Active Directory Certificate Services is a role first made available in Windows Server 2008. Previously it was known as certificate services.

learn more… | top users | synonyms

3
votes
1answer
36 views

Where does a Windows Certification Authority store its root private key?

I have a Windows Server 2012 R2 Enterprise Root Certification Authority on a Hyper-V virtual machine which, due to currently unkown reasons, doesn't boot anymore. I don't know if the VM will ever ...
5
votes
3answers
179 views

In a Windows PKI, what is a Workstation Authentication CA Template used for? What happens if it expires?

Many workstations have an expiring computer certificate that was issued using the Workstation Authentication CA template. The CA of this template expires in 2 days. I've deployed a new CA, with an ...
5
votes
2answers
44 views

Does the “Enterprise PKI” MMC allow for any automated testing of the PKI?

I'm using the Enterprise PKI snap in to diagnose and check the health of a MSFT PKI system. Is there any way to script/automate this tool to alert me to the pending expiration of a CRL or missing ...
5
votes
1answer
58 views

Generate new self-signed CA for Windows 2012 CA

Set up a Enterprise CA for Windows 2012. While generating the initial root CA, SHA512 was selected. This has proven to cause issues with TLS 1.2 that we were unaware of. I'm trying to generate a ...
4
votes
1answer
32 views

What is the purpose of a custom Certificate Trust List?

You can create and deploy a certificate trust list as detailed here, but I'm trying to understand the advantages of this over just deploying root and intermediate certs with group policy the normal ...
1
vote
0answers
26 views

How to setup digital signatures on Microsoft CA (AD-CS)?

I've been trying to research across the web on how to setup a Microsoft CA (AD-CS on Windows Server 2008 R2) in order to create a certificate for digital signatures, allowing you to digitally sign ...
2
votes
1answer
70 views

Submit a certificate request file from a non domain computer. How to figure out policy server parameters

I'm trying to submit a certificate request. I'm trying to do it from command line so I can run it from code. Previously I have done it by using the Microsoft Active Directory Certificate Services for ...
5
votes
1answer
160 views

Protecting credentials in Desired State Configuration using certificates

I'm new to DSC and trying to figure out how to make it work for us. What I'm stuck on is how the credentials are actually protected. My current understanding is that it isn't all that great. The big ...
0
votes
0answers
10 views

Publishing extra AD CA CRLs for clients

I am attempting to configure Workplace Join in my Lab Environment. I have my AD CS infrastructure in place and have configured an additional CDP/CRL list with an accessible DNS name for non-domain ...
1
vote
1answer
80 views

PKI - Cert Template could not be loaded. This function is not supported on this system

I've built PKI's many times yet this organization's results have me puzzled. Offline Root 2008 R2 Standard 2xEnterprise Subordinate CA's 2008 R2 Enterprise Installed services, all is good. When I go ...
0
votes
1answer
108 views

ADCS Create a new certificate or Rename?

Just joined a new company. Apparently back last year they got rid of the old CA and restored the certificate on a new server. (2003 to 2012). I was about to renew the certificate (self signed) on the ...
2
votes
1answer
184 views

Certificate revocation check fails for non-domain guest in spite of accessible CRL

When we try to use certificates on computers that are not part of the domain, Windows complains that The revocation function was unable to check revocation because the revocation server was ...
1
vote
1answer
32 views

Migrating certificate services to Server 2008 R1

I am currently planning a move of an Active Directory Certificate Services CA from a soon to be decommissioned Server 2003 R2 Standard box to an existing Windows 2008 R1 Enterprise box. This is not ...
1
vote
0answers
68 views

Windows - Replace subject from CSR when issuing certificate

I've received a CSR from a client with a CN, but not with all the subject fields we require. According to this answer from Scott*, it should be possible to specify the final subject values when the ...
0
votes
0answers
113 views

MS CA “certutil -deleterow” not doing anything

I'm trying to cleanup old and failed certificates on my CA using certutil. I'd like to delete all failed requests prior to July 1st, 2014. I'm running the following: certutil -v -deleterow 7/1/2014 ...
3
votes
1answer
1k views

Signing a Java Deployment Rule Set JAR using AD Certificate Services

I am tasked with deploying Java 7 Update 55 along with a Java Deployment Rule Set to all Active Directory Windows clients. I've managed to get a solid Java software deployment setup but I'm now ...
1
vote
1answer
32 views

How can I limit the SMIME capabilities from a CA without using FIM?

These instructions describe how to prevent using SMIME with weak ciphers, however it requires an expensive product from Microsoft. How can I prevent a CA from issuing SMIME certificates that permit ...
3
votes
1answer
228 views

How can I get an OID for a certificate template?

I'm using C# (or VBScript) to issue a certificate from an Enterprise CA. According to this answer, I need to specify the OID instead of the certificate name, and place it in an unexpected portion of ...
0
votes
0answers
53 views

How do I set the certificate name as prompted by an Android phone in Microsoft ADCS?

When I import this SMIME test signing certificate, (password is the letter q) Android phones will come up with this screen: My goal is to import the certificate, with the right name, into the user ...
0
votes
2answers
135 views

What is the impact of upgrading Windows 2008 R2 Standard to Enterprise?

I have a Windows Server 2003 domain controller, a Windows Server 2008 R2 Standard domain controller, and a Windows Server 2012 domain controller. I am looking to upgrade the 2008 R2 Standard DC to ...
2
votes
2answers
74 views

Can a single ADCS instance “hold” more than one PKI namespace?

I want to save on OS license, simplify CRL renewals and have more than one certificate instance on a given server. For me, this makes sense from a security perspective because I have: One CA that ...
1
vote
1answer
133 views

ADCS - How can I diagnose the exact reason a certificate request was denied by a policy module?

I need to develop operational procedures to audit and understand why a specific request was rejected by an Active Directory Certificate Services (ADCS) Policy Module. I've attempted turning on all ...
1
vote
1answer
385 views

Fixing “server unavailable” login problems in exchange 2013 and outlook 2010

We've been facing some problems pertaining to expiring user passwords, causing "server unavailable" login problems for Outlook Outlook 2007 and 2010 clients on exchange 2013. The quick fix to this was ...
0
votes
1answer
48 views

Windows Server Certificates external domain

recently setup certificate services on a windows server 2008 internal network. I setup certificate services, generated the certificate, put it in the domain's trusted certificate folder and applied ...
0
votes
1answer
249 views

How to move CertSrv from “Default Web Site” to a new site in IIS?

I have installed Active Directory Certificate services and it has created a CertSrv application under "Default Web Site" and it is accessible using http(s)://[hostname]/certsrv. I want to move ...
1
vote
0answers
59 views

MySQL SSL Problems

I need to configure SSL for a MySQL server. I've read all of the directions for doing self-signed certs but it's preferred that I sign and use the certs from a different CA running AD Certificate ...
0
votes
1answer
195 views

Exchange Server 2013 has dependency on old PDC

I am in the process of completely upgrading a Exchange 2007 system running on server 2008 R2 Hyper-V VMs hosted on a Exchange 2008 R2 domain controller. It had all the FSMO roles on it, and it was the ...
2
votes
0answers
77 views

Does the Windows Certification Authority support CMC Requests with CRMF Request Body?

I have a program that generates CMC certificate requests with a CRMF Request Body. When I submit this request to a certification authority running on Windows Server 2008 R2 Enterprise it always fails ...
1
vote
0answers
51 views

How to include all dns records and IP address of a server in automatic certificate enrollment of Microsoft AD CS?

In my company there are a lot of servers which users remotely login to them to do their duties. We have enabled computer certificate auto enrollment for them to assure secure connection. But because ...
0
votes
1answer
65 views

Time stamped digital signatures with AD-CS

We are planning to implement a time proof digital signature solution in our intranet. Currently we have a Enterprise AD CS up and running. We are planning to use these signatures only inside our ...
1
vote
2answers
545 views

Does a domain computer trust certs from domain CA

I have investigated this but have been unable to find a definitive answer to my question. I have never used certificate services in active directory before so am unsure of its possible ...
1
vote
0answers
40 views

EFS file access problems

in my organization, i have a deadline to deploy EFS using AD CS, and i am working with a single windows server 2003 box, which is the Root CA, and is the same server responsible to certificate ...
0
votes
1answer
116 views

Win2008 SRV Certutil csv option not present

I have an Enterprise Certificate Authority running well. I am attempting to automate some monitoring tasks using batch files and the certutil.exe command. After reading the documentation at: ...
5
votes
1answer
330 views

How do I configure AD CS to support Name Constraints (4.2.1.11 in RFC 2459)?

I am trying to figure out how to do Qualified Subordination with the critical extension set, but I'm unable to figure out how to do this in MSFT AD CS. For a given certificate, how do I make sure ...
2
votes
1answer
2k views

New Domain Controller Cannot Enroll for KerberosAuthentication Certificate

I have an AD domain. 2003 FFL/DFL. The schema was upgraded to version 56 for Server 2012. The domain contains a mix of domain controllers from Server 2003, Server 2008, Server 2008 R2, and now Server ...
0
votes
1answer
103 views

Auto-enrollment certificate without enroll permission

I am Domain Admin of a company. We implement Active Directory Certificate Services in our company for email signature and encryption. Because we have more than 1000 users in our company, we want to ...
0
votes
1answer
2k views

Enable certsrv.msc windows server 2008 r2 [closed]

How to start the certsrv.msc? I need to create a cert to access to an active directory over SSL
2
votes
0answers
148 views

Windows Sub CA not issuing certificates

I set up a fresh 2-tier PKI to try and replace an old broken PKI with a CA that was no longer available. Everything seems to be working between the offline root and online issuing CAs, but now I'm ...
5
votes
1answer
447 views

How to add custom OID for subject field on certificates issued by Windows Server 2008 R2 CA?

I'm using a Windows Server 2008 R2 domain controller with Active Directory Certificate Services installed. It's configured as an Enterprise Root CA. I have configured a custom certificate template so ...
1
vote
1answer
71 views

Anyone know of a way to find all certs that weren't auto-enrolled?

I'm in the process of moving an Active Directory Certificate Services role over to a new 2012 server. The new server will be issuing new certs and I need to find all certs that weren't handed out by ...
1
vote
1answer
188 views

Powershell: Fancy new cmdlet to install CRLs too?

So Win8.1 and 2012 R2 includes a neat new cmdlet to install certs: Import-Certificate [-FilePath] <String> [-CertStoreLocation <String> ] [-Confirm] [-WhatIf] [ <CommonParameters>] ...
3
votes
1answer
410 views

Cmdlets for AD CS deployment: Install-ADcsCertificationAuthority cmdlet failing when attempting to install an offline policy CA

I installed an offline root CA without issue using this command: Install-ADcsCertificationAuthority ` -OverwriteExistingKey ` <#In the case of a re-installation#> ` ...
1
vote
0answers
936 views

How do I set up an 802.1X infrastructure for use with OS X and iPads?

At my workplace I have been tasked with setting up machine certificate based 802.1X wireless authentication for our Apple devices. It seems like on the client side this will be handled by Profiles ...
3
votes
4answers
12k views

Java Deployment Rule Set via AD Enterprise CA

My goal is to get a Java Deployment Rule Set in place in my organization, but I do not want to pay third-party certificate authority for a code signing cert when we have a working CA running through ...
2
votes
2answers
131 views

Can a Windows Server CA separate code-signing keys from keys for other purposes?

I am a software developer. My team encrypts the sensitive sections of our ASP.NET web.config files. aspnet_regiis.exe is used to manage the local key store, encrypt and decrypt. I want to build a ...
0
votes
1answer
235 views

Windows 2003 AD Certificate services failed on primary DC?

Cert services show error: Event ID: 5 Description: Certificate Services could not find required registry information. The Certificate Services may need to be reinstalled. I have manualy removed CA ...
3
votes
1answer
157 views

Is it possible to include the private key in an openssl-generated CSR?

I'm using openssl on linux to generate a certificate signing request (CSR) that will be submitted to a Windows Certificate Services Certification Authority that has been configured to archive private ...
3
votes
1answer
614 views

Microsoft offline root CA CDP and AIA http URLs are hard coded - trouble ahead?

I'm new with ADCS, and there is a lot to understand. I set up a 2-tier PKI, and have placed the offline root CA certificate (CRT) and CRL files on a web server pointing to with a CNAME in DNS. When I ...
1
vote
2answers
334 views

Is it possible to batch sign CSRs (with certutil for instance)?

I have about 100 CSR to sign on a windows PKI. I would like to know if it's possible to batch submit, issue and export these CSRs via batch or powershell script, maybe using cert util, and how to do ...
3
votes
1answer
1k views

AD CS: Certificate Template not available

In short, a Certificate Template I want to use is not available for enrollment. The template in question is a copy of the "RAS and IAS Server" template. What's frustrating is that I've gotten this ...