Active Directory Certificate Services is a role first made available in Windows Server 2008. Previously it was known as certificate services.

learn more… | top users | synonyms

0
votes
0answers
10 views

Special considerations for a new Certificate Authority with multiple UPN suffices?

Our AD domain is foo.com, NetBIOS FOO_D1. A previous employee added a second UPN suffix, bar.com. Our corporate identity now revolves around bar.com, such that it is used in everyone's email address. ...
0
votes
0answers
15 views

URL retrieval tool AIA Certs “Wrong Issuer” after renewal

I performed a certificate renewal and for some reason this tool is indicating that it has wrong issuer. when I click on certs from AIA it says wrong issuer Any help will be grateful, i don't have any ...
0
votes
1answer
17 views

Add additional information to auto-enrolled certificates (Windows Active Directory CA)

I successfully enabled auto-enrollment for client computer certificates within our Active Directory domain. However, I want to include additional details in the auto-enrolled certificate such as the ...
0
votes
1answer
250 views

Smartcard Logon: The domain specified is not available. Please try again later

I'm standing up a test lab. Using AD CS, I've deployed a smartcard logon cert to an HID Crescendo C1150. When I attempt to log on to a WIN7 workstation with the smartcard, I'm greeted with: The ...
1
vote
2answers
46 views

AD Certificate services - The combobox to select Template is missing

Has anybody come across an issue where the certificate templates field is missing in the certsrv web-page? I am running 'Windows2012R2 Standard'. The online tutorials all have this combobox, but i am ...
0
votes
0answers
153 views

ASA Certifiate does not match the server name

I am trying to install a certificate on my Cisco ASA 5515, It has my local windows 2012 CA as a trusted CA. The domain has also had this CA applied to their trusted root. When ever i try and connect ...
3
votes
1answer
164 views

Removing LDAP from CDP & AIA in a Microsoft PKI

A default installation of a Microsoft PKI running Windows 2012 R2 includes LDAP URL's within CRL distribution points (CDP's) and Authority Information Access (AIA). I want to issue certificates ...
2
votes
1answer
69 views

AD Certificate template - Enroll on behalf of

I'm trying to setup S/MIME for a few users, which requires certificates. I'm not using smartcards, and not using autoenrollment for these certificates. Server is running 2012R2. I created a ...
2
votes
1answer
78 views

Does the auto generated LDAPS cert on a 2012R2 domain controller auto renew?

For a lab/teaching environment, we need to set up a Windows 2012R2 machine as a domain controller, with LDAPS enabled on 636. As we also need ADCS installed, we have just let ADCS auto generate the ...
1
vote
1answer
53 views

Can I add a certificate template type to the “Submit a Certificate Request” page in AD CS Web Enrollment?

In the CA Web Enrollment website, on the "Submit a Certificate Request or Renewal Request" page (https://<servername>/certsrv/certrqxt.asp) there is a dropbox under the "Certificate Template:" ...
1
vote
1answer
188 views

How to enable LDAP over SSL/TLS in AD without installing AD Certificate Services

I am installing a Sonicwall firewall into my organization. I've connected the Sonicwall with the Active Directory domain, however now on the status page of the appliance there is a huge warning: ...
0
votes
1answer
801 views

Remove expired CA certificates

My Win2012R2 Subordinate Enteprise CA certificate has expired. I already have a new one working. How can i remove the expired certificate? I see the expired certificate on the general tab of MMC CA ...
0
votes
1answer
26 views

Find out which certificates cause a certificate revocation list check

In the course of migrating our internal CA we first the old server up and running in order to allow clients to download the CRl from the URL hardcoded in already issued certificates. Meanwhile the old ...
0
votes
1answer
15 views

Windows 2008 Cert Authority only issuing certificates for 10 days

I am trying to get a certificate for my Remote Desktop server on my AD. When I submit the request through the Certificate Authority snap in it generates a certificate that is only valid for a few days ...
1
vote
1answer
282 views

Cross Forest Certificate Authority

Looking for help on material for setting up a multi tiered/cross-forest PKI Infrastructure. The only articles I can come across are just setting up the basic two tier systems on one domain. Basically ...
2
votes
3answers
41 views

Issuing own certificates for signing software

We have a windows based infrastructure. Recently I was asked by our software developer if we can issue our own certificates to sign some small programs we're sending to out partners. But I don't fully ...
0
votes
0answers
24 views

Windows ADCS Schannel event ID 36682 on computers

I have a 2 tier PKI hierarchy which contains an offline ROOT Certificate Server ( un-joined to the domain) and Enterprise Sub CA servers. We are using EAP-TLS method for authentication to corp ...
2
votes
1answer
73 views

Best Certs to use for internal https [duplicate]

I'm helping out a large church with some IT stuff they have lots of internal secure connections, like to the security cameras, or to the UniFi AP controller that want to use https. Of course each of ...
2
votes
1answer
104 views

Is capolicy.inf processed in full (or part) during server install, renewal, and issuing new certs

When installing a Windows CA, capol.inf confuses me. It seems that capol.inf does set defaults for the CA that can otherwise be done using certutil's registry functions (or regedit). It also ...
4
votes
1answer
89 views

Re-install ADCS CA Certificate & CRL on Workstation

I installed Active Directory Certificate Services and created a Standalone CA. Everything went fine and it automatically installed the CA certificate and CRL on all my domain workstations. On one of ...
2
votes
0answers
86 views

How does one create a certificate request for a managed service account in Windows?

I have a managed service account which needs a certificate in its personal store for decryption. I tried opening the Certificates snap-in and pointing to the service, but when I right-click on the ...
1
vote
0answers
415 views

Linux client for pki certificate auto enrollment from Windows CA

I just set up a Windows Server Certificate Authority. I would like to auto-enroll Ubuntu Linux computers for certificates. Can anyone share the available client options? I found this (old) technet ...
0
votes
0answers
325 views

Windows Server 2008R2 Certificate Services will not start Error Code 0x80090011 (-2146893807)

For no apparent reason that I can find our server 2008 r2 server, which is our ca service has stopped. I have tried to restart it, but when I do, it says object not found. When I check the event ...
1
vote
1answer
51 views

How do I get alerted to an pending AD CS certificate request?

I want to get a summary report of pending AD CS requests. How would I approach this? Does anything already exist? The problem I'm trying to solve is where a user requests a certificate, and i'm ...
2
votes
0answers
939 views

Server 2012, Attempted to Install Certificate Services, now Win-RM is broken

I have two exchange servers, one running Exchange 2007 and one Exchange 2010. On the Exchange 2010 I attempted to install a AD-Certificate role but after installing the role I am unable to run the ...
0
votes
2answers
99 views

How to Configure Windows Certificate Services not to use AIA and CRL when issuing Certificates

I have a Windows Certificate Service installed on a Windows Server 2008 R2 VM, and what I need to do is to modify certificates NOT to use AIA and CRL, but to ONLY use OCSP Responder. The OCSP is ...
1
vote
1answer
580 views

How can I create and install a domain signed certificate in IIS using PowerShell?

In my environment we host a whole lot of websites and WCF webservices in IIS (on Windows 2008 R2 and Windows 2012). We are in the process of enabling HTTPS on these sites. This goes as follows: ...
0
votes
0answers
946 views

Windows 2008 Web Enrollment Fails The RPC server is unavailable. 0x800706ba (WIN32: 1722)

I am setting up an RA and a Subordinate CA who is also an AD. I can issue certs through certutil and the mmc snap-in with no problem. But when I try using Web Enrollment in the RA, it fails saying ...
0
votes
1answer
766 views

Problematic Active Directorys CA certificate

i came across one DC, which gives me RPC errors when dealing with AD Certificate Service.I can see in AD there is 2 Root CA , one is problematic. Is it safe to remove it? Or is there a procedure for ...
3
votes
1answer
1k views

Where does a Windows Certification Authority store its root private key?

I have a Windows Server 2012 R2 Enterprise Root Certification Authority on a Hyper-V virtual machine which, due to currently unkown reasons, doesn't boot anymore. I don't know if the VM will ever ...
5
votes
3answers
1k views

In a Windows PKI, what is a Workstation Authentication CA Template used for? What happens if it expires?

Many workstations have an expiring computer certificate that was issued using the Workstation Authentication CA template. The CA of this template expires in 2 days. I've deployed a new CA, with an ...
5
votes
2answers
259 views

Does the “Enterprise PKI” MMC allow for any automated testing of the PKI?

I'm using the Enterprise PKI snap in to diagnose and check the health of a MSFT PKI system. Is there any way to script/automate this tool to alert me to the pending expiration of a CRL or missing ...
5
votes
1answer
235 views

Generate new self-signed CA for Windows 2012 CA

Set up a Enterprise CA for Windows 2012. While generating the initial root CA, SHA512 was selected. This has proven to cause issues with TLS 1.2 that we were unaware of. I'm trying to generate a ...
5
votes
1answer
892 views

What is the purpose of a custom Certificate Trust List?

You can create and deploy a certificate trust list as detailed here, but I'm trying to understand the advantages of this over just deploying root and intermediate certs with group policy the normal ...
1
vote
0answers
269 views

How to setup digital signatures on Microsoft CA (AD-CS)?

I've been trying to research across the web on how to setup a Microsoft CA (AD-CS on Windows Server 2008 R2) in order to create a certificate for digital signatures, allowing you to digitally sign ...
2
votes
1answer
382 views

Submit a certificate request file from a non domain computer. How to figure out policy server parameters

I'm trying to submit a certificate request. I'm trying to do it from command line so I can run it from code. Previously I have done it by using the Microsoft Active Directory Certificate Services for ...
8
votes
1answer
1k views

Protecting credentials in Desired State Configuration using certificates

I'm new to DSC and trying to figure out how to make it work for us. What I'm stuck on is how the credentials are actually protected. My current understanding is that it isn't all that great. The big ...
1
vote
1answer
313 views

PKI - Cert Template could not be loaded. This function is not supported on this system

I've built PKI's many times yet this organization's results have me puzzled. Offline Root 2008 R2 Standard 2xEnterprise Subordinate CA's 2008 R2 Enterprise Installed services, all is good. When I go ...
0
votes
1answer
514 views

ADCS Create a new certificate or Rename?

Just joined a new company. Apparently back last year they got rid of the old CA and restored the certificate on a new server. (2003 to 2012). I was about to renew the certificate (self signed) on the ...
2
votes
1answer
2k views

Certificate revocation check fails for non-domain guest in spite of accessible CRL

When we try to use certificates on computers that are not part of the domain, Windows complains that The revocation function was unable to check revocation because the revocation server was ...
1
vote
1answer
51 views

Migrating certificate services to Server 2008 R1

I am currently planning a move of an Active Directory Certificate Services CA from a soon to be decommissioned Server 2003 R2 Standard box to an existing Windows 2008 R1 Enterprise box. This is not ...
2
votes
0answers
191 views

Windows - Replace subject from CSR when issuing certificate

I've received a CSR from a client with a CN, but not with all the subject fields we require. According to this answer from Scott*, it should be possible to specify the final subject values when the ...
3
votes
1answer
5k views

Signing a Java Deployment Rule Set JAR using AD Certificate Services

I am tasked with deploying Java 7 Update 55 along with a Java Deployment Rule Set to all Active Directory Windows clients. I've managed to get a solid Java software deployment setup but I'm now ...
1
vote
1answer
107 views

How can I limit the SMIME capabilities from a CA without using FIM?

These instructions describe how to prevent using SMIME with weak ciphers, however it requires an expensive product from Microsoft. How can I prevent a CA from issuing SMIME certificates that permit ...
3
votes
1answer
1k views

How can I get an OID for a certificate template?

I'm using C# (or VBScript) to issue a certificate from an Enterprise CA. According to this answer, I need to specify the OID instead of the certificate name, and place it in an unexpected portion of ...
0
votes
2answers
242 views

What is the impact of upgrading Windows 2008 R2 Standard to Enterprise?

I have a Windows Server 2003 domain controller, a Windows Server 2008 R2 Standard domain controller, and a Windows Server 2012 domain controller. I am looking to upgrade the 2008 R2 Standard DC to ...
2
votes
2answers
204 views

Can a single ADCS instance “hold” more than one PKI namespace?

I want to save on OS license, simplify CRL renewals and have more than one certificate instance on a given server. For me, this makes sense from a security perspective because I have: One CA that ...
1
vote
1answer
588 views

ADCS - How can I diagnose the exact reason a certificate request was denied by a policy module?

I need to develop operational procedures to audit and understand why a specific request was rejected by an Active Directory Certificate Services (ADCS) Policy Module. I've attempted turning on all ...
1
vote
1answer
2k views

Fixing “server unavailable” login problems in exchange 2013 and outlook 2010

We've been facing some problems pertaining to expiring user passwords, causing "server unavailable" login problems for Outlook Outlook 2007 and 2010 clients on exchange 2013. The quick fix to this was ...
0
votes
1answer
90 views

Windows Server Certificates external domain

recently setup certificate services on a windows server 2008 internal network. I setup certificate services, generated the certificate, put it in the domain's trusted certificate folder and applied ...