Questions tagged [ad-certificate-services]
Active Directory Certificate Services is a role first made available in Windows Server 2008. Previously it was known as certificate services.
251
questions
0
votes
2
answers
29
views
is it ok to just discard a certificate authority if there is only one valid certificate?
I have inherited a windows server 2019 domain controller on a small network (approx. 30 client pc's) with adcs installed. I want to set up a dedicated server for adcs since having the adcs on the dc ...
- 94
1
vote
1
answer
28
views
Specifying Dynamic filenames for AIA and CDP in CAPolicy?
In the "CAPolicy.inf" file where you define [AuthorityInformationAccess] and [CRLDistributionPoint], can these sections use dynamic values? For instance:
[CRLDistirubtionPoint]
URL="...
- 7,118
3
votes
1
answer
223
views
How to create an Authenticode Signing infrastructure?
I am attempting to create the necessary infrastructure to allow authorised users to sign PowerShell scripts and have them be trusted by the organisation, this allows deploying scripts to computers ...
- 7,118
0
votes
0
answers
233
views
Issuing Certificate For Child Domain After Issuing One From Parent From Same CA
I am trying it issue a certificate as part of my Enrollment ability for a 2FA device for our child domain from our parent domain. I was able to do this months ago but now it won't let me do the child ...
- 835
2
votes
1
answer
18k
views
Windows 2012 CA Web Interface "No certificate templates could be found"
I have an enterprise certificate authority running on a Windows Server 2012 R2 member server. The web interface for the CA has recently started popping up an error each time I go to request a ...
CommunityBot
- 1
11
votes
1
answer
5k
views
certutil -ping fails with 30 seconds timeout - what to do?
The certificate store on my Win7 box is constantly hanging. Observe:
C:\>1.cmd
C:\>certutil -? | findstr /i ping
-ping -- Ping Active Directory Certificate Services Request interface
...
CommunityBot
- 1
0
votes
2
answers
269
views
Should a subordinate CA appear under the Trusted Root CA?
Recently I needed to setup PKI for VDI solution as smart card functionality was needed to handle SSO with Azure. I configured an offline Root CA and a domain joined subordinate CA per MS instructions ...
- 1
1
vote
1
answer
5k
views
Error installing Active Directory Certificate Services
I'm trying to install Active Directory Certificate Services on a Windows Server 2016 Standard Core VM where I logged in with the Administrator account.
I ran the following Powershell cmdlet:
ps> ...
CommunityBot
- 1
3
votes
2
answers
17k
views
No certificate templates in Certificate Services server on Windows 2019
There are a lot of discussions on here about this problem, and I have spent all day exploring every one of them. All the servers involved in this are Windows 2019. 2 domain controllers and a ...
- 4,917
0
votes
1
answer
151
views
Active Directory Certificate Services (ADCS) Template 3DES?
I am seeking clarification from anyone who is familiar with ADCS.
In reviewing the AD Object details, I am trying to understand why I am seeing 3DES in the application policy section of the ...
- 7,118
0
votes
0
answers
87
views
Windows Certification Authority Autoenrollment when Issuance Requirements is set
I have domain computers CA template which autoenrolls to machines without issues
I activated Issuance Requirements
I can automatically renew existing certificates, but cannot automatically/manyally ...
- 115
1
vote
0
answers
234
views
Windows CA Publishing Expired Certs in CRL When not configured to do so
I have a Windows ADDS CA that for some reason is publishing revoked but expired certificates in the CRL and I can't for the life of me figure out why. Here is my configuration:
Server 2012 R2
...
- 13
0
votes
1
answer
1k
views
LDAPS certificate isn't working on new server for third parties
About 5-6 years ago I setup LDAPS on my Primary Domain controller. I setup Active Directory Certificate Services (all on the same server), forwarded the port 636 on my firewall, and was able to ...
- 7
0
votes
1
answer
158
views
Microsoft Certificate Authority Machine Template - add single label host name to SAN
I would like to create a machine certificate template on a Microsoft Certificate Authority that includes the single label Active Directory (AD) Computer Names in the SAN.
I have tens of thousands of ...
- 36.8k
1
vote
1
answer
373
views
Implementing PKI on an Active Directory domain
I would like to implement a two-tier PKI in a relatively small Windows environment: about 35 users and five virtual servers. Although I have little experience with Linux, I am trying to use XCA on a ...
- 4,789
1
vote
1
answer
12k
views
Windows 2008 Web Enrollment Fails The RPC server is unavailable. 0x800706ba (WIN32: 1722)
I am setting up an RA and a Subordinate CA who is also an AD.
I can issue certs through certutil and the mmc snap-in with no problem.
But when I try using Web Enrollment in the RA, it fails saying "...
CommunityBot
- 1
0
votes
0
answers
66
views
Export pfx certificate after approving pending request
In Active Directory Certificate Authority I have template with CA certificate manager approval.
CA picture
When I approve a request I can not export issued certificates to pfx format. How can I export ...
- 1
0
votes
1
answer
130
views
CA: Certificate User for VPN
From a subordinate Enterprise CA I want to generate a user certificate that serves as an authentication method for VPN connections.
I want to install this certificate with autoenroll on the domain ...
- 36.8k
0
votes
0
answers
324
views
Migrating a CA to a new server - CA services won't start
We have an Enterprise Root CA running on Server 2012 R2. I built a replacement server running Server 2019 and followed the steps in the below article, I backed up the CA and relevant registry keys, ...
- 36.8k
1
vote
1
answer
189
views
SubCA certificate of trust
I have deployed a PKI infrastructure with a Stand-Alone Root CA (which will be kept off) and 4 Enterprise SubCA's which depends on this Root CA.
To make the computers trust the Root CA, I am going to ...
- 298
0
votes
1
answer
2k
views
Creating a new root certificate with new key length on windows ad certificate services
Due to new corporate guidelines I need to update the root certificate of my CA so the key length is 4096bits (Currently 2048bits).
My CA is AD integrated and currently running on our DC.
So now I am ...
- 4,917
0
votes
0
answers
238
views
How to submit certificate request from Red Hat machine to Windows CA?
I’m looking for solution, which helps me send certificate request from domain-joined RedHat Enterprise Linux machine to Certification Authority on Windows Sever 2022. Is there any solution to do this? ...
- 19
0
votes
2
answers
298
views
Change certificate issuer
Is it possible to change the "issuer" value in a CA so that when a new certificate is issued, the new "issuer" value appears?
In the case of having several SubCa, is it possible to ...
- 36.8k
2
votes
1
answer
474
views
How to set the lifetime of a CA certificate?
I'm trying to install a subordinate CA with Microsoft ADCS and when I do, it creates a .req file. Then I use that at the root CA to issue a certificate. The resulting certificate is always for 5 years....
0
votes
1
answer
310
views
Windows Server 2019 ADCS. CA subordinate
I have a "CA1" server with Windows 2019 that has the CA root Enterprise service. Additionally I have another server "CA-Subordinate" with Windows 2019 with the CA subordinate ...
- 4,789
0
votes
2
answers
253
views
With multiple RDP certificates, do all get checked?
If a Windows host has multiple RDP certificates. Do all get checked while connecting or only the first found?
I have a RDP certificates deployed from an Root CA with now invalid OCSP location in the ...
- 1,423
2
votes
1
answer
3k
views
Automatically renew certificate: Old cert gets archived, but no new one is issued
We are using Active Directory Certificate Services (AD CS) to issue certificates for internal web applications. We can manually request a certificate from the CA and it gets issued without problems. ...
- 101
0
votes
1
answer
614
views
Trouble setting up CES and CEP PKI in a trusted forest scenario
I have two AD domains with a two-way forest trust. I want computer accounts in DomainB to enroll for computer client auth certificates from the two-tier Windows CA in DomainA. I configured a ...
- 1
0
votes
0
answers
3k
views
How to configure AD Certificate Services to get past this WS_E_ENDPOINT_ACCESS_DENIED error?
I have followed the Microsoft test lab instructions for setting up a two-tier CA hierarchy. I have the Certificate Enrollment Policy Web Service (CEP) installed on the same machine as the issuing ...
- 1
0
votes
1
answer
370
views
Can we add a subordinate enterprise certificate authority linked to an existing enterprise Root certificate authority
The Root CA is domain joined.
The Sub CA will be domain joined.
The Sub CA will deliver workstation Authentification (template) to PC clients via GPO.
Is there any known issue with this configuration?
...
- 71.3k
0
votes
2
answers
2k
views
Auto-Enrollment with manager approval, but auto-approval for re-enrollment
I have a certificate template (auto-enrolled) that must require manager approval.
To achieve this, I checked the CA certificate manager approval checkbox in the Issuance Requirements tab.
The ...
0
votes
2
answers
4k
views
Windows Certificate Authority - Adding Additional Attributes
In AD Certificate Templates the templates have an option to build from AD information and includes Email, DNS, UPN, etc.
When creating a CSR using powershell, openssl and the certificate mmc snap-in ...
CommunityBot
- 1
1
vote
1
answer
2k
views
How to enable LDAP over SSL/TLS in AD without installing AD Certificate Services
I am installing a Sonicwall firewall into my organization. I've connected the Sonicwall with the Active Directory domain, however now on the status page of the appliance there is a huge warning:
...
CommunityBot
- 1
0
votes
1
answer
1k
views
Having trouble issuing the 2nd enterprise CA on the same offline Root CA as the 1st. Windows Server 2016
I am running into an issue and hoping someone can help me. We were asked to set up a new Root CA and 2 subordinate (issuing) CAs under it (the request includes using Azure and placing each VM in a ...
- 4,789
1
vote
1
answer
3k
views
ADCS Create a new certificate or Rename?
Just joined a new company. Apparently back last year they got rid of the old CA and restored the certificate on a new server. (2003 to 2012).
I was about to renew the certificate (self signed) on the ...
CommunityBot
- 1
1
vote
1
answer
2k
views
How to move CertSrv from "Default Web Site" to a new site in IIS?
I have installed Active Directory Certificate services and it has created a CertSrv application under "Default Web Site" and it is accessible using http(s)://[hostname]/certsrv.
I want to move ...
CommunityBot
- 1
4
votes
1
answer
3k
views
Fixing "server unavailable" login problems in exchange 2013 and outlook 2010
We've been facing some problems pertaining to expiring user passwords, causing "server unavailable" login problems for Outlook Outlook 2007 and 2010 clients on exchange 2013. The quick fix to this was ...
CommunityBot
- 1
0
votes
1
answer
330
views
Must all services of ADCS run under the same service account on the same server?
While deploying ADCS, on the documentation Microsoft recommends using service accounts for the services making up ADCS. The problem is that it doesn't address if these should be individually managed, ...
- 1,423
0
votes
1
answer
3k
views
Exchange Server 2013 has dependency on old PDC
I am in the process of completely upgrading a Exchange 2007 system running on server 2008 R2 Hyper-V VMs hosted on a Exchange 2008 R2 domain controller. It had all the FSMO roles on it, and it was the ...
CommunityBot
- 1
4
votes
2
answers
3k
views
RPC error when requesting computer certificate
I am using MMC with the certificate management snapin. I am requesting certificates from a brand new installation of a CA.
Requesting User certificates works perfectly.
Requesting Computer ...
CommunityBot
- 1
0
votes
2
answers
450
views
How can I set the ACL of a CA programmatically?
When launching the CA console (certsrv.msc), I can right-click on my CA, select Properties and then I can modify the ACL of my CA in the Security tab. When I modify it, the changes are applied to the ...
- 645
0
votes
1
answer
4k
views
Domain Member Servers - Accessing Certificate Revocation List (CRL)
In my environment I have a Enterprise Root CA installed on a domain controller and a separate domain controller configured as a Subordinate CA - I know this isn't recommended for security reasons but ...
- 7,118
2
votes
2
answers
14k
views
ADCS - How can I diagnose the exact reason a certificate request was denied by a policy module?
I need to develop operational procedures to audit and understand why a specific request was rejected by an Active Directory Certificate Services (ADCS) Policy Module.
I've attempted turning on all ...
- 645
0
votes
1
answer
259
views
How does OCSP handle deleted certificates?
We have a Microsoft Certificate Authority running on Windows Server 2019. We are issuing certificates to Android devices via a MDM. The Android device users browse to a web application (hosted by ...
- 7,118
0
votes
1
answer
2k
views
What controls the timing of the Windows Certificate Services event "Close to expiration" ID 1003?
I have a Windows Server which started logging this warning event 36/37 days before a certificate's expiry date and I would like to understand what controls/sets this timing and how it can be ...
- 7,118
1
vote
1
answer
1k
views
Unable to Backup or Restore Certificate Authority?
I migrated Certificate Authority Enterprise from windows server 2012 R2 to Windows Server 2019. Both Server are VMs
Here are the steps I took:
Baskup CA database, key and registry config of the ...
3
votes
1
answer
5k
views
Domain Controller autoenrollment - changing issuing CA
We are cleaning up our Windows PKI/CA environment and replacing our root CA with a new server. The current root CA has been issuing the following certificate templates for years now (in addition to ...
- 32.8k
0
votes
1
answer
685
views
CDP container in Active Directory required if not part of AD?
We have a Microsoft Active Directory Certificate Services Enterprise CA.
After installing the service, an AD container is created within CN=CDP,CN=Public Key Services,CN=Services,CN=Configuration,DC=...
- 7,118
0
votes
1
answer
783
views
Target specific Enterprise CA for auto-enrollment?
We have two intermediate Enterprise CAs (Windows AD CS) in our AD domain. Both CAs only have the Certification Authority role enabled.
CA1 is responsible for issuing certificates to workstations and ...
- 7,059
8
votes
5
answers
81k
views
Certificate Template Missing from "Certificate Template to Issue"
I'm having a problem similar to that posted in this question:
Missing Certificate template From certificate to issue
The short version is that I've created a duplicate certificate template and I'm ...
- 41