Active Directory Certificate Services is a role first made available in Windows Server 2008. Previously it was known as certificate services.

learn more… | top users | synonyms

1
vote
1answer
20 views

Cross Forest Certificate Authority

Looking for help on material for setting up a multi tiered/cross-forest PKI Infrastructure. The only articles I can come across are just setting up the basic two tier systems on one domain. Basically ...
2
votes
1answer
3k views

New Domain Controller Cannot Enroll for KerberosAuthentication Certificate

I have an AD domain. 2003 FFL/DFL. The schema was upgraded to version 56 for Server 2012. The domain contains a mix of domain controllers from Server 2003, Server 2008, Server 2008 R2, and now Server ...
1
vote
2answers
21 views

Issuing own certificates for signing software

We have a windows based infrastructure. Recently I was asked by our software developer if we can issue our own certificates to sign some small programs we're sending to out partners. But I don't fully ...
0
votes
0answers
4 views

Windows ADCS Schannel event ID 36682 on computers

I have a 2 tier PKI hierarchy which contains an offline ROOT Certificate Server ( un-joined to the domain) and Enterprise Sub CA servers. We are using EAP-TLS method for authentication to corp ...
3
votes
1answer
3k views

Signing a Java Deployment Rule Set JAR using AD Certificate Services

I am tasked with deploying Java 7 Update 55 along with a Java Deployment Rule Set to all Active Directory Windows clients. I've managed to get a solid Java software deployment setup but I'm now ...
1
vote
1answer
47 views

Best Certs to use for internal https [duplicate]

I'm helping out a large church with some IT stuff they have lots of internal secure connections, like to the security cameras, or to the UniFi AP controller that want to use https. Of course each of ...
0
votes
1answer
1k views

Unable to renew certificate in certmgr.msc in windows 2003

I am trying to renew a certificate using CertManager on Windows 2003 Server. (I have also used the certificate plug-in in MMC but its the same thing.) I am logged in with the Administrator account. ...
1
vote
1answer
1k views

Fixing “server unavailable” login problems in exchange 2013 and outlook 2010

We've been facing some problems pertaining to expiring user passwords, causing "server unavailable" login problems for Outlook Outlook 2007 and 2010 clients on exchange 2013. The quick fix to this was ...
5
votes
1answer
1k views

certutil -ping fails with 30 seconds timeout - what to do?

The certificate store on my Win7 box is constantly hanging. Observe: C:\>1.cmd C:\>certutil -? | findstr /i ping -ping -- Ping Active Directory Certificate Services Request ...
2
votes
1answer
43 views

Is capolicy.inf processed in full (or part) during server install, renewal, and issuing new certs

When installing a Windows CA, capol.inf confuses me. It seems that capol.inf does set defaults for the CA that can otherwise be done using certutil's registry functions (or regedit). It also ...
4
votes
1answer
47 views

Re-install ADCS CA Certificate & CRL on Workstation

I installed Active Directory Certificate Services and created a Standalone CA. Everything went fine and it automatically installed the CA certificate and CRL on all my domain workstations. On one of ...
5
votes
1answer
750 views

How to add custom OID for subject field on certificates issued by Windows Server 2008 R2 CA?

I'm using a Windows Server 2008 R2 domain controller with Active Directory Certificate Services installed. It's configured as an Enterprise Root CA. I have configured a custom certificate template so ...
1
vote
0answers
27 views

How does one create a certificate request for a managed service account in Windows?

I have a managed service account which needs a certificate in its personal store for decryption. I tried opening the Certificates snap-in and pointing to the service, but when I right-click on the ...
0
votes
0answers
144 views

Linux client for pki certificate auto enrollment from Windows CA

I just set up a Windows Server Certificate Authority. I would like to auto-enroll Ubuntu Linux computers for certificates. Can anyone share the available client options? I found this (old) technet ...
0
votes
0answers
144 views

Windows Server 2008R2 Certificate Services will not start Error Code 0x80090011 (-2146893807)

For no apparent reason that I can find our server 2008 r2 server, which is our ca service has stopped. I have tried to restart it, but when I do, it says object not found. When I check the event ...
1
vote
1answer
38 views

How do I get alerted to an pending AD CS certificate request?

I want to get a summary report of pending AD CS requests. How would I approach this? Does anything already exist? The problem I'm trying to solve is where a user requests a certificate, and i'm ...
1
vote
0answers
307 views

Server 2012, Attempted to Install Certificate Services, now Win-RM is broken

I have two exchange servers, one running Exchange 2007 and one Exchange 2010. On the Exchange 2010 I attempted to install a AD-Certificate role but after installing the role I am unable to run the ...
0
votes
2answers
55 views

How to Configure Windows Certificate Services not to use AIA and CRL when issuing Certificates

I have a Windows Certificate Service installed on a Windows Server 2008 R2 VM, and what I need to do is to modify certificates NOT to use AIA and CRL, but to ONLY use OCSP Responder. The OCSP is ...
1
vote
1answer
202 views

How can i create an install a domain signed certificate in IIS using PowerShell?

In my environment we host a whole lot of websites and WCF webservices in IIS (on Windows 2008 R2 and Windows 2012). We are in the process of enabling HTTPS on these sites. This goes as follows: ...
0
votes
0answers
303 views

Windows 2008 Web Enrollment Fails The RPC server is unavailable. 0x800706ba (WIN32: 1722)

I am setting up an RA and a Subordinate CA who is also an AD. I can issue certs through certutil and the mmc snap-in with no problem. But when I try using Web Enrollment in the RA, it fails saying ...
0
votes
0answers
302 views

Problematic Active Directorys CA certificate

i came across one DC, which gives me RPC errors when dealing with AD Certificate Service.I can see in AD there is 2 Root CA , one is problematic. Is it safe to remove it? Or is there a procedure for ...
2
votes
1answer
2k views

My Windows CA (certificate authority) main cert is expiring next week, what do I do?

I went ahead and renewed the Certificate Authority itself (right click the CA, all tasks, renew), using the same public/private keys. Do I need to do anything else to make sure things don't start to ...
4
votes
4answers
20k views

Java Deployment Rule Set via AD Enterprise CA

My goal is to get a Java Deployment Rule Set in place in my organization, but I do not want to pay third-party certificate authority for a code signing cert when we have a working CA running through ...
5
votes
2answers
140 views

Does the “Enterprise PKI” MMC allow for any automated testing of the PKI?

I'm using the Enterprise PKI snap in to diagnose and check the health of a MSFT PKI system. Is there any way to script/automate this tool to alert me to the pending expiration of a CRL or missing ...
3
votes
1answer
442 views

Where does a Windows Certification Authority store its root private key?

I have a Windows Server 2012 R2 Enterprise Root Certification Authority on a Hyper-V virtual machine which, due to currently unkown reasons, doesn't boot anymore. I don't know if the VM will ever ...
5
votes
3answers
609 views

In a Windows PKI, what is a Workstation Authentication CA Template used for? What happens if it expires?

Many workstations have an expiring computer certificate that was issued using the Workstation Authentication CA template. The CA of this template expires in 2 days. I've deployed a new CA, with an ...
2
votes
3answers
562 views

Run `certutil -DCInfo` on a different target domain

It seems that running certutil.exe -DCInfo Verify will check the certificates for all domain controllers in the domain of the logged-in user account. In our AD forest, we have a handful of domains. I ...
5
votes
1answer
128 views

Generate new self-signed CA for Windows 2012 CA

Set up a Enterprise CA for Windows 2012. While generating the initial root CA, SHA512 was selected. This has proven to cause issues with TLS 1.2 that we were unaware of. I'm trying to generate a ...
4
votes
1answer
4k views

CA and Primary Domain Controller on the same server

I am setting up a Microsoft AD to be my CA. After research, it looks like I need to have a domain controller before I can issue certs thru the CA. Would it be possible to place both the CA and the DC ...
4
votes
1answer
339 views

What is the purpose of a custom Certificate Trust List?

You can create and deploy a certificate trust list as detailed here, but I'm trying to understand the advantages of this over just deploying root and intermediate certs with group policy the normal ...
1
vote
0answers
113 views

How to setup digital signatures on Microsoft CA (AD-CS)?

I've been trying to research across the web on how to setup a Microsoft CA (AD-CS on Windows Server 2008 R2) in order to create a certificate for digital signatures, allowing you to digitally sign ...
0
votes
1answer
164 views

Auto-enrollment certificate without enroll permission

I am Domain Admin of a company. We implement Active Directory Certificate Services in our company for email signature and encryption. Because we have more than 1000 users in our company, we want to ...
2
votes
1answer
251 views

Submit a certificate request file from a non domain computer. How to figure out policy server parameters

I'm trying to submit a certificate request. I'm trying to do it from command line so I can run it from code. Previously I have done it by using the Microsoft Active Directory Certificate Services for ...
6
votes
1answer
683 views

Protecting credentials in Desired State Configuration using certificates

I'm new to DSC and trying to figure out how to make it work for us. What I'm stuck on is how the credentials are actually protected. My current understanding is that it isn't all that great. The big ...
0
votes
0answers
14 views

Publishing extra AD CA CRLs for clients

I am attempting to configure Workplace Join in my Lab Environment. I have my AD CS infrastructure in place and have configured an additional CDP/CRL list with an accessible DNS name for non-domain ...
0
votes
1answer
315 views

ADCS Create a new certificate or Rename?

Just joined a new company. Apparently back last year they got rid of the old CA and restored the certificate on a new server. (2003 to 2012). I was about to renew the certificate (self signed) on the ...
1
vote
1answer
194 views

PKI - Cert Template could not be loaded. This function is not supported on this system

I've built PKI's many times yet this organization's results have me puzzled. Offline Root 2008 R2 Standard 2xEnterprise Subordinate CA's 2008 R2 Enterprise Installed services, all is good. When I go ...
2
votes
1answer
759 views

Certificate revocation check fails for non-domain guest in spite of accessible CRL

When we try to use certificates on computers that are not part of the domain, Windows complains that The revocation function was unable to check revocation because the revocation server was ...
0
votes
1answer
413 views

How to move CertSrv from “Default Web Site” to a new site in IIS?

I have installed Active Directory Certificate services and it has created a CertSrv application under "Default Web Site" and it is accessible using http(s)://[hostname]/certsrv. I want to move ...
1
vote
1answer
45 views

Migrating certificate services to Server 2008 R1

I am currently planning a move of an Active Directory Certificate Services CA from a soon to be decommissioned Server 2003 R2 Standard box to an existing Windows 2008 R1 Enterprise box. This is not ...
1
vote
0answers
127 views

Windows - Replace subject from CSR when issuing certificate

I've received a CSR from a client with a CN, but not with all the subject fields we require. According to this answer from Scott*, it should be possible to specify the final subject values when the ...
0
votes
0answers
196 views

MS CA “certutil -deleterow” not doing anything

I'm trying to cleanup old and failed certificates on my CA using certutil. I'd like to delete all failed requests prior to July 1st, 2014. I'm running the following: certutil -v -deleterow 7/1/2014 ...
1
vote
1answer
63 views

How can I limit the SMIME capabilities from a CA without using FIM?

These instructions describe how to prevent using SMIME with weak ciphers, however it requires an expensive product from Microsoft. How can I prevent a CA from issuing SMIME certificates that permit ...
2
votes
2answers
141 views

Can a single ADCS instance “hold” more than one PKI namespace?

I want to save on OS license, simplify CRL renewals and have more than one certificate instance on a given server. For me, this makes sense from a security perspective because I have: One CA that ...
3
votes
1answer
634 views

How can I get an OID for a certificate template?

I'm using C# (or VBScript) to issue a certificate from an Enterprise CA. According to this answer, I need to specify the OID instead of the certificate name, and place it in an unexpected portion of ...
0
votes
2answers
201 views

What is the impact of upgrading Windows 2008 R2 Standard to Enterprise?

I have a Windows Server 2003 domain controller, a Windows Server 2008 R2 Standard domain controller, and a Windows Server 2012 domain controller. I am looking to upgrade the 2008 R2 Standard DC to ...
1
vote
1answer
286 views

ADCS - How can I diagnose the exact reason a certificate request was denied by a policy module?

I need to develop operational procedures to audit and understand why a specific request was rejected by an Active Directory Certificate Services (ADCS) Policy Module. I've attempted turning on all ...
0
votes
1answer
67 views

Windows Server Certificates external domain

recently setup certificate services on a windows server 2008 internal network. I setup certificate services, generated the certificate, put it in the domain's trusted certificate folder and applied ...
3
votes
1answer
2k views

AD CS: Certificate Template not available

In short, a Certificate Template I want to use is not available for enrollment. The template in question is a copy of the "RAS and IAS Server" template. What's frustrating is that I've gotten this ...
1
vote
0answers
80 views

MySQL SSL Problems

I need to configure SSL for a MySQL server. I've read all of the directions for doing self-signed certs but it's preferred that I sign and use the certs from a different CA running AD Certificate ...