Active Directory Certificate Services is a role first made available in Windows Server 2008. Previously it was known as certificate services.

learn more… | top users | synonyms

1
vote
1answer
366 views

Fixing “server unavailable” login problems in exchange 2013 and outlook 2010

We've been facing some problems pertaining to expiring user passwords, causing "server unavailable" login problems for Outlook Outlook 2007 and 2010 clients on exchange 2013. The quick fix to this was ...
3
votes
1answer
35 views

Where does a Windows Certification Authority store its root private key?

I have a Windows Server 2012 R2 Enterprise Root Certification Authority on a Hyper-V virtual machine which, due to currently unkown reasons, doesn't boot anymore. I don't know if the VM will ever ...
2
votes
1answer
2k views

New Domain Controller Cannot Enroll for KerberosAuthentication Certificate

I have an AD domain. 2003 FFL/DFL. The schema was upgraded to version 56 for Server 2012. The domain contains a mix of domain controllers from Server 2003, Server 2008, Server 2008 R2, and now Server ...
5
votes
3answers
172 views

In a Windows PKI, what is a Workstation Authentication CA Template used for? What happens if it expires?

Many workstations have an expiring computer certificate that was issued using the Workstation Authentication CA template. The CA of this template expires in 2 days. I've deployed a new CA, with an ...
2
votes
3answers
459 views

Run `certutil -DCInfo` on a different target domain

It seems that running certutil.exe -DCInfo Verify will check the certificates for all domain controllers in the domain of the logged-in user account. In our AD forest, we have a handful of domains. I ...
0
votes
1answer
1k views

Unable to renew certificate in certmgr.msc in windows 2003

I am trying to renew a certificate using CertManager on Windows 2003 Server. (I have also used the certificate plug-in in MMC but its the same thing.) I am logged in with the Administrator account. ...
5
votes
2answers
43 views

Does the “Enterprise PKI” MMC allow for any automated testing of the PKI?

I'm using the Enterprise PKI snap in to diagnose and check the health of a MSFT PKI system. Is there any way to script/automate this tool to alert me to the pending expiration of a CRL or missing ...
4
votes
1answer
928 views

certutil -ping fails with 30 seconds timeout - what to do?

The certificate store on my Win7 box is constantly hanging. Observe: C:\>1.cmd C:\>certutil -? | findstr /i ping -ping -- Ping Active Directory Certificate Services Request ...
5
votes
1answer
56 views

Generate new self-signed CA for Windows 2012 CA

Set up a Enterprise CA for Windows 2012. While generating the initial root CA, SHA512 was selected. This has proven to cause issues with TLS 1.2 that we were unaware of. I'm trying to generate a ...
4
votes
1answer
2k views

CA and Primary Domain Controller on the same server

I am setting up a Microsoft AD to be my CA. After research, it looks like I need to have a domain controller before I can issue certs thru the CA. Would it be possible to place both the CA and the DC ...
3
votes
1answer
1k views

Signing a Java Deployment Rule Set JAR using AD Certificate Services

I am tasked with deploying Java 7 Update 55 along with a Java Deployment Rule Set to all Active Directory Windows clients. I've managed to get a solid Java software deployment setup but I'm now ...
4
votes
1answer
30 views

What is the purpose of a custom Certificate Trust List?

You can create and deploy a certificate trust list as detailed here, but I'm trying to understand the advantages of this over just deploying root and intermediate certs with group policy the normal ...
1
vote
0answers
24 views

How to setup digital signatures on Microsoft CA (AD-CS)?

I've been trying to research across the web on how to setup a Microsoft CA (AD-CS on Windows Server 2008 R2) in order to create a certificate for digital signatures, allowing you to digitally sign ...
0
votes
1answer
103 views

Auto-enrollment certificate without enroll permission

I am Domain Admin of a company. We implement Active Directory Certificate Services in our company for email signature and encryption. Because we have more than 1000 users in our company, we want to ...
2
votes
1answer
65 views

Submit a certificate request file from a non domain computer. How to figure out policy server parameters

I'm trying to submit a certificate request. I'm trying to do it from command line so I can run it from code. Previously I have done it by using the Microsoft Active Directory Certificate Services for ...
5
votes
1answer
149 views

Protecting credentials in Desired State Configuration using certificates

I'm new to DSC and trying to figure out how to make it work for us. What I'm stuck on is how the credentials are actually protected. My current understanding is that it isn't all that great. The big ...
0
votes
0answers
10 views

Publishing extra AD CA CRLs for clients

I am attempting to configure Workplace Join in my Lab Environment. I have my AD CS infrastructure in place and have configured an additional CDP/CRL list with an accessible DNS name for non-domain ...
0
votes
1answer
107 views

ADCS Create a new certificate or Rename?

Just joined a new company. Apparently back last year they got rid of the old CA and restored the certificate on a new server. (2003 to 2012). I was about to renew the certificate (self signed) on the ...
1
vote
1answer
77 views

PKI - Cert Template could not be loaded. This function is not supported on this system

I've built PKI's many times yet this organization's results have me puzzled. Offline Root 2008 R2 Standard 2xEnterprise Subordinate CA's 2008 R2 Enterprise Installed services, all is good. When I go ...
2
votes
1answer
181 views

Certificate revocation check fails for non-domain guest in spite of accessible CRL

When we try to use certificates on computers that are not part of the domain, Windows complains that The revocation function was unable to check revocation because the revocation server was ...
0
votes
1answer
247 views

How to move CertSrv from “Default Web Site” to a new site in IIS?

I have installed Active Directory Certificate services and it has created a CertSrv application under "Default Web Site" and it is accessible using http(s)://[hostname]/certsrv. I want to move ...
1
vote
1answer
32 views

Migrating certificate services to Server 2008 R1

I am currently planning a move of an Active Directory Certificate Services CA from a soon to be decommissioned Server 2003 R2 Standard box to an existing Windows 2008 R1 Enterprise box. This is not ...
1
vote
0answers
68 views

Windows - Replace subject from CSR when issuing certificate

I've received a CSR from a client with a CN, but not with all the subject fields we require. According to this answer from Scott*, it should be possible to specify the final subject values when the ...
3
votes
4answers
12k views

Java Deployment Rule Set via AD Enterprise CA

My goal is to get a Java Deployment Rule Set in place in my organization, but I do not want to pay third-party certificate authority for a code signing cert when we have a working CA running through ...
0
votes
0answers
112 views

MS CA “certutil -deleterow” not doing anything

I'm trying to cleanup old and failed certificates on my CA using certutil. I'd like to delete all failed requests prior to July 1st, 2014. I'm running the following: certutil -v -deleterow 7/1/2014 ...
1
vote
1answer
31 views

How can I limit the SMIME capabilities from a CA without using FIM?

These instructions describe how to prevent using SMIME with weak ciphers, however it requires an expensive product from Microsoft. How can I prevent a CA from issuing SMIME certificates that permit ...
2
votes
2answers
74 views

Can a single ADCS instance “hold” more than one PKI namespace?

I want to save on OS license, simplify CRL renewals and have more than one certificate instance on a given server. For me, this makes sense from a security perspective because I have: One CA that ...
3
votes
1answer
225 views

How can I get an OID for a certificate template?

I'm using C# (or VBScript) to issue a certificate from an Enterprise CA. According to this answer, I need to specify the OID instead of the certificate name, and place it in an unexpected portion of ...
0
votes
0answers
53 views

How do I set the certificate name as prompted by an Android phone in Microsoft ADCS?

When I import this SMIME test signing certificate, (password is the letter q) Android phones will come up with this screen: My goal is to import the certificate, with the right name, into the user ...
0
votes
2answers
127 views

What is the impact of upgrading Windows 2008 R2 Standard to Enterprise?

I have a Windows Server 2003 domain controller, a Windows Server 2008 R2 Standard domain controller, and a Windows Server 2012 domain controller. I am looking to upgrade the 2008 R2 Standard DC to ...
1
vote
1answer
132 views

ADCS - How can I diagnose the exact reason a certificate request was denied by a policy module?

I need to develop operational procedures to audit and understand why a specific request was rejected by an Active Directory Certificate Services (ADCS) Policy Module. I've attempted turning on all ...
0
votes
1answer
48 views

Windows Server Certificates external domain

recently setup certificate services on a windows server 2008 internal network. I setup certificate services, generated the certificate, put it in the domain's trusted certificate folder and applied ...
3
votes
1answer
1k views

AD CS: Certificate Template not available

In short, a Certificate Template I want to use is not available for enrollment. The template in question is a copy of the "RAS and IAS Server" template. What's frustrating is that I've gotten this ...
1
vote
0answers
59 views

MySQL SSL Problems

I need to configure SSL for a MySQL server. I've read all of the directions for doing self-signed certs but it's preferred that I sign and use the certs from a different CA running AD Certificate ...
0
votes
1answer
192 views

Exchange Server 2013 has dependency on old PDC

I am in the process of completely upgrading a Exchange 2007 system running on server 2008 R2 Hyper-V VMs hosted on a Exchange 2008 R2 domain controller. It had all the FSMO roles on it, and it was the ...
2
votes
0answers
75 views

Does the Windows Certification Authority support CMC Requests with CRMF Request Body?

I have a program that generates CMC certificate requests with a CRMF Request Body. When I submit this request to a certification authority running on Windows Server 2008 R2 Enterprise it always fails ...
1
vote
0answers
51 views

How to include all dns records and IP address of a server in automatic certificate enrollment of Microsoft AD CS?

In my company there are a lot of servers which users remotely login to them to do their duties. We have enabled computer certificate auto enrollment for them to assure secure connection. But because ...
0
votes
1answer
65 views

Time stamped digital signatures with AD-CS

We are planning to implement a time proof digital signature solution in our intranet. Currently we have a Enterprise AD CS up and running. We are planning to use these signatures only inside our ...
1
vote
2answers
537 views

Does a domain computer trust certs from domain CA

I have investigated this but have been unable to find a definitive answer to my question. I have never used certificate services in active directory before so am unsure of its possible ...
5
votes
1answer
322 views

How do I configure AD CS to support Name Constraints (4.2.1.11 in RFC 2459)?

I am trying to figure out how to do Qualified Subordination with the critical extension set, but I'm unable to figure out how to do this in MSFT AD CS. For a given certificate, how do I make sure ...
1
vote
0answers
40 views

EFS file access problems

in my organization, i have a deadline to deploy EFS using AD CS, and i am working with a single windows server 2003 box, which is the Root CA, and is the same server responsible to certificate ...
0
votes
1answer
115 views

Win2008 SRV Certutil csv option not present

I have an Enterprise Certificate Authority running well. I am attempting to automate some monitoring tasks using batch files and the certutil.exe command. After reading the documentation at: ...
1
vote
0answers
931 views

How do I set up an 802.1X infrastructure for use with OS X and iPads?

At my workplace I have been tasked with setting up machine certificate based 802.1X wireless authentication for our Apple devices. It seems like on the client side this will be handled by Profiles ...
0
votes
1answer
2k views

Enable certsrv.msc windows server 2008 r2 [closed]

How to start the certsrv.msc? I need to create a cert to access to an active directory over SSL
2
votes
3answers
5k views

Active Directory Certificate Services won't start - error 100

I've migrated my Active Directory Certificate services Enterprise CA to a new server (and from Windows 2003 R2 x86 to Windows 2008 R2 x64). I have been having problems with checking the Certificate ...
2
votes
0answers
146 views

Windows Sub CA not issuing certificates

I set up a fresh 2-tier PKI to try and replace an old broken PKI with a CA that was no longer available. Everything seems to be working between the offline root and online issuing CAs, but now I'm ...
5
votes
1answer
442 views

How to add custom OID for subject field on certificates issued by Windows Server 2008 R2 CA?

I'm using a Windows Server 2008 R2 domain controller with Active Directory Certificate Services installed. It's configured as an Enterprise Root CA. I have configured a custom certificate template so ...
1
vote
2answers
333 views

Is it possible to batch sign CSRs (with certutil for instance)?

I have about 100 CSR to sign on a windows PKI. I would like to know if it's possible to batch submit, issue and export these CSRs via batch or powershell script, maybe using cert util, and how to do ...
1
vote
1answer
71 views

Anyone know of a way to find all certs that weren't auto-enrolled?

I'm in the process of moving an Active Directory Certificate Services role over to a new 2012 server. The new server will be issuing new certs and I need to find all certs that weren't handed out by ...
3
votes
1answer
401 views

Cmdlets for AD CS deployment: Install-ADcsCertificationAuthority cmdlet failing when attempting to install an offline policy CA

I installed an offline root CA without issue using this command: Install-ADcsCertificationAuthority ` -OverwriteExistingKey ` <#In the case of a re-installation#> ` ...