Active Directory Certificate Services is a role first made available in Windows Server 2008. Previously it was known as certificate services.

learn more… | top users | synonyms

1
vote
1answer
1k views

Problematic Active Directorys CA certificate

i came across one DC, which gives me RPC errors when dealing with AD Certificate Service.I can see in AD there is 2 Root CA , one is problematic. Is it safe to remove it? Or is there a procedure for ...
8
votes
1answer
1k views

certutil -ping fails with 30 seconds timeout - what to do?

The certificate store on my Win7 box is constantly hanging. Observe: C:\>1.cmd C:\>certutil -? | findstr /i ping -ping -- Ping Active Directory Certificate Services Request ...
1
vote
1answer
2k views

Fixing “server unavailable” login problems in exchange 2013 and outlook 2010

We've been facing some problems pertaining to expiring user passwords, causing "server unavailable" login problems for Outlook Outlook 2007 and 2010 clients on exchange 2013. The quick fix to this was ...
2
votes
1answer
138 views

How to include all dns records and IP address of a server in automatic certificate enrollment of Microsoft AD CS?

In my company there are a lot of servers which users remotely login to them to do their duties. We have enabled computer certificate auto enrollment for them to assure secure connection. But because ...
0
votes
2answers
35 views

Does Root CA need to be online?

I am trying to setup an IPv6-only Exchange Server 2013, running on Server 2012 R2 Datacenter. This is a 1-machine-setup in a VirtualBox for testing purposes. Everything is running ok so far. I.e. I ...
-1
votes
1answer
2k views

Unable to renew certificate in certmgr.msc in windows 2003

I am trying to renew a certificate using CertManager on Windows 2003 Server. (I have also used the certificate plug-in in MMC but its the same thing.) I am logged in with the Administrator account. ...
0
votes
0answers
17 views

Installing Certificate Enrollment Web Service and Certificate Enrollment Policy Web Service on same computer

I am referencing this MS Technet document: Setting Up Certificate Enrollment Web Services The environment is Windows Server 2008 R2. I am planning for a Certificate Enrollment Web Service and the ...
0
votes
1answer
16 views

Forcing Certificate Auto-Reissue

Recently, I used AD Certificate Authority to automatically issue a remote desktop certificate to each client on the local domain. After the auto-issue, I realized that I failed to properly configure ...
3
votes
2answers
2k views

How can I get an OID for a certificate template?

I'm using C# (or VBScript) to issue a certificate from an Enterprise CA. According to this answer, I need to specify the OID instead of the certificate name, and place it in an unexpected portion of ...
0
votes
0answers
14 views

Special considerations for a new Certificate Authority with multiple UPN suffices?

Our AD domain is foo.com, NetBIOS FOO_D1. A previous employee added a second UPN suffix, bar.com. Our corporate identity now revolves around bar.com, such that it is used in everyone's email address. ...
0
votes
0answers
64 views

URL retrieval tool AIA Certs “Wrong Issuer” after renewal

I performed a certificate renewal and for some reason this tool is indicating that it has wrong issuer. when I click on certs from AIA it says wrong issuer Any help will be grateful, i don't have any ...
2
votes
1answer
809 views

How can I create and install a domain signed certificate in IIS using PowerShell?

In my environment we host a whole lot of websites and WCF webservices in IIS (on Windows 2008 R2 and Windows 2012). We are in the process of enabling HTTPS on these sites. This goes as follows: ...
0
votes
1answer
26 views

Add additional information to auto-enrolled certificates (Windows Active Directory CA)

I successfully enabled auto-enrollment for client computer certificates within our Active Directory domain. However, I want to include additional details in the auto-enrolled certificate such as the ...
5
votes
1answer
5k views

New Domain Controller Cannot Enroll for KerberosAuthentication Certificate

I have an AD domain. 2003 FFL/DFL. The schema was upgraded to version 56 for Server 2012. The domain contains a mix of domain controllers from Server 2003, Server 2008, Server 2008 R2, and now Server ...
1
vote
1answer
1k views

Smartcard Logon: The domain specified is not available. Please try again later

I'm standing up a test lab. Using AD CS, I've deployed a smartcard logon cert to an HID Crescendo C1150. When I attempt to log on to a WIN7 workstation with the smartcard, I'm greeted with: The ...
3
votes
1answer
2k views

Where does a Windows Certification Authority store its root private key?

I have a Windows Server 2012 R2 Enterprise Root Certification Authority on a Hyper-V virtual machine which, due to currently unkown reasons, doesn't boot anymore. I don't know if the VM will ever ...
1
vote
2answers
137 views

AD Certificate services - The combobox to select Template is missing

Has anybody come across an issue where the certificate templates field is missing in the certsrv web-page? I am running 'Windows2012R2 Standard'. The online tutorials all have this combobox, but i am ...
0
votes
0answers
437 views

ASA Certifiate does not match the server name

I am trying to install a certificate on my Cisco ASA 5515, It has my local windows 2012 CA as a trusted CA. The domain has also had this CA applied to their trusted root. When ever i try and connect ...
2
votes
4answers
11k views

Active Directory Certificate Services won't start - error 100

I've migrated my Active Directory Certificate services Enterprise CA to a new server (and from Windows 2003 R2 x86 to Windows 2008 R2 x64). I have been having problems with checking the Certificate ...
2
votes
0answers
1k views

Server 2012, Attempted to Install Certificate Services, now Win-RM is broken

I have two exchange servers, one running Exchange 2007 and one Exchange 2010. On the Exchange 2010 I attempted to install a AD-Certificate role but after installing the role I am unable to run the ...
1
vote
3answers
3k views

Does a domain computer trust certs from domain CA

I have investigated this but have been unable to find a definitive answer to my question. I have never used certificate services in active directory before so am unsure of its possible ...
3
votes
1answer
330 views

Removing LDAP from CDP & AIA in a Microsoft PKI

A default installation of a Microsoft PKI running Windows 2012 R2 includes LDAP URL's within CRL distribution points (CDP's) and Authority Information Access (AIA). I want to issue certificates ...
2
votes
1answer
172 views

AD Certificate template - Enroll on behalf of

I'm trying to setup S/MIME for a few users, which requires certificates. I'm not using smartcards, and not using autoenrollment for these certificates. Server is running 2012R2. I created a ...
4
votes
2answers
4k views

AD CS: Certificate Template not available

In short, a Certificate Template I want to use is not available for enrollment. The template in question is a copy of the "RAS and IAS Server" template. What's frustrating is that I've gotten this ...
2
votes
1answer
136 views

Does the auto generated LDAPS cert on a 2012R2 domain controller auto renew?

For a lab/teaching environment, we need to set up a Windows 2012R2 machine as a domain controller, with LDAPS enabled on 636. As we also need ADCS installed, we have just let ADCS auto generate the ...
1
vote
1answer
90 views

Can I add a certificate template type to the “Submit a Certificate Request” page in AD CS Web Enrollment?

In the CA Web Enrollment website, on the "Submit a Certificate Request or Renewal Request" page (https://<servername>/certsrv/certrqxt.asp) there is a dropbox under the "Certificate Template:" ...
1
vote
1answer
320 views

How to enable LDAP over SSL/TLS in AD without installing AD Certificate Services

I am installing a Sonicwall firewall into my organization. I've connected the Sonicwall with the Active Directory domain, however now on the status page of the appliance there is a huge warning: ...
3
votes
1answer
6k views

Signing a Java Deployment Rule Set JAR using AD Certificate Services

I am tasked with deploying Java 7 Update 55 along with a Java Deployment Rule Set to all Active Directory Windows clients. I've managed to get a solid Java software deployment setup but I'm now ...
2
votes
3answers
41 views

Issuing own certificates for signing software

We have a windows based infrastructure. Recently I was asked by our software developer if we can issue our own certificates to sign some small programs we're sending to out partners. But I don't fully ...
0
votes
1answer
1k views

Remove expired CA certificates

My Win2012R2 Subordinate Enteprise CA certificate has expired. I already have a new one working. How can i remove the expired certificate? I see the expired certificate on the general tab of MMC CA ...
0
votes
1answer
32 views

Find out which certificates cause a certificate revocation list check

In the course of migrating our internal CA we first the old server up and running in order to allow clients to download the CRl from the URL hardcoded in already issued certificates. Meanwhile the old ...
0
votes
1answer
16 views

Windows 2008 Cert Authority only issuing certificates for 10 days

I am trying to get a certificate for my Remote Desktop server on my AD. When I submit the request through the Certificate Authority snap in it generates a certificate that is only valid for a few days ...
6
votes
5answers
29k views

Java Deployment Rule Set via AD Enterprise CA

My goal is to get a Java Deployment Rule Set in place in my organization, but I do not want to pay third-party certificate authority for a code signing cert when we have a working CA running through ...
1
vote
1answer
504 views

Cross Forest Certificate Authority

Looking for help on material for setting up a multi tiered/cross-forest PKI Infrastructure. The only articles I can come across are just setting up the basic two tier systems on one domain. Basically ...
0
votes
0answers
32 views

Windows ADCS Schannel event ID 36682 on computers

I have a 2 tier PKI hierarchy which contains an offline ROOT Certificate Server ( un-joined to the domain) and Enterprise Sub CA servers. We are using EAP-TLS method for authentication to corp ...
2
votes
1answer
80 views

Best Certs to use for internal https [duplicate]

I'm helping out a large church with some IT stuff they have lots of internal secure connections, like to the security cameras, or to the UniFi AP controller that want to use https. Of course each of ...
2
votes
1answer
118 views

Is capolicy.inf processed in full (or part) during server install, renewal, and issuing new certs

When installing a Windows CA, capol.inf confuses me. It seems that capol.inf does set defaults for the CA that can otherwise be done using certutil's registry functions (or regedit). It also ...
4
votes
1answer
94 views

Re-install ADCS CA Certificate & CRL on Workstation

I installed Active Directory Certificate Services and created a Standalone CA. Everything went fine and it automatically installed the CA certificate and CRL on all my domain workstations. On one of ...
6
votes
1answer
1k views

How to add custom OID for subject field on certificates issued by Windows Server 2008 R2 CA?

I'm using a Windows Server 2008 R2 domain controller with Active Directory Certificate Services installed. It's configured as an Enterprise Root CA. I have configured a custom certificate template so ...
2
votes
0answers
120 views

How does one create a certificate request for a managed service account in Windows?

I have a managed service account which needs a certificate in its personal store for decryption. I tried opening the Certificates snap-in and pointing to the service, but when I right-click on the ...
1
vote
0answers
572 views

Linux client for pki certificate auto enrollment from Windows CA

I just set up a Windows Server Certificate Authority. I would like to auto-enroll Ubuntu Linux computers for certificates. Can anyone share the available client options? I found this (old) technet ...
0
votes
0answers
427 views

Windows Server 2008R2 Certificate Services will not start Error Code 0x80090011 (-2146893807)

For no apparent reason that I can find our server 2008 r2 server, which is our ca service has stopped. I have tried to restart it, but when I do, it says object not found. When I check the event ...
1
vote
1answer
55 views

How do I get alerted to an pending AD CS certificate request?

I want to get a summary report of pending AD CS requests. How would I approach this? Does anything already exist? The problem I'm trying to solve is where a user requests a certificate, and i'm ...
0
votes
2answers
114 views

How to Configure Windows Certificate Services not to use AIA and CRL when issuing Certificates

I have a Windows Certificate Service installed on a Windows Server 2008 R2 VM, and what I need to do is to modify certificates NOT to use AIA and CRL, but to ONLY use OCSP Responder. The OCSP is ...
0
votes
0answers
1k views

Windows 2008 Web Enrollment Fails The RPC server is unavailable. 0x800706ba (WIN32: 1722)

I am setting up an RA and a Subordinate CA who is also an AD. I can issue certs through certutil and the mmc snap-in with no problem. But when I try using Web Enrollment in the RA, it fails saying ...
2
votes
1answer
3k views

My Windows CA (certificate authority) main cert is expiring next week, what do I do?

I went ahead and renewed the Certificate Authority itself (right click the CA, all tasks, renew), using the same public/private keys. Do I need to do anything else to make sure things don't start to ...
5
votes
2answers
311 views

Does the “Enterprise PKI” MMC allow for any automated testing of the PKI?

I'm using the Enterprise PKI snap in to diagnose and check the health of a MSFT PKI system. Is there any way to script/automate this tool to alert me to the pending expiration of a CRL or missing ...
5
votes
3answers
1k views

In a Windows PKI, what is a Workstation Authentication CA Template used for? What happens if it expires?

Many workstations have an expiring computer certificate that was issued using the Workstation Authentication CA template. The CA of this template expires in 2 days. I've deployed a new CA, with an ...
2
votes
3answers
768 views

Run `certutil -DCInfo` on a different target domain

It seems that running certutil.exe -DCInfo Verify will check the certificates for all domain controllers in the domain of the logged-in user account. In our AD forest, we have a handful of domains. I ...
5
votes
1answer
263 views

Generate new self-signed CA for Windows 2012 CA

Set up a Enterprise CA for Windows 2012. While generating the initial root CA, SHA512 was selected. This has proven to cause issues with TLS 1.2 that we were unaware of. I'm trying to generate a ...