2
votes
0answers
14 views

Certificate revocation check fails for non-domain guest in spite of accessible CRL

When we try to use certificates on computers that are not part of the domain, Windows complains that The revocation function was unable to check revocation because the revocation server was ...
1
vote
0answers
32 views

Windows - Replace subject from CSR when issuing certificate

I've received a CSR from a client with a CN, but not with all the subject fields we require. According to this answer from Scott*, it should be possible to specify the final subject values when the ...
3
votes
1answer
58 views

How can I get an OID for a certificate template?

I'm using C# (or VBScript) to issue a certificate from an Enterprise CA. According to this answer, I need to specify the OID instead of the certificate name, and place it in an unexpected portion of ...
1
vote
1answer
31 views

ADCS - How can I diagnose the exact reason a certificate request was denied by a policy module?

I need to develop operational procedures to audit and understand why a specific request was rejected by an Active Directory Certificate Services (ADCS) Policy Module. I've attempted turning on all ...
1
vote
0answers
33 views

How to include all dns records and IP address of a server in automatic certificate enrollment of Microsoft AD CS?

In my company there are a lot of servers which users remotely login to them to do their duties. We have enabled computer certificate auto enrollment for them to assure secure connection. But because ...
0
votes
1answer
46 views

Time stamped digital signatures with AD-CS

We are planning to implement a time proof digital signature solution in our intranet. Currently we have a Enterprise AD CS up and running. We are planning to use these signatures only inside our ...
1
vote
2answers
150 views

Does a domain computer trust certs from domain CA

I have investigated this but have been unable to find a definitive answer to my question. I have never used certificate services in active directory before so am unsure of its possible ...
1
vote
0answers
30 views

EFS file access problems

in my organization, i have a deadline to deploy EFS using AD CS, and i am working with a single windows server 2003 box, which is the Root CA, and is the same server responsible to certificate ...
0
votes
1answer
63 views

Win2008 SRV Certutil csv option not present

I have an Enterprise Certificate Authority running well. I am attempting to automate some monitoring tasks using batch files and the certutil.exe command. After reading the documentation at: ...
5
votes
1answer
160 views

How do I configure AD CS to support Name Constraints (4.2.1.11 in RFC 2459)?

I am trying to figure out how to do Qualified Subordination with the critical extension set, but I'm unable to figure out how to do this in MSFT AD CS. For a given certificate, how do I make sure ...
0
votes
0answers
48 views

Auto-enrollment certificate without enroll permission

I am Domain Admin of a company. We implement Active Directory Certificate Services in our company for email signature and encryption. Because we have more than 1000 users in our company, we want to ...
1
vote
1answer
55 views

Anyone know of a way to find all certs that weren't auto-enrolled?

I'm in the process of moving an Active Directory Certificate Services role over to a new 2012 server. The new server will be issuing new certs and I need to find all certs that weren't handed out by ...
1
vote
0answers
580 views

How do I set up an 802.1X infrastructure for use with OS X and iPads?

At my workplace I have been tasked with setting up machine certificate based 802.1X wireless authentication for our Apple devices. It seems like on the client side this will be handled by Profiles ...
3
votes
1answer
388 views

Microsoft offline root CA CDP and AIA http URLs are hard coded - trouble ahead?

I'm new with ADCS, and there is a lot to understand. I set up a 2-tier PKI, and have placed the offline root CA certificate (CRT) and CRL files on a web server pointing to with a CNAME in DNS. When I ...
3
votes
1answer
908 views

AD CS: Certificate Template not available

In short, a Certificate Template I want to use is not available for enrollment. The template in question is a copy of the "RAS and IAS Server" template. What's frustrating is that I've gotten this ...
4
votes
1answer
1k views

CA and Primary Domain Controller on the same server

i am setting up a Microsoft AD to be my CA. After research it looks like i need to have a domain controller before i can issue certs thru the CA. Would it be possible to place both the CA and the DC ...
2
votes
1answer
361 views

Multiple CA's on Windows Server 2012

Is it possible to create multiple Certficate Authorities in Windows Server 2012? Specifically: I'd like to create a standalone root CA which will have its private key in offline secure storage. The ...
1
vote
1answer
188 views

Client side certificates in client browsers with unix server for management

We are currently running Unix dedicated servers for everything (Web cluster, database, FTP, batch, ...) except for a Microsoft Active Directory Certificate Services. The sole purpose of this Windows ...
0
votes
1answer
1k views

AD Certificate Templates does not appear

I'm following what should be simple instructions to enable LDAP SSL on our domain controller (instructions here). Duplicating the Kerberos certificate is successful however, when attempting to select ...
2
votes
1answer
114 views

Missing subject field values in user certificate (Windows)

I am trying to enroll (on behalf of) a user certificate but certain fields appear to be missing in the subject field. Specifically, O and OU. Using ADSI, I see that the fields have the values I want ...
5
votes
1answer
516 views

Microsoft CA certificate templates expires sooner than expected

The certificates my Microsoft CA is generating do not match the time period indicated in the template used. How can I resolve this? I recently created a new certificate template for use on my Linux ...
4
votes
2answers
260 views

Migrate an intermediate CA to a new root

Using the Microsoft CA is there any way to cut over to a new certificate authority from an intermediate authority? Both my systems are Microsoft CAs - I have a 2008 R2 Enterprise CA (intermediate) ...
0
votes
1answer
4k views

How can I get SBS2011 to issue certificates?

I want to use certificates to authenticate both client and server for a new internal service. Since all our servers already have the SBS (2011 Standard) server's Cert installed as a Trusted Root, ...
1
vote
1answer
2k views

Microsoft Standalone CA - Set expiration date of an individual request

I have set up a Microsoft Standalone CA on 2008 R2 as a root CA. I'm trying to setup a subordinate Enterprise CA. I generated the certificate request, and submitted it to the root CA. Then, I ran ...
1
vote
1answer
295 views

Decommissioning PKI - How do I set a CRL Next update to null?

I am planning on deploying two Windows 2008R2 PKIs: One for legacy devices that don't support SHA-2 / ECP and another one that does support it. When the time comes to decommission the SHA1 ...
4
votes
1answer
385 views

How large is the certificate OCSP and CRL cache in my Windows server?

How can I see the size of the in-memory OCSP cache to a CRL cache in my Domain Controllers? In other words, most Windows process that uses CryptoAPIs have an in-memory cache of every CRL and OCSP ...
1
vote
1answer
579 views

Domain Environment + Certificate Authority + Server 2008 R2

I have recently been delegated the task to setup a CA in our domain environment and have a question on why Microsoft does somethings the way they do lol. I have been trying to read up on what the ...
2
votes
1answer
286 views

Can't request computer certificate

I am using MMC with the snaping of certificates. I am requesting certificates from a brand new installation of a CA. Requesting User certificates works perfectly. Requesting Computer certificates ...
1
vote
1answer
415 views

Using Microsoft CA to create TLS key/cert for Postfix

I'm trying to configure a postfix mailserver to use TLS encryption for SMTP (and IMAP with dovecot, but I haven't gotten to that point yet). It's running on a Fedora 14 machine and I'm using webmin to ...
3
votes
1answer
884 views

Automatically create Subject Alternate Name (SAN) Certificates

We are running an enterprise CA on Windows 2008R2. I just did an update to windows 7 on my workstation. Now every time I connect to a remote server using rdp I get a warning stating that the ...
3
votes
2answers
3k views

Cannot issue Computer cert to standalone computer from my ECA

All Windows 2K8R2 SP1 environment. I have a working Enterprise Certificate Authority in my domain. I want to issue a Computer certificate (for Server Authentication purpose) to an external, ...
1
vote
1answer
431 views

powershell and remote signing

I've created a power shell script to run on start-up but its not working. I've never run a script through group policy so i don't know what the restrictions/best practices are. I've been told i need ...
2
votes
1answer
264 views

Migrating from a standalone to enterprise CA

I want a peaceful transition from an old standalone CA into an enterprise CA. I am intending to offline the server on completion of this process. My thought process is to publish a CRL with a long ...
1
vote
2answers
561 views

Are code signing certificates automatically trusted across the domain if the root CA is trusted?

We have a Microsoft enterprise certificate authority, and I would like to start issuing a few code signing certificates. But what I'm unsure of is this: since all our domain/forest machines trust the ...
1
vote
1answer
1k views

Can I remove the DC role from a W2k8 server being an Enterprise CA?

Is it possible to run a W2k8 Enterprise (AD-integrated) Certificate Authority on a server that it not a domain controller - mine currently is a DC and I do not remember whether this was a requirement? ...
0
votes
1answer
946 views

Issuing Computer Certificates to Non-Domain Members (Enterprise CA)

I am trying to implement remote client access using L2TP/IPSec VPN for both domain members and non-members. Domain members is fine and working OK but I am having trouble issuing a certificate to the ...
1
vote
1answer
370 views

I can't install Enterprise root CA in windows 2003

I am trying to install Enterprise CA in my windows server 2003.But I can select only stand alone root CA and the stand alone subordinate CA. Other two options are not highlighted. Can anybody give me ...
2
votes
3answers
411 views

Run `certutil -DCInfo` on a different target domain

It seems that running certutil.exe -DCInfo Verify will check the certificates for all domain controllers in the domain of the logged-in user account. In our AD forest, we have a handful of domains. I ...
5
votes
2answers
4k views

Certificate Template Missing from “Certificate Template to Issue”

I'm having a problem similar to that posted in this question: Missing Certificate template From certificate to issue The short version is that I've created a duplicate certificate template and I'm ...
0
votes
1answer
134 views

Understating certificate authority nesting

Given we have the following network/CA structure: Win2K8R2 - Root CA - no idea where its' certificate is? Win2K8R2 - Sub CA - obtained CA certificate from Root CA Win2K8R2 - OWA 2010 (Basically, a ...
1
vote
0answers
392 views

Change name of Win Server 2008 computer after CA install

I am importing an old certificate database into the new CA on a new server I'm installing. I am warned by Windows that I can't change the computer name, domain settings, etc., after installing the CA. ...
2
votes
2answers
774 views

Is it safe to reboot a Windows 2003 certificate authority server? What problems might occur?

My company has a Windows 2003 root certificate authority server which is used to generate client certificates for Remote Desktop Services logins, as well as certificates for internal HTTPS websites. ...
1
vote
1answer
636 views

Windows 2008 CA and Windows 2003 AD?

I have a Windows 2003 AD and I set up a root ca and a sub ca both of which are windows 2008(joined to domain).I need to use the sub ca to generate end user certificates for digital signature , they ...
1
vote
2answers
3k views

Domain Controller promotion and certificate autoenrollment

I have this AD domain where a Windows Server 2003 SP2 Enterprise Root Certification Authority is operational, and certificate autoenrollment is enabled both for users and computers; all fine and good, ...
0
votes
1answer
269 views

Creating an MS Certificate Authority using CA Root Certificate created with OpenSSL

Using the guide here: http://www.davidpashley.com/articles/cert-authority.html I have create a certificate authority using OpenSSL. However I would now like to use the Microsoft CA instead. The ...
6
votes
2answers
5k views

Adding new root/enterprise CA without disturbing existing one?

I am looking at installing a new AD-integrated enterprise certificate authority structure, but have discovered that somebody already has created a CA (mostly used for SSL on internal websites). I ...
1
vote
1answer
330 views

Do I need to take special care when decommissioning a certificate server in a windows domain?

I'm setting up a new Windows 2008 R2 server to take over from a older Windows 2003 box in a small windows domain. I discovered that the old server is running the only certificate service in the ...
4
votes
1answer
8k views

How to configure what certificates can be issued using Web Enrollment in Windows Server 2008 R2 Enterprise?

I have a CA installed on of my Windows Servers in a small farm of systems. I've installed the Certification Authority Web Enrollment and Certificate Enrollment Web Service roles on the CA. I want to ...
2
votes
1answer
3k views

Using an AD-integrated Enterprise CA to issue an Exchange 2010 certificate

I have a small test network that includes Win2k8 R2 machines, an Enterprise CA server and an Exchange 2010 SP1 RU1 CAS server. I would like to issue a certificate for Exchange from the CA. As the ...