0

I'm trying to issue a certificate which was generated by openssl.

$ openssl req -out vpn_certrequest.csr -key vpn_key.key -new -sha256
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:BE
State or Province Name (full name) [Some-State]:A
Locality Name (eg, city) []:MyCity
Organization Name (eg, company) [Internet Widgits Pty Ltd]:MyOrg
Organizational Unit Name (eg, section) []:
Common Name (e.g. server FQDN or YOUR name) []:My Name
Email Address []:[email protected]

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:

After going to my CA (Windows Server 2008 based, using http://localhost/certsrv/), I pick "Request a certificate", "submit an advanced certificate request" and then paste the output of cat vpn_certrequest.csr. As "Certificate Template" I pick "User" and then hit submit.

However, when I download the signed certificate, I cannot find any information back that I originally entered (such as MyCity/MyOrg/My Name). The CN ("Isseued To") is set to "Administrator".

Any idea what I'm doing wrong?

2
  • You're not doing anything wrong. The CA is free to ignore everything you entered in along with the CSR. Mar 5, 2016 at 16:00
  • @MichaelHampton: thanks for your reply. If I do the same but I select Web Server as Certificate Template, then it is respected. But with Web Server, the intended purpose is wrong. When I use Authenticated Session, the same occurs. Should I make changes to my Windows Server CA, then?
    – SaeX
    Mar 5, 2016 at 17:09

1 Answer 1

1

If you have access to the Windows CA, then double check the template that your certificate is generated from. In the template, under Subject Name, if it's marked to get details from Active Directory (instead of 'supply in the request') then it will replace any information you send with the AD details of the user submitting the request.

You may need to create another template (right click the one you're using and choose to duplicate) in order to change these settings. Once you've adjusted any settings in your duplicate template, go back to the CA console. Right click on Certificate Templates -> New -> Certificate Template to Issue. You should be able to select your duplicate in the list, hopefully.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .