In January, Microsoft released updates for Windows Server OS versions 2016, 2019, and 2022, introducing changes to the way Kerberos handles certificate-based authentication. These updates included stricter validation checks for certificates as part of Microsoft's ongoing efforts to enhance security. While SystoLOCK had anticipated these changes and ensured compliance with the announced requirements, the updates triggered an unexpected issue unrelated to the new validation scheme.

As part of the updates, Microsoft implemented changes aimed at hardening Kerberos, particularly in how it processes certificates for authentication. While these measures are critical for addressing known vulnerabilities, something probably happened along the way during the roll-out of these updates that inadvertently caused issues for certain configurations, including the specific certificate structure employed by SystoLOCK.

Historically, SystoLOCK-issued certificates left the subject field empty to prevent name escaping in certain edge cases. Instead, the user identifier was stored in the subject alternative name (SAN) attribute, which Windows had always prioritized over the empty subject. This approach ensured flexibility and compatibility in various environments while maintaining security standards. However, with the January updates, Microsoft inadvertently introduced a bug in the Kerberos subsystem.

The bug caused domain controllers to silently reject certificates with an empty subject field. Unlike prior behavior, where Windows ignored the empty subject and relied on the SAN attribute, the updated Kerberos validation logic now fails without generating an error or log entry. This silent failure created a challenging situation, as administrators received no feedback to identify the root cause.

The bug’s impact extended to SystoLOCK's implementation, disrupting the authentication process for systems relying on these certificates. Previously, this configuration had been reliable, but the new handling introduced a breaking change.

This issue caused some SystoLOCK installations to stop working on updated Windows Server systems. Affected users experienced disruptions in authentication workflows, with no clear diagnostic information to indicate why the failures were occurring. This lack of feedback added significant complexity to troubleshooting, particularly in environments where administrators had limited visibility into certificate validation processes.

The disruption primarily impacted environments where the January updates were promptly applied. As SystoLOCK had been fully functional before the update, the sudden failure left users without access to critical systems, causing operational delays and potential security concerns.

Our development team responded quickly to diagnose and mitigate the issue. After a thorough investigation, a Hotfix was developed and released to address the problem. The Hotfix updates SystoLOCK’s certificate issuance process to include a proper value in the subject field. This adjustment ensures compatibility with the new Windows validation behavior, preventing domain controllers from rejecting certificates due to an empty subject.

The updated certificate structure adheres to the new validation requirements while maintaining SystoLOCK’s commitment to security and flexibility. With this fix, authentication functionality was restored across affected environments, and users were able to resume normal operations without further disruptions.

Administrators of affected environments should immediately update their SystoLOCK installation to ensure uninterrupted authentication and resume paused Windows updates.

Please download the newest Hotfix CBA-HotFx-2.16.5053.1221 from https://systola.com/downloads/systolock and follow the instructions on Hotfix installation.

For detailed information about the January updates and their impact, refer to the following resources:

• Microsoft PAC Validation Changes
• Windows DC Hardening Update Details
• Windows Hardening Guidance