Active Directory Certificate Services is a role first made available in Windows Server 2008. Previously it was known as certificate services.
1
vote
1answer
33 views
How to setup SSL for Active Directory?
I have a Windows 2008 Server (Base2) machine.
In Server Manager > Roles, i can see:
1. Active Directory Domain Services
2. DNS Server
3. Active Directory Certificate Services.
Under Active Directory ...
0
votes
0answers
29 views
ADFS 2.0: send issuer of user certificate as claim
Using ADFS 2.0, I would like to send to a relying party information about the issuer of the user certificate, if a user authenticated using an x509 certificate.
Is this possible? How should I ...
0
votes
0answers
236 views
Certificate Error on Server 2008 R2 Event ID 6 and 13
I have two DC, one is a Windows Server 2003 (certificate server), the other is Windows Server 2008 R2.
The Windows Server 2008 R2 has the following events in the event viewer.
Source: ...
1
vote
0answers
220 views
Unable to request new certificate: access denied. (2008 R2)
When trying to request a new certificate for DomainControllerAuthentication from our DC designated as the CA, we keep receiving an access denied error.
The following events are generated in the event ...
1
vote
1answer
54 views
FIM CM Broken After Manual Cert Renewal
I recently attempted to renew the certificate for the clmAgent user account according to these directions:
http://technet.microsoft.com/en-us/library/hh149034%28v=ws.10%29.aspx
I logged in with the ...
0
votes
0answers
158 views
Windows 2008 Autoenrolment error, revocation server was offline
I'm trying to setup an devlopment environment that needs certifacates and AD. I'm not a sysadmin and has some trouble to grasp the concpept of autoenrolment and how all parts fits together. I have set ...
4
votes
1answer
222 views
CA and Primary Domain Controller on the same server
i am setting up a Microsoft AD to be my CA. After research it looks like i need to have a domain controller before i can issue certs thru the CA. Would it be possible to place both the CA and the DC ...
2
votes
1answer
150 views
Multiple CA's on Windows Server 2012
Is it possible to create multiple Certficate Authorities in Windows Server 2012?
Specifically: I'd like to create a standalone root CA which will have its private key in offline secure storage. The ...
1
vote
1answer
167 views
Client side certificates in client browsers with unix server for management
We are currently running Unix dedicated servers for everything (Web cluster, database, FTP, batch, ...) except for a Microsoft Active Directory Certificate Services. The sole purpose of this Windows ...
0
votes
0answers
71 views
Failover Issuer CAs without Clustering [closed]
I am attempting to setup a Certificate Authority with some failover capabilities for the issuer CAs. I have an offline root CA and am attempting to setup two subordinate CAs on our domain which will ...
0
votes
1answer
180 views
AD Certificate Templates does not appear
I'm following what should be simple instructions to enable LDAP SSL on our domain controller (instructions here). Duplicating the Kerberos certificate is successful however, when attempting to select ...
1
vote
1answer
423 views
How to autoenroll certificates from a Certification Authority in a trusted domain?
I have two Active Directory domains in two separate forests, all at Windows Server 2008 R2 functional levels. There is a two-way forest trust between the domains.
Domain A contains a Windows Server ...
4
votes
1answer
176 views
Microsoft CA certificate templates expires sooner than expected
The certificates my Microsoft CA is generating do not match the time period indicated in the template used. How can I resolve this?
I recently created a new certificate template for use on my Linux ...
0
votes
0answers
187 views
WS 2008 R2 Online Responder not Responding to OCSP Requests
I'm trying to configure an Online Responder (OCSP Responder) for a Windows-based PKI (2008 R2) and I can't for the life of me get the OCSP service to validate when I check it in the Enterprise PKI ...
3
votes
2answers
124 views
Migrate an intermediate CA to a new root
Using the Microsoft CA is there any way to cut over to a new certificate authority from an intermediate authority?
Both my systems are Microsoft CAs - I have a 2008 R2 Enterprise CA (intermediate) ...
0
votes
1answer
2k views
How can I get SBS2011 to issue certificates?
I want to use certificates to authenticate both client and server for a new internal service.
Since all our servers already have the SBS (2011 Standard) server's Cert installed as a Trusted Root, ...
0
votes
0answers
155 views
Require both MS-CHAP and Smart-Card authentication using NPS
I have an odd request, our client wants the ability to use certificate-based authentication for Routing & Remote Access in server 2008 R2, however he wants to use both Certificates and Passwords. ...
1
vote
1answer
1k views
Child domain new cert request - certificate template permissions do not allow current user to enroll 0x80094012
I have the following AD configuration:
rootca (standalone not domain connected)
mydom.local
dc1.mydom.local
svr1.mydom.local
subca.mydom.local(enterprise subordinate CA)
other.mydom.local
...
2
votes
3answers
2k views
Active Directory Certificate Services won't start - error 100
I've migrated my Active Directory Certificate services Enterprise CA to a new server (and from Windows 2003 R2 x86 to Windows 2008 R2 x64).
I have been having problems with checking the Certificate ...
1
vote
1answer
838 views
Microsoft Standalone CA - Set expiration date of an individual request
I have set up a Microsoft Standalone CA on 2008 R2 as a root CA. I'm trying to setup a subordinate Enterprise CA. I generated the certificate request, and submitted it to the root CA. Then, I ran ...
1
vote
1answer
140 views
How do I create multiple instances of Certificate Server on the same Windows installation?
The following URLs describe a new feature of Windows Certificate server is the ability to install multiple instances on the same server.
(see end of "transcript" link it's a zip file) ...
1
vote
1answer
169 views
Decommissioning PKI - How do I set a CRL Next update to null?
I am planning on deploying two Windows 2008R2 PKIs: One for legacy devices that don't support SHA-2 / ECP and another one that does support it.
When the time comes to decommission the SHA1 ...
4
votes
1answer
178 views
How large is the certificate OCSP and CRL cache in my Windows server?
How can I see the size of the in-memory OCSP cache to a CRL cache in my Domain Controllers?
In other words, most Windows process that uses CryptoAPIs have an in-memory cache of every CRL and OCSP ...
1
vote
1answer
397 views
Domain Environment + Certificate Authority + Server 2008 R2
I have recently been delegated the task to setup a CA in our domain environment and have a question on why Microsoft does somethings the way they do lol. I have been trying to read up on what the ...
0
votes
4answers
4k views
NPS EAP authentication failing after Windows Update
I have a Windows 2008 Std server running NPS. After applying the latest round of updates (including Root Certificates for April 2012 KB931125 (See:http://support.microsoft.com/kb/933430/)), EAP ...
1
vote
1answer
251 views
Using Microsoft CA to create TLS key/cert for Postfix
I'm trying to configure a postfix mailserver to use TLS encryption for SMTP (and IMAP with dovecot, but I haven't gotten to that point yet). It's running on a Fedora 14 machine and I'm using webmin to ...
1
vote
1answer
1k views
Unable to submit certificate request to 2k8R2 CA
I have created a two-tier CA using Windows Server 2008 R2. The .inf files used to create this standalone root and an enterprise subCA are at the end of this post.
The root is installed OK and issued ...
0
votes
1answer
2k views
How to publish a CRL for an internal Windows certification authority?
I have an Active Directory domain with an Enterprise Root Certification Authority in it; the domain uses a private domain name ("domain.local"), and we also have a public domain name ("domain.com"). ...
2
votes
1answer
721 views
My Windows CA (certificate authority) main cert is expiring next week, what do I do?
I went ahead and renewed the Certificate Authority itself (right click the CA, all tasks, renew), using the same public/private keys.
Do I need to do anything else to make sure things don't start to ...
3
votes
1answer
398 views
Automatically create Subject Alternate Name (SAN) Certificates
We are running an enterprise CA on Windows 2008R2. I just did an update to windows 7 on my workstation. Now every time I connect to a remote server using rdp I get a warning stating that the ...
1
vote
1answer
839 views
How can we clear CRL cache in Windows Server 008 using certutil command?
I know we can clear the CRL Cache in Windows Server 2008 using the certification authority UI. However, I want to automate the process and therefore looking a way to do it from command line. Is it ...
9
votes
2answers
5k views
Distribution of root certificate with Windows AD Certificate Services
Windows Server provides a certificate authority service. However, it's not clear from its documentation how (or if) the root certificate gets distributed to clients.
Do domain member computers ...
1
vote
1answer
358 views
Certificate Enrollment Control has stopped working on localhost AD CA server?
I'm having strange issue with my current AD CA server, when I try to generate a certificate by using the url https://localhost/certsrv/certrqma.asp I got the following error eventhough I did the ...
3
votes
2answers
926 views
Cannot issue Computer cert to standalone computer from my ECA
All Windows 2K8R2 SP1 environment.
I have a working Enterprise Certificate Authority in my domain. I want to issue a Computer certificate (for Server Authentication purpose) to an external, ...
2
votes
3answers
3k views
How do I reissue machine certificates for my Active Directory members now that I have a private CA?
So I have a working Active Directory. I've recently added a new machine to act as an Active Directory Certificate Authority.
I've added a Group Policy (Computer level) for automatic certificate ...
1
vote
1answer
349 views
powershell and remote signing
I've created a power shell script to run on start-up but its not working. I've never run a script through group policy so i don't know what the restrictions/best practices are. I've been told i need ...
1
vote
2answers
380 views
Requesting certificates fails in different site
I'm not really sure where to start looking
When requesting a certificate, a server always gets the error message "You cannot request a certificate at this time because no certificate types are ...
1
vote
1answer
213 views
Certificate issed to DC on every restart
I have installed 2 CA onto 2 Windows 2008R2 VM, one being an offline root CA and the other is intended to be the issuing CA. However I found that a DC (a 2008R2 VM) is requesting 2 certificates, ...
2
votes
1answer
179 views
Migrating from a standalone to enterprise CA
I want a peaceful transition from an old standalone CA into an enterprise CA. I am intending to offline the server on completion of this process.
My thought process is to publish a CRL with a long ...
1
vote
2answers
353 views
Are code signing certificates automatically trusted across the domain if the root CA is trusted?
We have a Microsoft enterprise certificate authority, and I would like to start issuing a few code signing certificates.
But what I'm unsure of is this: since all our domain/forest machines trust the ...
0
votes
1answer
486 views
Unable to renew certificate in certmgr.msc in windows 2003
I am trying to renew a certificate using CertManager on Windows 2003 Server. (I have also used the certificate plug-in in MMC but its the same thing.) I am logged in with the Administrator account.
...
1
vote
1answer
667 views
Can I remove the DC role from a W2k8 server being an Enterprise CA?
Is it possible to run a W2k8 Enterprise (AD-integrated) Certificate Authority on a server that it not a domain controller - mine currently is a DC and I do not remember whether this was a requirement? ...
0
votes
1answer
569 views
Issuing Computer Certificates to Non-Domain Members (Enterprise CA)
I am trying to implement remote client access using L2TP/IPSec VPN for both domain members and non-members. Domain members is fine and working OK but I am having trouble issuing a certificate to the ...
1
vote
1answer
264 views
I can't install Enterprise root CA in windows 2003
I am trying to install Enterprise CA in my windows server 2003.But I can select only stand alone root CA and the stand alone subordinate CA. Other two options are not highlighted. Can anybody give me ...
2
votes
2answers
278 views
Run `certutil -DCInfo` on a different target domain
It seems that running certutil.exe -DCInfo Verify will check the certificates for all domain controllers in the domain of the logged-in user account.
In our AD forest, we have a handful of domains. I ...
4
votes
1answer
2k views
Certificate Template Missing from “Certificate Template to Issue”
I'm having a problem similar to that posted in this question:
Missing Certificate template From certificate to issue
The short version is that I've created a duplicate certificate template and I'm ...
0
votes
1answer
88 views
Can not find a specific group in MS Windows 2008
In a MS-Win 2008 SP2 I am trying to find the group CERTSVC_DCOM_ACCESS.
I followed this link Error in MS-CA request instructions but I can not seem to find that group.
Where it? Does it have a ...
0
votes
1answer
123 views
Understating certificate authority nesting
Given we have the following network/CA structure:
Win2K8R2 - Root CA - no idea where its' certificate is?
Win2K8R2 - Sub CA - obtained CA certificate from Root CA
Win2K8R2 - OWA 2010 (Basically, a ...
1
vote
1answer
76 views
Server 2003 Certificate Authority
I have a Certificate Authority installed on Windows Server 2003 R2 Enterprise Edition, I am looking at auto enrollment.
When I go into the Certificate Authority mmc I cannot see Certificate Templates ...
1
vote
0answers
241 views
Change name of Win Server 2008 computer after CA install
I am importing an old certificate database into the new CA on a new server I'm installing. I am warned by Windows that I can't change the computer name, domain settings, etc., after installing the CA. ...
