3
votes
1answer
239 views

802.1x certificates, EAP-TLS, RADIUS and Windows machines

When using 802.1x certificate-based authentication on Windows machines, should I use different certificate for each machine? There is RADIUS server running in the network, the machines use EAP-TLS to ...
0
votes
1answer
81 views

Unable to install Network Deployment Enrollment Services (NDES)

I'm trying to install NDES on a Win2k8 R2 server, but I can't see the option. I've already added a user to IIS_IUSRS, and that user as sufficient priveleges since it is a part of the Administrator ...
2
votes
3answers
90 views

Use personal SSL Certificate created on my own?

I'm new to SSL Certificates. I've seen some tutorials about creating personal certificates but I didn't go far reading. It seems that I can create a personal SSL Certificate and use it on my website, ...
2
votes
1answer
60 views

How to securely connect to multiple different LDAPS servers (Debian)

I'm trying to connect to multiple different LDAPS servers. A lot of the documentation I've seen recommends setting TLS_REQCERT never, but that strikes me as horribly unsecure to not verify the ...
1
vote
2answers
69 views

Certificate Security in intranet Environment?

We have this topology in our company : A new rule says that each document being sent by outlook should be encrypted. we decided using PGP. We already have a certificate ( self signed). the ...
1
vote
1answer
271 views

Certificates compartments (certmgr.msc)?

After reading a while , Im trying to understand what kind of certificates will be found at : Personal Other People Trusted Root Certicfiation Authorities will personal will contains only private ...
3
votes
1answer
737 views

How do I go about Improving wireless security at the office (Radius? Certs?)

EDIT 1: Our environment is mixed, majority OSX with a few Windows and Linux boxes. More importantly, Android and Apple cellphones will also need wireless access on a regular basis. We have a redhat ...
0
votes
3answers
651 views

Purpose of the x509 certificate in metadata files on the IdP side (SSO structure)

In order to implement SSO, I have been working with some IdP and a Shibboleth SP install without being able to answer this question. On the IdP side I have a few metadata files that describes some ...
5
votes
2answers
243 views

Safely install MDM Certificate in MDM Server

I am new to server technology.I know how to obtain an Apple iOS MDM Certificate and to use Apple iOS MDM features, we must: 1. Join Appleā€™s iOS Developer Enterprise Program. 2. Enroll 3. Register ...
1
vote
1answer
231 views

Issuing client certificates to customers

What's the best approach for issuing client certificates to customers? Should we run our own certificate services (we're on Win 2008 R2), and issue them that way? Is there a CA that will issue them ...
2
votes
1answer
162 views

Is KB2641690 required on W2K3 running IE6

KB2641690 is an update to the Microsoft Untrusted Certificate Store but it not detected as required by MBSA. It is not installed on my machine and does not appear to be superseded by anything. Any ...
6
votes
2answers
3k views

How to allow RDP access based on client certificate

How can I limit (RDP) access to a Windows Server not only by username/password but also with a client certificate? Imagine creating a certificate and copying this to all computers from which I want ...
1
vote
1answer
58 views

Security Certificate Exception

I am dealing with a small issue of certificate. In our wifi hotspot, every user is given a different username and password. In order to access any website, after connecting to wifi, login credentials ...
2
votes
1answer
143 views

Setup wifi router to allow connection only when a certificate is installed

I'm not sure if this is in scope of SF, but I'd like to setup a router so that it will only allow connections when a certain certificate is available on the client machine. The question is - is it ...
0
votes
2answers
345 views

How to use a shared key and certificate for all users with OpenVPN?

I have an OpenVPN server which authenticates to an Active Directory and asks therefore each user for a username and passphrase. On top of that it also requires each user to have a client certificate ...
2
votes
2answers
228 views

Sensibility of using generic client keys with openvpn in this scenario

I have configured a working openvpn server (ubuntu 10.04) and client, no problems. I generated certificates and key files and such like for a client machine. We deploy a number of these generic ...
1
vote
1answer
151 views

Create Mobile Device Management Server for iPhone Management on Windows Server

I need to create Mobile Device Management server to manage my enterprise's iPhone devices. I need to configuration it on Windows 2008 server. What are the steps to configure Mobile Device Management ...
0
votes
2answers
104 views

ssh - keys and password

I've gotten keys (certificates) working correctly, but as it is, it's more of a "convenience" thing. (which I love). But as far as security, someone can still use a password to login. What's a good ...
2
votes
2answers
87 views

ssl communication handshake question

During SSL communication, the server sends its certificate to the client for authentication. Optionally, the client could send its certificate too, for client authentication. My question is, does the ...
1
vote
1answer
161 views

Considerations for certificate revocation for intermittently isolated ad-hoc networks

I'm trying to decide on a certificate revocation strategy for a solution I'm designing (that will utilize Dogtag PKI, per customer request). The obvious choices seem to be using a CRL or using OCSP. ...
0
votes
1answer
734 views

A non interactive alternative to makecert

I have a need to create a self signed certificate non interactively. Unfortunately, the only tool that I know of (makecert) is interactive - it uses GUI to ask for a password. My OS is Windows (from ...
3
votes
1answer
810 views

certutil -ping fails with 30 seconds timeout - what to do?

The certificate store on my Win7 box is constantly hanging. Observe: C:\>1.cmd C:\>certutil -? | findstr /i ping -ping -- Ping Active Directory Certificate Services Request ...
11
votes
1answer
9k views

How to inspect remote SMTP server's TLS certificate?

We have an Exchange 2007 server running on Windows Server 2008. Our client uses another vendor's mail server. Their security policies require us to use enforced TLS. This was working fine until ...
8
votes
2answers
3k views

Free OCSP server for testing purposes?

Can anyone recommend a free and simple OCSP server for Windows or Linux?
6
votes
6answers
287 views

Certificate Authentication

I am currently working on deploying a website for staff to use remotely and would like to make sure it is secure. I was thinking would it be possible to set up some kind of certificate ...
3
votes
3answers
16k views

'Certificate types are not available' When creating computer certificate?

Environment Windows Server 2008 sp1 Xeon CPU E5430 @ 2.66 GHz 16.0 GB Ram 64-bit Operating System 1TB Disk Space Server Role: SQL Server Other Information: Joint to domain, Logged in user domain ...
4
votes
2answers
1k views

How to protect an SSL certificate (Apache/CentOS)

I currently use a server SSL certificate without a pass-pharse in order to allow Apache to start up unattended. There are signs from customers to require us to protect the SSL certificate more ...
2
votes
3answers
4k views

Website security certificate warnings in IE8 Windows 7 (64bit), fine in Firefox

We received new computers for use in the office (Dell Vostro). They seem to work fine for the most part but when we use IE8 to go to some websites, such as Yahoo! Mail, it tells us: There is a ...
0
votes
1answer
3k views

IIS6 - install SSL certificate - pem file

Consider the need to secure a website under IIS 6 / Windows 2003. Here are the steps taken: Created a private key by OpenSSL: openssl genrsa -des3 -out filename.key 2048 A CSR was created by ...
7
votes
3answers
279 views

Does a CA require a full-time administrator?

At my place of employment, we have skated by over the years without having an internal Certificate Authority. This has worked for us because there was no visible impact by not having trusted entities. ...
0
votes
2answers
127 views

How could I digitally sign LDAP data?

How could I digitally sign LDAP data? I want to make an LDAP request from a user machine to a proxy server that then relays the request to an LDAP server. The LDAP server would then respond with the ...
1
vote
2answers
1k views

IE7 stops sending client SSL certificate

We use client SSL certificates to secure web-based user communications with our web server (the edit site for a SharePoint site). Certificates are generated internally and sent to users to be ...
9
votes
4answers
3k views

How to manage a web servers SSL private key protection (password vs. no password)?

We have a discussion in my company's security group about what's the worse of the following options to manage SSL private key. The web server needs access to the private key for the encryption ...
9
votes
2answers
9k views

How do I deploy an internal certificate authority?

IE7 aggressively warns about certificate failure; we have some internal sites that run over HTTPS and thus need a valid cert. We appear to have an certificate authority on the intranet that can sign ...
1
vote
2answers
164 views

What is the best way to run SSL with Apache HTTPD in an app you distribute?

Let's say you have a web app and you distribute an embedded Apache HTTPD with that web app. It's difficult to manage customers that want to run SSL. The best way appears to be to let the customer ...