk/IsZAEZFgRjb3JwMSowKAYD%0AVQQDEyFTYW1zdW5nIEVsZWN0cm9uaWNzIElzc3VpbmcgQ0EgMDECE14AAmwxq/bc%0AykAmxNkAAAACbDEwDQYJKoZIhvcNAQEBBQAEggEAcgdu0iIX92EtxZrBBQLHZDMZ%0A17UylsMDUH3g3fKFwFsFGL7sRfvR2BG6yPO6rqmb4GLzeRLfQAYvVGCpMyZ1Gy0z%0ArmCkonqKuuhDKWIBN21Y4zc1C9pCdDBjk6Wjustk%2BGonsX19/BLb0EEKYMIbNbRd%0AA96rB/9zCOErtBpSZHlxpEzgGz4Y/mN0ddg5VNRFU1kgubcXJs3u7TdDKDqklpQu%0AetyH1jozjzCqbX42TgyjcP7HuFParcZrIlVdPXTS20n1wX5O%2BlBqwpy9fHKk4GA6%0ASRjYquGB2qZV0atpUfalPcRPmHZ2SXwqSjGHhb2rf%2BsxJLcfnkWOSoDFLwQK2TCC%0AAxoGCSqGSIb3DQEHATARBgUrDgMCBwQI4KHvmrkWysqAggL45AwlGwOPy7KncQY7%0AM7XD2mbP6sDXx8dhvggBjN7aPgeG4ZanM%2BaHV1PjGD6XtzFSckAYsPPgC9YtDuFo%0AYysp2tevxVwvFdHybG2uf0I1p%2Bwii2nJMLZTQ2uB8cPJbyalDhPPwD6eajKBwosD%0A8iUPuqLmUCTfD1RtMcagvN7IzCuL9tJ4y8W%2B6Smx43APlEQO6j2niIN4XURZg8jY%0AZHgs2QU%2B0HCZhkLqFU3JV0VjGvTagqXJmKmiRNMo/1JSERCHPYnWmf6Yti%2BJtAjo%0AnBz%2BurGVn6u7XfBNO7CeCdiXuA2nziojF2Pqr3heXNp4chNzBZwG9vmcYxwmWs8t%0APoVTIlfaFXdfAhID%2BLxvgSAx%2Bn1u9saYDLAMaqFTbfqgTqGpAhMAtiK5wlHlIYfT%0AUXNRX9CCyz2ZFu12DbrkeX7/Hi6whjJ5fWgTrlcOtybyrZLGpJKcj/kOJRvIEXKZ%0Au54T6vLKTbsg4vZYyxdBSSdLTsKx%2BVnT6wLo%2ByRROSAXpnKURARxINJwThx1px%2Bc%0AftLfx3VW2tmTS%2BXCY9M/iIHShe4VLS1nKzrZ4nAXB9erl348GE%2BeRcNwWqTr4rAb%0AYQDVj%2B5sBbMMGxxP7G/zGWqK5Rpc/mihSR5qiVoCNM2bBKJZBI7ZmfBJYaKOyVQb%0AJZkwnu1d5GYONs7%2BUtRIPAymelM1eVrTRCYiTTSL17vIdQuYE9/zzLwJl0RzkOcj%0Ayih5/PTvyFcwWNEfp5FemNaIgTFjjw/yhQic9ZlrQ3LbjeAgCxEMNsYyNTUyFg%2BQ%0A6QFfntuGR2S1gvxQbGxibtCQAw0UiBCsttQC3OK1pXuA/r2s3N3UHiRNFArBHNOP%0AyDIyS3QTxC2EY4Ru93/SZNPvhFJE3B1dfuSwyv87SnfuZdtiZYV32jgHs6Yz7cT9%0A8mqOXzq1jMNmwax16PHMp5JQ5xE3UINqsoiVCgd9%2BrcfVJUeYG2VrTNwpnc0h3el%0A%2BdWspfstY9fp%2BPz9ZJ45aY%2BnC8rG7up5n/jz6aCCAyYwggMiMIICCqADAgECAiAx%0ANDIxQzhERjgwN0Y5RDMwQUI0MDdFMEZBQThGMDUwADANBgkqhkiG9w0BAQQFADBF%0AMQwwCgYDVQQLEwNTUkExNTAzBgNVBAMTLFNSQTE1MDEwMDAxMzMubmEuY29ycC5z%0AYW1zdW5nZWxlY3Ryb25pY3MubmV0MB4XDTIyMDMyODIxNTEyOVoXDTIyMDQwMzIz%0ANTEyOVowRTEMMAoGA1UECxMDU1JBMTUwMwYDVQQDEyxTUkExNTAxMDAwMTMzLm5h%0ALmNvcnAuc2Ftc3VuZ2VsZWN0cm9uaWNzLm5ldDCCASIwDQYJKoZIhvcNAQEBBQAD%0AggEPADCCAQoCggEBAM6M14aoDSOxnVQ7Wi4rcF498wyWgQK/JshNYLDKrpGBNZEr%0A%2BR2Zc2ggenS4uQTji46t0PSsrToYUtbPRgTbmEBo0Nd5%2BE8uUhM/48a5HGuFIvkp%0AjbNeWNG6VEi6QJEGwSuUNu32qiOqjDCLHBU5hVZmLIoTI1DtLXQQc5lchsAt3sGJ%0AN555X6FMDf5HEgHqPyVMNGAnvTF3kz/0XEW9F5bDGRlvzmYWtOLFIGyudf%2BHcotT%0A6rgFgxXPux92znhMfz4yf/GdibO7%2BdRKcpiHgIMs3LUUj22xXea9teyBdawZveKV%0APzeRh4H3HgnMeI83kYp8ipHjYmIoofmb3uzP8iUCAwEAATANBgkqhkiG9w0BAQQF%0AAAOCAQEAILPEnpSSxx2fgQE9EzG1bM7k27m6GtRZkJWb3SLA8KbOvfLROIx3RVDY%0AHM6kx%2BuzMNYFDSAqbNPuw3Ly0Ctutai7y/V0wdI3n1iGYluIVyzPWDjEt0eOu2St%0AgZ1jKoDToLORGERBF1vnzakYbIdwOdZsI1NtMZ0TN3cink48Wd3JQbbulmk9Zt3P%0AW9Yu1Q0Ww4BPCfr3jy7NLeBQpTECu9y43stEhVr9FfdEzzQnCOuRSOtFBAdEQ9cY%0AXjzeP9ECVrId9fLY4vAMaPxbIfAMIYw5bv%2BZoXKd0XQ8EK6uVJbSNRrHNX/EaQtY%0AYeU2oq8Tpf04ERS1CnPyEEVRJsWmjzGCAlcwggJTAgEBMGkwRTEMMAoGA1UECxMD%0AU1JBMTUwMwYDVQQDEyxTUkExNTAxMDAwMTMzLm5hLmNvcnAuc2Ftc3VuZ2VsZWN0%0Acm9uaWNzLm5ldAIgMTQyMUM4REY4MDdGOUQzMEFCNDA3RTBGQUE4RjA1MAAwDAYI%0AKoZIhvcNAgUFAKCBwTASBgpghkgBhvhFAQkCMQQTAjE5MBgGCSqGSIb3DQEJAzEL%0ABgkqhkiG9w0BBwEwHAYJKoZIhvcNAQkFMQ8XDTIyMDMyODIxNTEyOVowHwYJKoZI%0AhvcNAQkEMRIEEHL9q8kMRu3czOUk78KttvowIAYKYIZIAYb4RQEJBTESBBCpokDz%0ASWPlxpsrDxyvhtGsMDAGCmCGSAGG%2BEUBCQcxIhMgMTQyMUM4REY4MDdGOUQzMEFC%0ANDA3RTBGQUE4RjA1MEMwDQYJKoZIhvcNAQEBBQAEggEAh28c/RBwgQCrJetP%2BAcR%0A4Kyd0rQ%2B9hsgDpkWxRrSIhv/CvS%2B6SuF8umhwfMTsxkC8l97oqrlLDqcnrSI9jZO%0Ag0VWRN0t/XYXPWlOFg83UoGJbdlPFb3F99umPgr3HV6lHdCoPIm5PZ05xGOakxIo%0AuuPLlIBPKcHJRwM10Fp8QsFbWC9kDZ2jELY4AYU8jV61a742f9/zpP0p%2BQECeD9r%0Ah4rJZIKUyEokvrS6Iu14Jn/1YL5VjBUikX1LHmRzOgF9EEr21Ab0cBardMAyv9Qq%0A4gFlaP%2BBDYnYU0%2BQM2sctDo3x4iZrPFOz1yVxefNG7DRF2X/lCzUazmcNfAW5Ahr%0AWA%3D%3D%0A 80 - 105.165.69.22 - - 200 0 0 635

gotthardp commented 2 years ago

Hmm. It does not help much though. It's a log from the HTTP server, not from the SCEP server.

ishackigozi commented 2 years ago

2022-04-02 01:01:42 10.40.87.82 GET /certsrv/mscep/mscep.dll/pkiclient.exe operation=GetCACaps 80 - 105.165.69.22 - - 200 0 0 179

2022-04-02 01:01:43 10.40.87.82 POST /certsrv/mscep/mscep.dll/pkiclient.exe operation=PKIOperation 80 - 105.165.69.22 - - 200 0 0 570

ishackigozi commented 2 years ago

#Software: Microsoft Internet Information Services 10.0 -- 2022-04-03 00:01:42 10.40.87.82 GET /certsrv/mscep_admin - 80 - 105.165.69.22 Wget/1.20.3+(linux-gnu) - 401 2 5 175 2022-04-03 00:01:42 10.40.87.82 GET /certsrv/mscep_admin - 80 na\sra_mdm_certgen 105.165.69.22 Wget/1.20.3+(linux-gnu) - 301 0 0 180 2022-04-03 00:01:44 10.40.87.82 GET /certsrv/mscep_admin/ - 80 na\sra_mdm_certgen 105.165.69.22 Wget/1.20.3+(linux-gnu) - 200 0 0 731 2022-04-03 00:01:44 10.40.87.82 GET /certsrv/mscep/mscep.dll/pkiclient.exe operation=GetCACaps 80 - 105.165.69.22 - - 200 0 0 229 2022-04-03 00:01:44 10.40.87.82 GET /certsrv/mscep/mscep.dll/pkiclient.exe operation=GetCACert&message=CAIdentifier 80 - 105.165.69.22 - - 200 0 0 177 2022-04-03 00:01:45 10.40.87.82 GET /certsrv/mscep/mscep.dll/pkiclient.exe operation=GetCACaps 80 - 105.165.69.22 - - 200 0 0 174 2022-04-03 00:01:45 10.40.87.82 POST /certsrv/mscep/mscep.dll/pkiclient.exe operation=PKIOperation 80 - 105.165.69.22 - - 200 0 0 565 2022-04-03 01:01:29 10.40.87.82 GET /certsrv/mscep_admin - 80 - 105.165.69.22 Wget/1.20.3+(linux-gnu) - 401 2 5 178 2022-04-03 01:01:30 10.40.87.82 GET /certsrv/mscep_admin - 80 na\sra_mdm_certgen 105.165.69.22 Wget/1.20.3+(linux-gnu) - 301 0 0 179 2022-04-03 01:01:30 10.40.87.82 GET /certsrv/mscep_admin/ - 80 na\sra_mdm_certgen 105.165.69.22 Wget/1.20.3+(linux-gnu) - 200 0 0 714 2022-04-03 01:01:31 10.40.87.82 GET /certsrv/mscep/mscep.dll/pkiclient.exe operation=GetCACaps 80 - 105.165.69.22 - - 200 0 0 175 2022-04-03 01:01:31 10.40.87.82 GET /certsrv/mscep/mscep.dll/pkiclient.exe operation=GetCACert&message=CAIdentifier 80 - 105.165.69.22 - - 200 0 0 177 2022-04-03 01:01:31 10.40.87.82 GET /certsrv/mscep/mscep.dll/pkiclient.exe operation=GetCACaps 80 - 105.165.69.22 - - 200 0 0 176 2022-04-03 01:01:33 10.40.87.82 POST /certsrv/mscep/mscep.dll/pkiclient.exe operation=PKIOperation 80 - 105.165.69.22 - - 200 0 0 572 2022-04-03 02:01:17 10.40.87.82 GET /certsrv/mscep_admin - 80 - 105.165.69.22 Wget/1.20.3+(linux-gnu) - 401 2 5 177 2022-04-03 02:01:17 10.40.87.82 GET /certsrv/mscep_admin - 80 na\sra_mdm_certgen 105.165.69.22 Wget/1.20.3+(linux-gnu) - 301 0 0 179 2022-04-03 02:01:18 10.40.87.82 GET /certsrv/mscep_admin/ - 80 na\sra_mdm_certgen 105.165.69.22 Wget/1.20.3+(linux-gnu) - 200 0 0 724 2022-04-03 02:01:18 10.40.87.82 GET /certsrv/mscep/mscep.dll/pkiclient.exe operation=GetCACaps 80 - 105.165.69.22 - - 200 0 0 176 2022-04-03 02:01:19 10.40.87.82 GET /certsrv/mscep/mscep.dll/pkiclient.exe operation=GetCACert&message=CAIdentifier 80 - 105.165.69.22 - - 200 0 0 176 2022-04-03 02:01:19 10.40.87.82 GET /certsrv/mscep/mscep.dll/pkiclient.exe operation=GetCACaps 80 - 105.165.69.22 - - 200 0 0 175 2022-04-03 02:01:20 10.40.87.82 POST /certsrv/mscep/mscep.dll/pkiclient.exe operation=PKIOperation 80 - 105.165.69.22 - - 200 0 0 565 2022-04-03 03:01:04 10.40.87.82 GET /certsrv/mscep_admin - 80 - 105.165.69.22 Wget/1.20.3+(linux-gnu) - 401 2 5 177 2022-04-03 03:01:04 10.40.87.82 GET /certsrv/mscep_admin - 80 na\sra_mdm_certgen 105.165.69.22 Wget/1.20.3+(linux-gnu) - 301 0 0 180 2022-04-03 03:01:05 10.40.87.82 GET /certsrv/mscep_admin/ - 80 na\sra_mdm_certgen 105.165.69.22 Wget/1.20.3+(linux-gnu) - 200 0 0 756 2022-04-03 03:01:05 10.40.87.82 GET /certsrv/mscep/mscep.dll/pkiclient.exe operation=GetCACaps 80 - 105.165.69.22 - - 200 0 0 176 2022-04-03 03:01:05 10.40.87.82 GET /certsrv/mscep/mscep.dll/pkiclient.exe operation=GetCACert&message=CAIdentifier 80 - 105.165.69.22 - - 200 0 0 177 2022-04-03 03:01:06 10.40.87.82 GET /certsrv/mscep/mscep.dll/pkiclient.exe operation=GetCACaps 80 - 105.165.69.22 - - 200 0 0 176 2022-04-03 03:01:07 10.40.87.82 POST /certsrv/mscep/mscep.dll/pkiclient.exe operation=PKIOperation 80 - 105.165.69.22 - - 200 0 0 610 2022-04-03 04:00:59 10.40.87.82 GET /certsrv/mscep_admin - 80 - 105.165.69.22 Wget/1.20.3+(linux-gnu) - 401 2 5 177 2022-04-03 04:00:59 10.40.87.82 GET /certsrv/mscep_admin - 80 na\sra_mdm_certgen 105.165.69.22 Wget/1.20.3+(linux-gnu) - 301 0 0 179 2022-04-03 04:01:02 10.40.87.82 GET /certsrv/mscep_admin/ - 80 na\sra_mdm_certgen 105.165.69.22 Wget/1.20.3+(linux-gnu) - 200 0 0 2259 2022-04-03 04:01:02 10.40.87.82 GET /certsrv/mscep/mscep.dll/pkiclient.exe operation=GetCACaps 80 - 105.165.69.22 - - 200 0 0 206 2022-04-03 04:01:03 10.40.87.82 GET /certsrv/mscep/mscep.dll/pkiclient.exe operation=GetCACert&message=CAIdentifier 80 - 105.165.69.22 - - 200 0 0 481 2022-04-03 04:01:03 10.40.87.82 GET /certsrv/mscep/mscep.dll/pkiclient.exe operation=GetCACaps 80 - 105.165.69.22 - - 200 0 0 365 2022-04-03 04:01:04 10.40.87.82 POST /certsrv/mscep/mscep.dll/pkiclient.exe operation=PKIOperation 80 - 105.165.69.22 - - 200 0 0 568 2022-04-03 05:01:38 10.40.87.82 GET /certsrv/mscep_admin - 80 - 105.165.69.22 Wget/1.20.3+(linux-gnu) - 401 2 5 177 2022-04-03 05:01:38 10.40.87.82 GET /certsrv/mscep_admin - 80 na\sra_mdm_certgen 105.165.69.22 Wget/1.20.3+(linux-gnu) - 301 0 0 180 2022-04-03 05:01:39 10.40.87.82 GET /certsrv/mscep_admin/ - 80 na\sra_mdm_certgen 105.165.69.22 Wget/1.20.3+(linux-gnu) - 200 0 0 714 2022-04-03 05:01:40 10.40.87.82 GET /certsrv/mscep/mscep.dll/pkiclient.exe operation=GetCACaps 80 - 105.165.69.22 - - 200 0 0 519 2022-04-03 05:01:40 10.40.87.82 GET /certsrv/mscep/mscep.dll/pkiclient.exe operation=GetCACert&message=CAIdentifier 80 - 105.165.69.22 - - 200 0 0 444 2022-04-03 05:01:41 10.40.87.82 GET /certsrv/mscep/mscep.dll/pkiclient.exe operation=GetCACaps 80 - 105.165.69.22 - - 200 0 0 176 2022-04-03 05:01:41 10.40.87.82 POST /certsrv/mscep/mscep.dll/pkiclient.exe operation=PKIOperation 80 - 105.165.69.22 - - 200 0 0 565 2022-04-03 06:01:24 10.40.87.82 GET /certsrv/mscep_admin - 80 - 105.165.69.22 Wget/1.20.3+(linux-gnu) - 401 2 5 176 2022-04-03 06:01:24 10.40.87.82 GET /certsrv/mscep_admin - 80 na\sra_mdm_certgen 105.165.69.22 Wget/1.20.3+(linux-gnu) - 301 0 0 179 2022-04-03 06:01:25 10.40.87.82 GET /certsrv/mscep_admin/ - 80 na\sra_mdm_certgen 105.165.69.22 Wget/1.20.3+(linux-gnu) - 200 0 0 717 2022-04-03 06:01:25 10.40.87.82 GET /certsrv/mscep/mscep.dll/pkiclient.exe operation=GetCACaps 80 - 105.165.69.22 - - 200 0 0 173 2022-04-03 06:01:25 10.40.87.82 GET /certsrv/mscep/mscep.dll/pkiclient.exe operation=GetCACert&message=CAIdentifier 80 - 105.165.69.22 - - 200 0 0 179 2022-04-03 06:01:27 10.40.87.82 GET /certsrv/mscep/mscep.dll/pkiclient.exe operation=GetCACaps 80 - 105.165.69.22 - - 200 0 0 177 2022-04-03 06:01:27 10.40.87.82 POST /certsrv/mscep/mscep.dll/pkiclient.exe operation=PKIOperation 80 - 105.165.69.22 - - 200 0 0 567 2022-04-03 07:01:11 10.40.87.82 GET /certsrv/mscep_admin - 80 - 105.165.69.22 Wget/1.20.3+(linux-gnu) - 401 2 5 176 2022-04-03 07:01:11 10.40.87.82 GET /certsrv/mscep_admin - 80 na\sra_mdm_certgen 105.165.69.22 Wget/1.20.3+(linux-gnu) - 301 0 0 179 2022-04-03 07:01:13 10.40.87.82 GET /certsrv/mscep_admin/ - 80 na\sra_mdm_certgen 105.165.69.22 Wget/1.20.3+(linux-gnu) - 200 0 0 712 2022-04-03 07:01:13 10.40.87.82 GET /certsrv/mscep/mscep.dll/pkiclient.exe operation=GetCACaps 80 - 105.165.69.22 - - 200 0 0 175 2022-04-03 07:01:13 10.40.87.82 GET /certsrv/mscep/mscep.dll/pkiclient.exe operation=GetCACert&message=CAIdentifier 80 - 105.165.69.22 - - 200 0 0 177 2022-04-03 07:01:14 10.40.87.82 GET /certsrv/mscep/mscep.dll/pkiclient.exe operation=GetCACaps 80 - 105.165.69.22 - - 200 0 0 178 2022-04-03 07:01:14 10.40.87.82 POST /certsrv/mscep/mscep.dll/pkiclient.exe operation=PKIOperation 80 - 105.165.69.22 - - 200 0 0 566 2022-04-03 08:01:01 10.40.87.82 GET /certsrv/mscep_admin - 80 - 105.165.69.22 Wget/1.20.3+(linux-gnu) - 401 2 5 175 2022-04-03 08:01:02 10.40.87.82 GET /certsrv/mscep_admin - 80 na\sra_mdm_certgen 105.165.69.22 Wget/1.20.3+(linux-gnu) - 301 0 0 179 2022-04-03 08:01:02 10.40.87.82 GET /certsrv/mscep_admin/ - 80 na\sra_mdm_certgen 105.165.69.22 Wget/1.20.3+(linux-gnu) - 200 0 0 711 2022-04-03 08:01:04 10.40.87.82 GET /certsrv/mscep/mscep.dll/pkiclient.exe operation=GetCACaps 80 - 105.165.69.22 - - 200 0 0 175 2022-04-03 08:01:04 10.40.87.82 GET /certsrv/mscep/mscep.dll/pkiclient.exe operation=GetCACert&message=CAIdentifier 80 - 105.165.69.22 - - 200 0 0 177 2022-04-03 08:01:05 10.40.87.82 GET /certsrv/mscep/mscep.dll/pkiclient.exe operation=GetCACaps 80 - 105.165.69.22 - - 200 0 0 175 2022-04-03 08:01:05 10.40.87.82 POST /certsrv/mscep/mscep.dll/pkiclient.exe operation=PKIOperation 80 - 105.165.69.22 - - 200 0 0 571 2022-04-03 09:01:51 10.40.87.82 GET /certsrv/mscep_admin - 80 - 105.165.69.22 Wget/1.20.3+(linux-gnu) - 401 2 5 177 2022-04-03 09:01:52 10.40.87.82 GET /certsrv/mscep_admin - 80 na\sra_mdm_certgen 105.165.69.22 Wget/1.20.3+(linux-gnu) - 301 0 0 179 2022-04-03 09:01:52 10.40.87.82 GET /certsrv/mscep_admin/ - 80 na\sra_mdm_certgen 105.165.69.22 Wget/1.20.3+(linux-gnu) - 200 0 0 714 2022-04-03 09:01:53 10.40.87.82 GET /certsrv/mscep/mscep.dll/pkiclient.exe operation=GetCACaps 80 - 105.165.69.22 - - 200 0 0 176 2022-04-03 09:01:53 10.40.87.82 GET /certsrv/mscep/mscep.dll/pkiclient.exe operation=GetCACert&message=CAIdentifier 80 - 105.165.69.22 - - 200 0 0 177 2022-04-03 09:01:53 10.40.87.82 GET /certsrv/mscep/mscep.dll/pkiclient.exe operation=GetCACaps 80 - 105.165.69.22 - - 200 0 0 176 2022-04-03 09:01:55 10.40.87.82 POST /certsrv/mscep/mscep.dll/pkiclient.exe operation=PKIOperation 80 - 105.165.69.22 - - 200 0 0 572 2022-04-03 10:01:32 10.40.87.82 GET /certsrv/mscep_admin - 80 - 105.165.69.22 Wget/1.20.3+(linux-gnu) - 401 2 5 176 2022-04-03 10:01:32 10.40.87.82 GET /certsrv/mscep_admin - 80 na\sra_mdm_certgen 105.165.69.22 Wget/1.20.3+(linux-gnu) - 301 0 0 179 2022-04-03 10:01:34 10.40.87.82 GET /certsrv/mscep_admin/ - 80 na\sra_mdm_certgen 105.165.69.22 Wget/1.20.3+(linux-gnu) - 200 0 0 713 2022-04-03 10:01:34 10.40.87.82 GET /certsrv/mscep/mscep.dll/pkiclient.exe operation=GetCACaps 80 - 105.165.69.22 - - 200 0 0 176 2022-04-03 10:01:35 10.40.87.82 GET /certsrv/mscep/mscep.dll/pkiclient.exe operation=GetCACert&message=CAIdentifier 80 - 105.165.69.22 - - 200 0 0 177 2022-04-03 10:01:35 10.40.87.82 GET /certsrv/mscep/mscep.dll/pkiclient.exe operation=GetCACaps 80 - 105.165.69.22 - - 200 0 0 176 2022-04-03 10:01:36 10.40.87.82 POST /certsrv/mscep/mscep.dll/pkiclient.exe operation=PKIOperation 80 - 105.165.69.22 - - 200 0 0 568 2022-04-03 11:01:20 10.40.87.82 GET /certsrv/mscep_admin - 80 - 105.165.69.22 Wget/1.20.3+(linux-gnu) - 401 2 5 177 2022-04-03 11:01:20 10.40.87.82 GET /certsrv/mscep_admin - 80 na\sra_mdm_certgen 105.165.69.22 Wget/1.20.3+(linux-gnu) - 301 0 0 181 2022-04-03 11:01:21 10.40.87.82 GET /certsrv/mscep_admin/ - 80 na\sra_mdm_certgen 105.165.69.22 Wget/1.20.3+(linux-gnu) - 200 0 0 726 2022-04-03 11:01:21 10.40.87.82 GET /certsrv/mscep/mscep.dll/pkiclient.exe operation=GetCACaps 80 - 105.165.69.22 - - 200 0 0 177 2022-04-03 11:01:22 10.40.87.82 GET /certsrv/mscep/mscep.dll/pkiclient.exe operation=GetCACert&message=CAIdentifier 80 - 105.165.69.22 - - 200 0 0 177 2022-04-03 11:01:22 10.40.87.82 GET /certsrv/mscep/mscep.dll/pkiclient.exe operation=GetCACaps 80 - 105.165.69.22 - - 200 0 0 176 2022-04-03 11:01:23 10.40.87.82 POST /certsrv/mscep/mscep.dll/pkiclient.exe operation=PKIOperation 80 - 105.165.69.22 - - 200 0 0 569 2022-04-03 12:01:07 10.40.87.82 GET /certsrv/mscep_admin - 80 - 105.165.69.22 Wget/1.20.3+(linux-gnu) - 401 2 5 176 2022-04-03 12:01:07 10.40.87.82 GET /certsrv/mscep_admin - 80 na\sra_mdm_certgen 105.165.69.22 Wget/1.20.3+(linux-gnu) - 301 0 0 181 2022-04-03 12:01:08 10.40.87.82 GET /certsrv/mscep_admin/ - 80 na\sra_mdm_certgen 105.165.69.22 Wget/1.20.3+(linux-gnu) - 200 0 0 722 2022-04-03 12:01:08 10.40.87.82 GET /certsrv/mscep/mscep.dll/pkiclient.exe operation=GetCACaps 80 - 105.165.69.22 - - 200 0 0 176 2022-04-03 12:01:09 10.40.87.82 GET /certsrv/mscep/mscep.dll/pkiclient.exe operation=GetCACert&message=CAIdentifier 80 - 105.165.69.22 - - 200 0 0 176 2022-04-03 12:01:09 10.40.87.82 GET /certsrv/mscep/mscep.dll/pkiclient.exe operation=GetCACaps 80 - 105.165.69.22 - - 200 0 0 176 2022-04-03 12:01:10 10.40.87.82 POST /certsrv/mscep/mscep.dll/pkiclient.exe operation=PKIOperation 80 - 105.165.69.22 - - 200 0 0 571 2022-04-03 13:00:53 10.40.87.82 GET /certsrv/mscep_admin - 80 - 105.165.69.22 Wget/1.20.3+(linux-gnu) - 401 2 5 180 2022-04-03 13:00:53 10.40.87.82 GET /certsrv/mscep_admin - 80 na\sra_mdm_certgen 105.165.69.22 Wget/1.20.3+(linux-gnu) - 301 0 0 179 2022-04-03 13:00:55 10.40.87.82 GET /certsrv/mscep_admin/ - 80 na\sra_mdm_certgen 105.165.69.22 Wget/1.20.3+(linux-gnu) - 200 0 0 717 2022-04-03 13:00:56 10.40.87.82 GET /certsrv/mscep/mscep.dll/pkiclient.exe operation=GetCACaps 80 - 105.165.69.22 - - 200 0 0 179 2022-04-03 13:00:56 10.40.87.82 GET /certsrv/mscep/mscep.dll/pkiclient.exe operation=GetCACert&message=CAIdentifier 80 - 105.165.69.22 - - 200 0 0 177 2022-04-03 13:00:56 10.40.87.82 GET /certsrv/mscep/mscep.dll/pkiclient.exe operation=GetCACaps 80 - 105.165.69.22 - - 200 0 0 176 2022-04-03 13:00:57 10.40.87.82 POST /certsrv/mscep/mscep.dll/pkiclient.exe operation=PKIOperation 80 - 105.165.69.22 - - 200 0 0 567 2022-04-03 14:01:49 10.40.87.82 GET /certsrv/mscep_admin - 80 - 105.165.69.22 Wget/1.20.3+(linux-gnu) - 401 2 5 177 2022-04-03 14:01:49 10.40.87.82 GET /certsrv/mscep_admin - 80 na\sra_mdm_certgen 105.165.69.22 Wget/1.20.3+(linux-gnu) - 301 0 0 179 2022-04-03 14:01:50 10.40.87.82 GET /certsrv/mscep_admin/ - 80 na\sra_mdm_certgen 105.165.69.22 Wget/1.20.3+(linux-gnu) - 200 0 0 730 2022-04-03 14:01:50 10.40.87.82 GET /certsrv/mscep/mscep.dll/pkiclient.exe operation=GetCACaps 80 - 105.165.69.22 - - 200 0 0 176 2022-04-03 14:01:50 10.40.87.82 GET /certsrv/mscep/mscep.dll/pkiclient.exe operation=GetCACert&message=CAIdentifier 80 - 105.165.69.22 - - 200 0 0 177 2022-04-03 14:01:52 10.40.87.82 GET /certsrv/mscep/mscep.dll/pkiclient.exe operation=GetCACaps 80 - 105.165.69.22 - - 200 0 0 177 2022-04-03 14:01:53 10.40.87.82 POST /certsrv/mscep/mscep.dll/pkiclient.exe operation=PKIOperation 80 - 105.165.69.22 - - 200 0 0 566 2022-04-03 15:01:28 10.40.87.82 GET /certsrv/mscep_admin - 80 - 105.165.69.22 Wget/1.20.3+(linux-gnu) - 401 2 5 177 2022-04-03 15:01:28 10.40.87.82 GET /certsrv/mscep_admin - 80 na\sra_mdm_certgen 105.165.69.22 Wget/1.20.3+(linux-gnu) - 301 0 0 178 2022-04-03 15:01:29 10.40.87.82 GET /certsrv/mscep_admin/ - 80 na\sra_mdm_certgen 105.165.69.22 Wget/1.20.3+(linux-gnu) - 200 0 0 1169 2022-04-03 15:01:30 10.40.87.82 GET /certsrv/mscep/mscep.dll/pkiclient.exe operation=GetCACaps 80 - 105.165.69.22 - - 200 0 0 217 2022-04-03 15:01:30 10.40.87.82 GET /certsrv/mscep/mscep.dll/pkiclient.exe operation=GetCACert&message=CAIdentifier 80 - 105.165.69.22 - - 200 0 0 177 2022-04-03 15:01:31 10.40.87.82 GET /certsrv/mscep/mscep.dll/pkiclient.exe operation=GetCACaps 80 - 105.165.69.22 - - 200 0 0 176 2022-04-03 15:01:31 10.40.87.82 POST /certsrv/mscep/mscep.dll/pkiclient.exe operation=PKIOperation 80 - 105.165.69.22 - - 200 0 0 564 2022-04-03 16:01:14 10.40.87.82 GET /certsrv/mscep_admin - 80 - 105.165.69.22 Wget/1.20.3+(linux-gnu) - 401 2 5 178 2022-04-03 16:01:14 10.40.87.82 GET /certsrv/mscep_admin - 80 na\sra_mdm_certgen 105.165.69.22 Wget/1.20.3+(linux-gnu) - 301 0 0 178 2022-04-03 16:01:16 10.40.87.82 GET /certsrv/mscep_admin/ - 80 na\sra_mdm_certgen 105.165.69.22 Wget/1.20.3+(linux-gnu) - 200 0 0 731 2022-04-03 16:01:16 10.40.87.82 GET /certsrv/mscep/mscep.dll/pkiclient.exe operation=GetCACaps 80 - 105.165.69.22 - - 200 0 0 176 2022-04-03 16:01:16 10.40.87.82 GET /certsrv/mscep/mscep.dll/pkiclient.exe operation=GetCACert&message=CAIdentifier 80 - 105.165.69.22 - - 200 0 0 176 2022-04-03 16:01:17 10.40.87.82 GET /certsrv/mscep/mscep.dll/pkiclient.exe operation=GetCACaps 80 - 105.165.69.22 - - 200 0 0 175 2022-04-03 16:01:18 10.40.87.82 POST /certsrv/mscep/mscep.dll/pkiclient.exe operation=PKIOperation 80 - 105.165.69.22 - - 200 0 0 761 2022-04-03 17:01:02 10.40.87.82 GET /certsrv/mscep_admin - 80 - 105.165.69.22 Wget/1.20.3+(linux-gnu) - 401 2 5 177 2022-04-03 17:01:02 10.40.87.82 GET /certsrv/mscep_admin - 80 na\sra_mdm_certgen 105.165.69.22 Wget/1.20.3+(linux-gnu) - 301 0 0 184 2022-04-03 17:01:03 10.40.87.82 GET /certsrv/mscep_admin/ - 80 na\sra_mdm_certgen 105.165.69.22 Wget/1.20.3+(linux-gnu) - 200 0 0 714 2022-04-03 17:01:03 10.40.87.82 GET /certsrv/mscep/mscep.dll/pkiclient.exe operation=GetCACaps 80 - 105.165.69.22 - - 200 0 0 176 2022-04-03 17:01:04 10.40.87.82 GET /certsrv/mscep/mscep.dll/pkiclient.exe operation=GetCACert&message=CAIdentifier 80 - 105.165.69.22 - - 200 0 0 177 2022-04-03 17:01:04 10.40.87.82 GET /certsrv/mscep/mscep.dll/pkiclient.exe operation=GetCACaps 80 - 105.165.69.22 - - 200 0 0 176 2022-04-03 17:01:05 10.40.87.82 POST /certsrv/mscep/mscep.dll/pkiclient.exe operation=PKIOperation 80 - 105.165.69.22 - - 200 0 0 568 2022-04-03 18:00:48 10.40.87.82 GET /certsrv/mscep_admin - 80 - 105.165.69.22 Wget/1.20.3+(linux-gnu) - 401 2 5 179 2022-04-03 18:00:50 10.40.87.82 GET /certsrv/mscep_admin - 80 na\sra_mdm_certgen 105.165.69.22 Wget/1.20.3+(linux-gnu) - 301 0 0 180 2022-04-03 18:00:50 10.40.87.82 GET /certsrv/mscep_admin/ - 80 na\sra_mdm_certgen 105.165.69.22 Wget/1.20.3+(linux-gnu) - 200 0 0 724 2022-04-03 18:00:51 10.40.87.82 GET /certsrv/mscep/mscep.dll/pkiclient.exe operation=GetCACaps 80 - 105.165.69.22 - - 200 0 0 176 2022-04-03 18:00:51 10.40.87.82 GET /certsrv/mscep/mscep.dll/pkiclient.exe operation=GetCACert&message=CAIdentifier 80 - 105.165.69.22 - - 200 0 0 177 2022-04-03 18:00:51 10.40.87.82 GET /certsrv/mscep/mscep.dll/pkiclient.exe operation=GetCACaps 80 - 105.165.69.22 - - 200 0 0 176 2022-04-03 18:00:52 10.40.87.82 POST /certsrv/mscep/mscep.dll/pkiclient.exe operation=PKIOperation 80 - 105.165.69.22 - - 200 0 0 565 2022-04-03 19:01:45 10.40.87.82 GET /certsrv/mscep_admin - 80 - 105.165.69.22 Wget/1.20.3+(linux-gnu) - 401 2 5 176 2022-04-03 19:01:45 10.40.87.82 GET /certsrv/mscep_admin - 80 na\sra_mdm_certgen 105.165.69.22 Wget/1.20.3+(linux-gnu) - 301 0 0 180 2022-04-03 19:01:46 10.40.87.82 GET /certsrv/mscep_admin/ - 80 na\sra_mdm_certgen 105.165.69.22 Wget/1.20.3+(linux-gnu) - 200 0 0 725 2022-04-03 19:01:46 10.40.87.82 GET /certsrv/mscep/mscep.dll/pkiclient.exe operation=GetCACaps 80 - 105.165.69.22 - - 200 0 0 176 2022-04-03 19:01:46 10.40.87.82 GET /certsrv/mscep/mscep.dll/pkiclient.exe operation=GetCACert&message=CAIdentifier 80 - 105.165.69.22 - - 200 0 0 176 2022-04-03 19:01:47 10.40.87.82 GET /certsrv/mscep/mscep.dll/pkiclient.exe operation=GetCACaps 80 - 105.165.69.22 - - 200 0 0 176 2022-04-03 19:01:48 10.40.87.82 POST /certsrv/mscep/mscep.dll/pkiclient.exe operation=PKIOperation 80 - 105.165.69.22 - - 200 0 0 566 2022-04-03 20:01:23 10.40.87.82 GET /certsrv/mscep_admin - 80 - 105.165.69.22 Wget/1.20.3+(linux-gnu) - 401 2 5 176 2022-04-03 20:01:24 10.40.87.82 GET /certsrv/mscep_admin - 80 na\sra_mdm_certgen 105.165.69.22 Wget/1.20.3+(linux-gnu) - 301 0 0 183 2022-04-03 20:01:24 10.40.87.82 GET /certsrv/mscep_admin/ - 80 na\sra_mdm_certgen 105.165.69.22 Wget/1.20.3+(linux-gnu) - 200 0 0 741 2022-04-03 20:01:25 10.40.87.82 GET /certsrv/mscep/mscep.dll/pkiclient.exe operation=GetCACaps 80 - 105.165.69.22 - - 200 0 0 175 2022-04-03 20:01:25 10.40.87.82 GET /certsrv/mscep/mscep.dll/pkiclient.exe operation=GetCACert&message=CAIdentifier 80 - 105.165.69.22 - - 200 0 0 176 2022-04-03 20:01:25 10.40.87.82 GET /certsrv/mscep/mscep.dll/pkiclient.exe operation=GetCACaps 80 - 105.165.69.22 - - 200 0 0 176 2022-04-03 20:01:26 10.40.87.82 POST /certsrv/mscep/mscep.dll/pkiclient.exe operation=PKIOperation 80 - 105.165.69.22 - - 200 0 0 566 2022-04-03 21:01:10 10.40.87.82 GET /certsrv/mscep_admin - 80 - 105.165.69.22 Wget/1.20.3+(linux-gnu) - 401 2 5 176 2022-04-03 21:01:10 10.40.87.82 GET /certsrv/mscep_admin - 80 na\sra_mdm_certgen 105.165.69.22 Wget/1.20.3+(linux-gnu) - 301 0 0 179 2022-04-03 21:01:12 10.40.87.82 GET /certsrv/mscep_admin/ - 80 na\sra_mdm_certgen 105.165.69.22 Wget/1.20.3+(linux-gnu) - 200 0 0 730 2022-04-03 21:01:12 10.40.87.82 GET /certsrv/mscep/mscep.dll/pkiclient.exe operation=GetCACaps 80 - 105.165.69.22 - - 200 0 0 176 2022-04-03 21:01:12 10.40.87.82 GET /certsrv/mscep/mscep.dll/pkiclient.exe operation=GetCACert&message=CAIdentifier 80 - 105.165.69.22 - - 200 0 0 177 2022-04-03 21:01:13 10.40.87.82 GET /certsrv/mscep/mscep.dll/pkiclient.exe operation=GetCACaps 80 - 105.165.69.22 - - 200 0 0 176 2022-04-03 21:01:13 10.40.87.82 POST /certsrv/mscep/mscep.dll/pkiclient.exe operation=PKIOperation 80 - 105.165.69.22 - - 200 0 0 579 2022-04-03 22:00:58 10.40.87.82 GET /certsrv/mscep_admin - 80 - 105.165.69.22 Wget/1.20.3+(linux-gnu) - 401 2 5 177 2022-04-03 22:00:58 10.40.87.82 GET /certsrv/mscep_admin - 80 na\sra_mdm_certgen 105.165.69.22 Wget/1.20.3+(linux-gnu) - 301 0 0 180 2022-04-03 22:01:01 10.40.87.82 GET /certsrv/mscep_admin/ - 80 na\sra_mdm_certgen 105.165.69.22 Wget/1.20.3+(linux-gnu) - 200 0 0 3850 2022-04-03 22:01:03 10.40.87.82 GET /certsrv/mscep/mscep.dll/pkiclient.exe operation=GetCACaps 80 - 105.165.69.22 - - 200 0 0 176 2022-04-03 22:01:03 10.40.87.82 GET /certsrv/mscep/mscep.dll/pkiclient.exe operation=GetCACert&message=CAIdentifier 80 - 105.165.69.22 - - 200 0 0 176 2022-04-03 22:01:04 10.40.87.82 GET /certsrv/mscep/mscep.dll/pkiclient.exe operation=GetCACaps 80 - 105.165.69.22 - - 200 0 0 527 2022-04-03 22:01:04 10.40.87.82 POST /certsrv/mscep/mscep.dll/pkiclient.exe operation=PKIOperation 80 - 105.165.69.22 - - 200 0 0 570 2022-04-03 23:01:44 10.40.87.82 GET /certsrv/mscep_admin - 80 - 105.165.69.22 Wget/1.20.3+(linux-gnu) - 401 2 5 177 2022-04-03 23:01:46 10.40.87.82 GET /certsrv/mscep_admin - 80 na\sra_mdm_certgen 105.165.69.22 Wget/1.20.3+(linux-gnu) - 301 0 0 179 2022-04-03 23:01:46 10.40.87.82 GET /certsrv/mscep_admin/ - 80 na\sra_mdm_certgen 105.165.69.22 Wget/1.20.3+(linux-gnu) - 200 0 0 734 2022-04-03 23:01:47 10.40.87.82 GET /certsrv/mscep/mscep.dll/pkiclient.exe operation=GetCACaps 80 - 105.165.69.22 - - 200 0 0 177 2022-04-03 23:01:47 10.40.87.82 GET /certsrv/mscep/mscep.dll/pkiclient.exe operation=GetCACert&message=CAIdentifier 80 - 105.165.69.22 - - 200 0 0 377 2022-04-03 23:01:48 10.40.87.82 GET /certsrv/mscep/mscep.dll/pkiclient.exe operation=GetCACaps 80 - 105.165.69.22 - - 200 0 0 176 2022-04-03 23:01:48 10.40.87.82 POST /certsrv/mscep/mscep.dll/pkiclient.exe operation=PKIOperation 80 - 105.165.69.22 - - 200 0 0 572

#Software: Microsoft Internet Information Services 10.0 -- 2022-04-03 00:01:42 10.40.87.82 GET /certsrv/mscep_admin - 80 - 105.165.69.22 Wget/1.20.3+(linux-gnu) - 401 2 5 175 2022-04-03 00:01:42 10.40.87.82 GET /certsrv/mscep_admin - 80 na\sra_mdm_certgen 105.165.69.22 Wget/1.20.3+(linux-gnu) - 301 0 0 180 2022-04-03 00:01:44 10.40.87.82 GET /certsrv/mscep_admin/ - 80 na\sra_mdm_certgen 105.165.69.22 Wget/1.20.3+(linux-gnu) - 200 0 0 731 2022-04-03 00:01:44 10.40.87.82 GET /certsrv/mscep/mscep.dll/pkiclient.exe operation=GetCACaps 80 - 105.165.69.22 - - 200 0 0 229 2022-04-03 00:01:44 10.40.87.82 GET /certsrv/mscep/mscep.dll/pkiclient.exe operation=GetCACert&message=CAIdentifier 80 - 105.165.69.22 - - 200 0 0 177 2022-04-03 00:01:45 10.40.87.82 GET /certsrv/mscep/mscep.dll/pkiclient.exe operation=GetCACaps 80 - 105.165.69.22 - - 200 0 0 174 2022-04-03 00:01:45 10.40.87.82 POST /certsrv/mscep/mscep.dll/pkiclient.exe operation=PKIOperation 80 - 105.165.69.22 - - 200 0 0 565 2022-04-03 01:01:29 10.40.87.82 GET /certsrv/mscep_admin - 80 - 105.165.69.22 Wget/1.20.3+(linux-gnu) - 401 2 5 178 2022-04-03 01:01:30 10.40.87.82 GET /certsrv/mscep_admin - 80 na\sra_mdm_certgen 105.165.69.22 Wget/1.20.3+(linux-gnu) - 301 0 0 179 2022-04-03 01:01:30 10.40.87.82 GET /certsrv/mscep_admin/ - 80 na\sra_mdm_certgen 105.165.69.22 Wget/1.20.3+(linux-gnu) - 200 0 0 714 2022-04-03 01:01:31 10.40.87.82 GET /certsrv/mscep/mscep.dll/pkiclient.exe operation=GetCACaps 80 - 105.165.69.22 - - 200 0 0 175 2022-04-03 01:01:31 10.40.87.82 GET /certsrv/mscep/mscep.dll/pkiclient.exe operation=GetCACert&message=CAIdentifier 80 - 105.165.69.22 - - 200 0 0 177 2022-04-03 01:01:31 10.40.87.82 GET /certsrv/mscep/mscep.dll/pkiclient.exe operation=GetCACaps 80 - 105.165.69.22 - - 200 0 0 176 2022-04-03 01:01:33 10.40.87.82 POST /certsrv/mscep/mscep.dll/pkiclient.exe operation=PKIOperation 80 - 105.165.69.22 - - 200 0 0 572 2022-04-03 02:01:17 10.40.87.82 GET /certsrv/mscep_admin - 80 - 105.165.69.22 Wget/1.20.3+(linux-gnu) - 401 2 5 177 2022-04-03 02:01:17 10.40.87.82 GET /certsrv/mscep_admin - 80 na\sra_mdm_certgen 105.165.69.22 Wget/1.20.3+(linux-gnu) - 301 0 0 179 2022-04-03 02:01:18 10.40.87.82 GET /certsrv/mscep_admin/ - 80 na\sra_mdm_certgen 105.165.69.22 Wget/1.20.3+(linux-gnu) - 200 0 0 724 2022-04-03 02:01:18 10.40.87.82 GET /certsrv/mscep/mscep.dll/pkiclient.exe operation=GetCACaps 80 - 105.165.69.22 - - 200 0 0 176 2022-04-03 02:01:19 10.40.87.82 GET /certsrv/mscep/mscep.dll/pkiclient.exe operation=GetCACert&message=CAIdentifier 80 - 105.165.69.22 - - 200 0 0 176 2022-04-03 02:01:19 10.40.87.82 GET /certsrv/mscep/mscep.dll/pkiclient.exe operation=GetCACaps 80 - 105.165.69.22 - - 200 0 0 175 2022-04-03 02:01:20 10.40.87.82 POST /certsrv/mscep/mscep.dll/pkiclient.exe operation=PKIOperation 80 - 105.165.69.22 - - 200 0 0 565 2022-04-03 03:01:04 10.40.87.82 GET /certsrv/mscep_admin - 80 - 105.165.69.22 Wget/1.20.3+(linux-gnu) - 401 2 5 177 2022-04-03 03:01:04 10.40.87.82 GET /certsrv/mscep_admin - 80 na\sra_mdm_certgen 105.165.69.22 Wget/1.20.3+(linux-gnu) - 301 0 0 180 2022-04-03 03:01:05 10.40.87.82 GET /certsrv/mscep_admin/ - 80 na\sra_mdm_certgen 105.165.69.22 Wget/1.20.3+(linux-gnu) - 200 0 0 756 2022-04-03 03:01:05 10.40.87.82 GET /certsrv/mscep/mscep.dll/pkiclient.exe operation=GetCACaps 80 - 105.165.69.22 - - 200 0 0 176 2022-04-03 03:01:05 10.40.87.82 GET /certsrv/mscep/mscep.dll/pkiclient.exe operation=GetCACert&message=CAIdentifier 80 - 105.165.69.22 - - 200 0 0 177 2022-04-03 03:01:06 10.40.87.82 GET /certsrv/mscep/mscep.dll/pkiclient.exe operation=GetCACaps 80 - 105.165.69.22 - - 200 0 0 176 2022-04-03 03:01:07 10.40.87.82 POST /certsrv/mscep/mscep.dll/pkiclient.exe operation=PKIOperation 80 - 105.165.69.22 - - 200 0 0 610 2022-04-03 04:00:59 10.40.87.82 GET /certsrv/mscep_admin - 80 - 105.165.69.22 Wget/1.20.3+(linux-gnu) - 401 2 5 177 2022-04-03 04:00:59 10.40.87.82 GET /certsrv/mscep_admin - 80 na\sra_mdm_certgen 105.165.69.22 Wget/1.20.3+(linux-gnu) - 301 0 0 179 2022-04-03 04:01:02 10.40.87.82 GET /certsrv/mscep_admin/ - 80 na\sra_mdm_certgen 105.165.69.22 Wget/1.20.3+(linux-gnu) - 200 0 0 2259 2022-04-03 04:01:02 10.40.87.82 GET /certsrv/mscep/mscep.dll/pkiclient.exe operation=GetCACaps 80 - 105.165.69.22 - - 200 0 0 206 2022-04-03 04:01:03 10.40.87.82 GET /certsrv/mscep/mscep.dll/pkiclient.exe operation=GetCACert&message=CAIdentifier 80 - 105.165.69.22 - - 200 0 0 481 2022-04-03 04:01:03 10.40.87.82 GET /certsrv/mscep/mscep.dll/pkiclient.exe operation=GetCACaps 80 - 105.165.69.22 - - 200 0 0 365 2022-04-03 04:01:04 10.40.87.82 POST /certsrv/mscep/mscep.dll/pkiclient.exe operation=PKIOperation 80 - 105.165.69.22 - - 200 0 0 568 2022-04-03 05:01:38 10.40.87.82 GET /certsrv/mscep_admin - 80 - 105.165.69.22 Wget/1.20.3+(linux-gnu) - 401 2 5 177 2022-04-03 05:01:38 10.40.87.82 GET /certsrv/mscep_admin - 80 na\sra_mdm_certgen 105.165.69.22 Wget/1.20.3+(linux-gnu) - 301 0 0 180 2022-04-03 05:01:39 10.40.87.82 GET /certsrv/mscep_admin/ - 80 na\sra_mdm_certgen 105.165.69.22 Wget/1.20.3+(linux-gnu) - 200 0 0 714 2022-04-03 05:01:40 10.40.87.82 GET /certsrv/mscep/mscep.dll/pkiclient.exe operation=GetCACaps 80 - 105.165.69.22 - - 200 0 0 519 2022-04-03 05:01:40 10.40.87.82 GET /certsrv/mscep/mscep.dll/pkiclient.exe operation=GetCACert&message=CAIdentifier 80 - 105.165.69.22 - - 200 0 0 444 2022-04-03 05:01:41 10.40.87.82 GET /certsrv/mscep/mscep.dll/pkiclient.exe operation=GetCACaps 80 - 105.165.69.22 - - 200 0 0 176 2022-04-03 05:01:41 10.40.87.82 POST /certsrv/mscep/mscep.dll/pkiclient.exe operation=PKIOperation 80 - 105.165.69.22 - - 200 0 0 565 2022-04-03 06:01:24 10.40.87.82 GET /certsrv/mscep_admin - 80 - 105.165.69.22 Wget/1.20.3+(linux-gnu) - 401 2 5 176 2022-04-03 06:01:24 10.40.87.82 GET /certsrv/mscep_admin - 80 na\sra_mdm_certgen 105.165.69.22 Wget/1.20.3+(linux-gnu) - 301 0 0 179 2022-04-03 06:01:25 10.40.87.82 GET /certsrv/mscep_admin/ - 80 na\sra_mdm_certgen 105.165.69.22 Wget/1.20.3+(linux-gnu) - 200 0 0 717 2022-04-03 06:01:25 10.40.87.82 GET /certsrv/mscep/mscep.dll/pkiclient.exe operation=GetCACaps 80 - 105.165.69.22 - - 200 0 0 173 2022-04-03 06:01:25 10.40.87.82 GET /certsrv/mscep/mscep.dll/pkiclient.exe operation=GetCACert&message=CAIdentifier 80 - 105.165.69.22 - - 200 0 0 179 2022-04-03 06:01:27 10.40.87.82 GET /certsrv/mscep/mscep.dll/pkiclient.exe operation=GetCACaps 80 - 105.165.69.22 - - 200 0 0 177 2022-04-03 06:01:27 10.40.87.82 POST /certsrv/mscep/mscep.dll/pkiclient.exe operation=PKIOperation 80 - 105.165.69.22 - - 200 0 0 567 2022-04-03 07:01:11 10.40.87.82 GET /certsrv/mscep_admin - 80 - 105.165.69.22 Wget/1.20.3+(linux-gnu) - 401 2 5 176 2022-04-03 07:01:11 10.40.87.82 GET /certsrv/mscep_admin - 80 na\sra_mdm_certgen 105.165.69.22 Wget/1.20.3+(linux-gnu) - 301 0 0 179 2022-04-03 07:01:13 10.40.87.82 GET /certsrv/mscep_admin/ - 80 na\sra_mdm_certgen 105.165.69.22 Wget/1.20.3+(linux-gnu) - 200 0 0 712 2022-04-03 07:01:13 10.40.87.82 GET /certsrv/mscep/mscep.dll/pkiclient.exe operation=GetCACaps 80 - 105.165.69.22 - - 200 0 0 175 2022-04-03 07:01:13 10.40.87.82 GET /certsrv/mscep/mscep.dll/pkiclient.exe operation=GetCACert&message=CAIdentifier 80 - 105.165.69.22 - - 200 0 0 177 2022-04-03 07:01:14 10.40.87.82 GET /certsrv/mscep/mscep.dll/pkiclient.exe operation=GetCACaps 80 - 105.165.69.22 - - 200 0 0 178 2022-04-03 07:01:14 10.40.87.82 POST /certsrv/mscep/mscep.dll/pkiclient.exe operation=PKIOperation 80 - 105.165.69.22 - - 200 0 0 566 2022-04-03 08:01:01 10.40.87.82 GET /certsrv/mscep_admin - 80 - 105.165.69.22 Wget/1.20.3+(linux-gnu) - 401 2 5 175 2022-04-03 08:01:02 10.40.87.82 GET /certsrv/mscep_admin - 80 na\sra_mdm_certgen 105.165.69.22 Wget/1.20.3+(linux-gnu) - 301 0 0 179 2022-04-03 08:01:02 10.40.87.82 GET /certsrv/mscep_admin/ - 80 na\sra_mdm_certgen 105.165.69.22 Wget/1.20.3+(linux-gnu) - 200 0 0 711 2022-04-03 08:01:04 10.40.87.82 GET /certsrv/mscep/mscep.dll/pkiclient.exe operation=GetCACaps 80 - 105.165.69.22 - - 200 0 0 175 2022-04-03 08:01:04 10.40.87.82 GET /certsrv/mscep/mscep.dll/pkiclient.exe operation=GetCACert&message=CAIdentifier 80 - 105.165.69.22 - - 200 0 0 177 2022-04-03 08:01:05 10.40.87.82 GET /certsrv/mscep/mscep.dll/pkiclient.exe operation=GetCACaps 80 - 105.165.69.22 - - 200 0 0 175 2022-04-03 08:01:05 10.40.87.82 POST /certsrv/mscep/mscep.dll/pkiclient.exe operation=PKIOperation 80 - 105.165.69.22 - - 200 0 0 571 2022-04-03 09:01:51 10.40.87.82 GET /certsrv/mscep_admin - 80 - 105.165.69.22 Wget/1.20.3+(linux-gnu) - 401 2 5 177 2022-04-03 09:01:52 10.40.87.82 GET /certsrv/mscep_admin - 80 na\sra_mdm_certgen 105.165.69.22 Wget/1.20.3+(linux-gnu) - 301 0 0 179 2022-04-03 09:01:52 10.40.87.82 GET /certsrv/mscep_admin/ - 80 na\sra_mdm_certgen 105.165.69.22 Wget/1.20.3+(linux-gnu) - 200 0 0 714 2022-04-03 09:01:53 10.40.87.82 GET /certsrv/mscep/mscep.dll/pkiclient.exe operation=GetCACaps 80 - 105.165.69.22 - - 200 0 0 176 2022-04-03 09:01:53 10.40.87.82 GET /certsrv/mscep/mscep.dll/pkiclient.exe operation=GetCACert&message=CAIdentifier 80 - 105.165.69.22 - - 200 0 0 177 2022-04-03 09:01:53 10.40.87.82 GET /certsrv/mscep/mscep.dll/pkiclient.exe operation=GetCACaps 80 - 105.165.69.22 - - 200 0 0 176 2022-04-03 09:01:55 10.40.87.82 POST /certsrv/mscep/mscep.dll/pkiclient.exe operation=PKIOperation 80 - 105.165.69.22 - - 200 0 0 572 2022-04-03 10:01:32 10.40.87.82 GET /certsrv/mscep_admin - 80 - 105.165.69.22 Wget/1.20.3+(linux-gnu) - 401 2 5 176 2022-04-03 10:01:32 10.40.87.82 GET /certsrv/mscep_admin - 80 na\sra_mdm_certgen 105.165.69.22 Wget/1.20.3+(linux-gnu) - 301 0 0 179 2022-04-03 10:01:34 10.40.87.82 GET /certsrv/mscep_admin/ - 80 na\sra_mdm_certgen 105.165.69.22 Wget/1.20.3+(linux-gnu) - 200 0 0 713 2022-04-03 10:01:34 10.40.87.82 GET /certsrv/mscep/mscep.dll/pkiclient.exe operation=GetCACaps 80 - 105.165.69.22 - - 200 0 0 176 2022-04-03 10:01:35 10.40.87.82 GET /certsrv/mscep/mscep.dll/pkiclient.exe operation=GetCACert&message=CAIdentifier 80 - 105.165.69.22 - - 200 0 0 177 2022-04-03 10:01:35 10.40.87.82 GET /certsrv/mscep/mscep.dll/pkiclient.exe operation=GetCACaps 80 - 105.165.69.22 - - 200 0 0 176 2022-04-03 10:01:36 10.40.87.82 POST /certsrv/mscep/mscep.dll/pkiclient.exe operation=PKIOperation 80 - 105.165.69.22 - - 200 0 0 568 2022-04-03 11:01:20 10.40.87.82 GET /certsrv/mscep_admin - 80 - 105.165.69.22 Wget/1.20.3+(linux-gnu) - 401 2 5 177 2022-04-03 11:01:20 10.40.87.82 GET /certsrv/mscep_admin - 80 na\sra_mdm_certgen 105.165.69.22 Wget/1.20.3+(linux-gnu) - 301 0 0 181 2022-04-03 11:01:21 10.40.87.82 GET /certsrv/mscep_admin/ - 80 na\sra_mdm_certgen 105.165.69.22 Wget/1.20.3+(linux-gnu) - 200 0 0 726 2022-04-03 11:01:21 10.40.87.82 GET /certsrv/mscep/mscep.dll/pkiclient.exe operation=GetCACaps 80 - 105.165.69.22 - - 200 0 0 177 2022-04-03 11:01:22 10.40.87.82 GET /certsrv/mscep/mscep.dll/pkiclient.exe operation=GetCACert&message=CAIdentifier 80 - 105.165.69.22 - - 200 0 0 177 2022-04-03 11:01:22 10.40.87.82 GET /certsrv/mscep/mscep.dll/pkiclient.exe operation=GetCACaps 80 - 105.165.69.22 - - 200 0 0 176 2022-04-03 11:01:23 10.40.87.82 POST /certsrv/mscep/mscep.dll/pkiclient.exe operation=PKIOperation 80 - 105.165.69.22 - - 200 0 0 569 2022-04-03 12:01:07 10.40.87.82 GET /certsrv/mscep_admin - 80 - 105.165.69.22 Wget/1.20.3+(linux-gnu) - 401 2 5 176 2022-04-03 12:01:07 10.40.87.82 GET /certsrv/mscep_admin - 80 na\sra_mdm_certgen 105.165.69.22 Wget/1.20.3+(linux-gnu) - 301 0 0 181 2022-04-03 12:01:08 10.40.87.82 GET /certsrv/mscep_admin/ - 80 na\sra_mdm_certgen 105.165.69.22 Wget/1.20.3+(linux-gnu) - 200 0 0 722 2022-04-03 12:01:08 10.40.87.82 GET /certsrv/mscep/mscep.dll/pkiclient.exe operation=GetCACaps 80 - 105.165.69.22 - - 200 0 0 176 2022-04-03 12:01:09 10.40.87.82 GET /certsrv/mscep/mscep.dll/pkiclient.exe operation=GetCACert&message=CAIdentifier 80 - 105.165.69.22 - - 200 0 0 176 2022-04-03 12:01:09 10.40.87.82 GET /certsrv/mscep/mscep.dll/pkiclient.exe operation=GetCACaps 80 - 105.165.69.22 - - 200 0 0 176 2022-04-03 12:01:10 10.40.87.82 POST /certsrv/mscep/mscep.dll/pkiclient.exe operation=PKIOperation 80 - 105.165.69.22 - - 200 0 0 571 2022-04-03 13:00:53 10.40.87.82 GET /certsrv/mscep_admin - 80 - 105.165.69.22 Wget/1.20.3+(linux-gnu) - 401 2 5 180 2022-04-03 13:00:53 10.40.87.82 GET /certsrv/mscep_admin - 80 na\sra_mdm_certgen 105.165.69.22 Wget/1.20.3+(linux-gnu) - 301 0 0 179 2022-04-03 13:00:55 10.40.87.82 GET /certsrv/mscep_admin/ - 80 na\sra_mdm_certgen 105.165.69.22 Wget/1.20.3+(linux-gnu) - 200 0 0 717 2022-04-03 13:00:56 10.40.87.82 GET /certsrv/mscep/mscep.dll/pkiclient.exe operation=GetCACaps 80 - 105.165.69.22 - - 200 0 0 179 2022-04-03 13:00:56 10.40.87.82 GET /certsrv/mscep/mscep.dll/pkiclient.exe operation=GetCACert&message=CAIdentifier 80 - 105.165.69.22 - - 200 0 0 177 2022-04-03 13:00:56 10.40.87.82 GET /certsrv/mscep/mscep.dll/pkiclient.exe operation=GetCACaps 80 - 105.165.69.22 - - 200 0 0 176 2022-04-03 13:00:57 10.40.87.82 POST /certsrv/mscep/mscep.dll/pkiclient.exe operation=PKIOperation 80 - 105.165.69.22 - - 200 0 0 567 2022-04-03 14:01:49 10.40.87.82 GET /certsrv/mscep_admin - 80 - 105.165.69.22 Wget/1.20.3+(linux-gnu) - 401 2 5 177 2022-04-03 14:01:49 10.40.87.82 GET /certsrv/mscep_admin - 80 na\sra_mdm_certgen 105.165.69.22 Wget/1.20.3+(linux-gnu) - 301 0 0 179 2022-04-03 14:01:50 10.40.87.82 GET /certsrv/mscep_admin/ - 80 na\sra_mdm_certgen 105.165.69.22 Wget/1.20.3+(linux-gnu) - 200 0 0 730 2022-04-03 14:01:50 10.40.87.82 GET /certsrv/mscep/mscep.dll/pkiclient.exe operation=GetCACaps 80 - 105.165.69.22 - - 200 0 0 176 2022-04-03 14:01:50 10.40.87.82 GET /certsrv/mscep/mscep.dll/pkiclient.exe operation=GetCACert&message=CAIdentifier 80 - 105.165.69.22 - - 200 0 0 177 2022-04-03 14:01:52 10.40.87.82 GET /certsrv/mscep/mscep.dll/pkiclient.exe operation=GetCACaps 80 - 105.165.69.22 - - 200 0 0 177 2022-04-03 14:01:53 10.40.87.82 POST /certsrv/mscep/mscep.dll/pkiclient.exe operation=PKIOperation 80 - 105.165.69.22 - - 200 0 0 566 2022-04-03 15:01:28 10.40.87.82 GET /certsrv/mscep_admin - 80 - 105.165.69.22 Wget/1.20.3+(linux-gnu) - 401 2 5 177 2022-04-03 15:01:28 10.40.87.82 GET /certsrv/mscep_admin - 80 na\sra_mdm_certgen 105.165.69.22 Wget/1.20.3+(linux-gnu) - 301 0 0 178 2022-04-03 15:01:29 10.40.87.82 GET /certsrv/mscep_admin/ - 80 na\sra_mdm_certgen 105.165.69.22 Wget/1.20.3+(linux-gnu) - 200 0 0 1169 2022-04-03 15:01:30 10.40.87.82 GET /certsrv/mscep/mscep.dll/pkiclient.exe operation=GetCACaps 80 - 105.165.69.22 - - 200 0 0 217 2022-04-03 15:01:30 10.40.87.82 GET /certsrv/mscep/mscep.dll/pkiclient.exe operation=GetCACert&message=CAIdentifier 80 - 105.165.69.22 - - 200 0 0 177 2022-04-03 15:01:31 10.40.87.82 GET /certsrv/mscep/mscep.dll/pkiclient.exe operation=GetCACaps 80 - 105.165.69.22 - - 200 0 0 176 2022-04-03 15:01:31 10.40.87.82 POST /certsrv/mscep/mscep.dll/pkiclient.exe operation=PKIOperation 80 - 105.165.69.22 - - 200 0 0 564 2022-04-03 16:01:14 10.40.87.82 GET /certsrv/mscep_admin - 80 - 105.165.69.22 Wget/1.20.3+(linux-gnu) - 401 2 5 178 2022-04-03 16:01:14 10.40.87.82 GET /certsrv/mscep_admin - 80 na\sra_mdm_certgen 105.165.69.22 Wget/1.20.3+(linux-gnu) - 301 0 0 178 2022-04-03 16:01:16 10.40.87.82 GET /certsrv/mscep_admin/ - 80 na\sra_mdm_certgen 105.165.69.22 Wget/1.20.3+(linux-gnu) - 200 0 0 731 2022-04-03 16:01:16 10.40.87.82 GET /certsrv/mscep/mscep.dll/pkiclient.exe operation=GetCACaps 80 - 105.165.69.22 - - 200 0 0 176 2022-04-03 16:01:16 10.40.87.82 GET /certsrv/mscep/mscep.dll/pkiclient.exe operation=GetCACert&message=CAIdentifier 80 - 105.165.69.22 - - 200 0 0 176 2022-04-03 16:01:17 10.40.87.82 GET /certsrv/mscep/mscep.dll/pkiclient.exe operation=GetCACaps 80 - 105.165.69.22 - - 200 0 0 175 2022-04-03 16:01:18 10.40.87.82 POST /certsrv/mscep/mscep.dll/pkiclient.exe operation=PKIOperation 80 - 105.165.69.22 - - 200 0 0 761 2022-04-03 17:01:02 10.40.87.82 GET /certsrv/mscep_admin - 80 - 105.165.69.22 Wget/1.20.3+(linux-gnu) - 401 2 5 177 2022-04-03 17:01:02 10.40.87.82 GET /certsrv/mscep_admin - 80 na\sra_mdm_certgen 105.165.69.22 Wget/1.20.3+(linux-gnu) - 301 0 0 184 2022-04-03 17:01:03 10.40.87.82 GET /certsrv/mscep_admin/ - 80 na\sra_mdm_certgen 105.165.69.22 Wget/1.20.3+(linux-gnu) - 200 0 0 714 2022-04-03 17:01:03 10.40.87.82 GET /certsrv/mscep/mscep.dll/pkiclient.exe operation=GetCACaps 80 - 105.165.69.22 - - 200 0 0 176 2022-04-03 17:01:04 10.40.87.82 GET /certsrv/mscep/mscep.dll/pkiclient.exe operation=GetCACert&message=CAIdentifier 80 - 105.165.69.22 - - 200 0 0 177 2022-04-03 17:01:04 10.40.87.82 GET /certsrv/mscep/mscep.dll/pkiclient.exe operation=GetCACaps 80 - 105.165.69.22 - - 200 0 0 176 2022-04-03 17:01:05 10.40.87.82 POST /certsrv/mscep/mscep.dll/pkiclient.exe operation=PKIOperation 80 - 105.165.69.22 - - 200 0 0 568 2022-04-03 18:00:48 10.40.87.82 GET /certsrv/mscep_admin - 80 - 105.165.69.22 Wget/1.20.3+(linux-gnu) - 401 2 5 179 2022-04-03 18:00:50 10.40.87.82 GET /certsrv/mscep_admin - 80 na\sra_mdm_certgen 105.165.69.22 Wget/1.20.3+(linux-gnu) - 301 0 0 180 2022-04-03 18:00:50 10.40.87.82 GET /certsrv/mscep_admin/ - 80 na\sra_mdm_certgen 105.165.69.22 Wget/1.20.3+(linux-gnu) - 200 0 0 724 2022-04-03 18:00:51 10.40.87.82 GET /certsrv/mscep/mscep.dll/pkiclient.exe operation=GetCACaps 80 - 105.165.69.22 - - 200 0 0 176 2022-04-03 18:00:51 10.40.87.82 GET /certsrv/mscep/mscep.dll/pkiclient.exe operation=GetCACert&message=CAIdentifier 80 - 105.165.69.22 - - 200 0 0 177 2022-04-03 18:00:51 10.40.87.82 GET /certsrv/mscep/mscep.dll/pkiclient.exe operation=GetCACaps 80 - 105.165.69.22 - - 200 0 0 176 2022-04-03 18:00:52 10.40.87.82 POST /certsrv/mscep/mscep.dll/pkiclient.exe operation=PKIOperation 80 - 105.165.69.22 - - 200 0 0 565 2022-04-03 19:01:45 10.40.87.82 GET /certsrv/mscep_admin - 80 - 105.165.69.22 Wget/1.20.3+(linux-gnu) - 401 2 5 176 2022-04-03 19:01:45 10.40.87.82 GET /certsrv/mscep_admin - 80 na\sra_mdm_certgen 105.165.69.22 Wget/1.20.3+(linux-gnu) - 301 0 0 180 2022-04-03 19:01:46 10.40.87.82 GET /certsrv/mscep_admin/ - 80 na\sra_mdm_certgen 105.165.69.22 Wget/1.20.3+(linux-gnu) - 200 0 0 725 2022-04-03 19:01:46 10.40.87.82 GET /certsrv/mscep/mscep.dll/pkiclient.exe operation=GetCACaps 80 - 105.165.69.22 - - 200 0 0 176 2022-04-03 19:01:46 10.40.87.82 GET /certsrv/mscep/mscep.dll/pkiclient.exe operation=GetCACert&message=CAIdentifier 80 - 105.165.69.22 - - 200 0 0 176 2022-04-03 19:01:47 10.40.87.82 GET /certsrv/mscep/mscep.dll/pkiclient.exe operation=GetCACaps 80 - 105.165.69.22 - - 200 0 0 176 2022-04-03 19:01:48 10.40.87.82 POST /certsrv/mscep/mscep.dll/pkiclient.exe operation=PKIOperation 80 - 105.165.69.22 - - 200 0 0 566 2022-04-03 20:01:23 10.40.87.82 GET /certsrv/mscep_admin - 80 - 105.165.69.22 Wget/1.20.3+(linux-gnu) - 401 2 5 176 2022-04-03 20:01:24 10.40.87.82 GET /certsrv/mscep_admin - 80 na\sra_mdm_certgen 105.165.69.22 Wget/1.20.3+(linux-gnu) - 301 0 0 183 2022-04-03 20:01:24 10.40.87.82 GET /certsrv/mscep_admin/ - 80 na\sra_mdm_certgen 105.165.69.22 Wget/1.20.3+(linux-gnu) - 200 0 0 741 2022-04-03 20:01:25 10.40.87.82 GET /certsrv/mscep/mscep.dll/pkiclient.exe operation=GetCACaps 80 - 105.165.69.22 - - 200 0 0 175 2022-04-03 20:01:25 10.40.87.82 GET /certsrv/mscep/mscep.dll/pkiclient.exe operation=GetCACert&message=CAIdentifier 80 - 105.165.69.22 - - 200 0 0 176 2022-04-03 20:01:25 10.40.87.82 GET /certsrv/mscep/mscep.dll/pkiclient.exe operation=GetCACaps 80 - 105.165.69.22 - - 200 0 0 176 2022-04-03 20:01:26 10.40.87.82 POST /certsrv/mscep/mscep.dll/pkiclient.exe operation=PKIOperation 80 - 105.165.69.22 - - 200 0 0 566 2022-04-03 21:01:10 10.40.87.82 GET /certsrv/mscep_admin - 80 - 105.165.69.22 Wget/1.20.3+(linux-gnu) - 401 2 5 176 2022-04-03 21:01:10 10.40.87.82 GET /certsrv/mscep_admin - 80 na\sra_mdm_certgen 105.165.69.22 Wget/1.20.3+(linux-gnu) - 301 0 0 179 2022-04-03 21:01:12 10.40.87.82 GET /certsrv/mscep_admin/ - 80 na\sra_mdm_certgen 105.165.69.22 Wget/1.20.3+(linux-gnu) - 200 0 0 730 2022-04-03 21:01:12 10.40.87.82 GET /certsrv/mscep/mscep.dll/pkiclient.exe operation=GetCACaps 80 - 105.165.69.22 - - 200 0 0 176 2022-04-03 21:01:12 10.40.87.82 GET /certsrv/mscep/mscep.dll/pkiclient.exe operation=GetCACert&message=CAIdentifier 80 - 105.165.69.22 - - 200 0 0 177 2022-04-03 21:01:13 10.40.87.82 GET /certsrv/mscep/mscep.dll/pkiclient.exe operation=GetCACaps 80 - 105.165.69.22 - - 200 0 0 176 2022-04-03 21:01:13 10.40.87.82 POST /certsrv/mscep/mscep.dll/pkiclient.exe operation=PKIOperation 80 - 105.165.69.22 - - 200 0 0 579 2022-04-03 22:00:58 10.40.87.82 GET /certsrv/mscep_admin - 80 - 105.165.69.22 Wget/1.20.3+(linux-gnu) - 401 2 5 177 2022-04-03 22:00:58 10.40.87.82 GET /certsrv/mscep_admin - 80 na\sra_mdm_certgen 105.165.69.22 Wget/1.20.3+(linux-gnu) - 301 0 0 180 2022-04-03 22:01:01 10.40.87.82 GET /certsrv/mscep_admin/ - 80 na\sra_mdm_certgen 105.165.69.22 Wget/1.20.3+(linux-gnu) - 200 0 0 3850 2022-04-03 22:01:03 10.40.87.82 GET /certsrv/mscep/mscep.dll/pkiclient.exe operation=GetCACaps 80 - 105.165.69.22 - - 200 0 0 176 2022-04-03 22:01:03 10.40.87.82 GET /certsrv/mscep/mscep.dll/pkiclient.exe operation=GetCACert&message=CAIdentifier 80 - 105.165.69.22 - - 200 0 0 176 2022-04-03 22:01:04 10.40.87.82 GET /certsrv/mscep/mscep.dll/pkiclient.exe operation=GetCACaps 80 - 105.165.69.22 - - 200 0 0 527 2022-04-03 22:01:04 10.40.87.82 POST /certsrv/mscep/mscep.dll/pkiclient.exe operation=PKIOperation 80 - 105.165.69.22 - - 200 0 0 570 2022-04-03 23:01:44 10.40.87.82 GET /certsrv/mscep_admin - 80 - 105.165.69.22 Wget/1.20.3+(linux-gnu) - 401 2 5 177 2022-04-03 23:01:46 10.40.87.82 GET /certsrv/mscep_admin - 80 na\sra_mdm_certgen 105.165.69.22 Wget/1.20.3+(linux-gnu) - 301 0 0 179 2022-04-03 23:01:46 10.40.87.82 GET /certsrv/mscep_admin/ - 80 na\sra_mdm_certgen 105.165.69.22 Wget/1.20.3+(linux-gnu) - 200 0 0 734 2022-04-03 23:01:47 10.40.87.82 GET /certsrv/mscep/mscep.dll/pkiclient.exe operation=GetCACaps 80 - 105.165.69.22 - - 200 0 0 177 2022-04-03 23:01:47 10.40.87.82 GET /certsrv/mscep/mscep.dll/pkiclient.exe operation=GetCACert&message=CAIdentifier 80 - 105.165.69.22 - - 200 0 0 377 2022-04-03 23:01:48 10.40.87.82 GET /certsrv/mscep/mscep.dll/pkiclient.exe operation=GetCACaps 80 - 105.165.69.22 - - 200 0 0 176 2022-04-03 23:01:48 10.40.87.82 POST /certsrv/mscep/mscep.dll/pkiclient.exe operation=PKIOperation 80 - 105.165.69.22 - - 200 0 0 572

ishackigozi commented 2 years ago

@gotthardp Are those logs above helpful? gotthardp

ishackigozi commented 2 years ago

Active Directory Certificate Services could not process request 2352882 due to an error: A required certificate is not within its validity period when verifying against the current system clock or the timestamp in the signed file. 0x800b0101 (-2146762495 CERT_E_EXPIRED). The request was for CN=XXXXXX.XXXXXXX, OU=XXX. Additional information: Error Verifying Request Signature or Signing Certificate

ishackigozi commented 2 years ago

@gotthardp Above are the logs. Please kindly advise.

gotthardp commented 2 years ago

What kind of advise are you expecting? The error message is pretty self-explanatory: A required certificate is not within its validity period when verifying against the current system clock or the timestamp in the signed file. I suggest you check the validity of the certificate and the date/time on the machines.

ishackigozi commented 2 years ago

I figured the issue out thank you so much. Two of the CA certs had expired.

ishackigozi commented 2 years ago

fixed

certnanny / sscep

Issue generating certs #144