In cryptography, a certificate authority, or certification authority, (CA) is an entity that issues digital certificates.

learn more… | top users | synonyms (1)

1
vote
0answers
26 views

How do I change the expiration of CRLs with OpenSSL?

I am currently experimenting with my self signed CA. But in order for my devices to work I need a valid CRL. I set the CDP to one of the CDN hosting providers. As I have only 5 certificates issued I ...
2
votes
2answers
28 views

How do I request a certificate from CEP / CES on a Microsoft CA on OSX or Linux?

This article describes how to request a certificate from AD CS (Active Directory Certificate Services) from a non-domain joined windows computer. I would think the same principals apply to non ...
1
vote
1answer
36 views

apache ssl - unable to get local issuer certificate

Somehow just today suddenly my seafile client throwed this error. I don't believe its a seafile issue, because my openssl throws the exact same error: user@nb-user:~$ echo |openssl s_client -connect ...
0
votes
0answers
12 views

After renewing web CA, Outlook 2013 can connect to Exchange 2013 but not Outlook 2010

After renewing web CA, 2013 outlook client are able to connect to 2013 Exchange but not 2010 outlook clients? Anyone run in to this issue please advise!
0
votes
3answers
20 views

How to create a digital signature and verify it through a server

I am trying to find out a way to create a digital signature for the employees of my company and place it in a server from where they can retrieve them and attach it with any digital document (Office ...
2
votes
1answer
62 views

Setup a non-CA Puppet Master

I would like to set up an additional puppet master to act as a non-CA server. I’ve have installed and am successfully using Passenger. The servers in question are all running CentOS 6.6 and are all ...
0
votes
1answer
25 views

Using rsyslog with TLS without generating a self signed cert

Just about every guide I have seen for using TLS with rsyslog involves generating a self signed cert and using that. If the boxes are already set up with a legit signed cert how do you set up the ...
1
vote
1answer
46 views

Exchange 2010 to Exchange Online cutover migration error

I am in the middle of an Exchange 2010 to Office 365 cutover migration and i keep getting errors when trying to create a migration endpoint on Office 365 hence the migration can't progress. I have ...
1
vote
1answer
35 views

How to maintain revokation list for client certificates

I have a website running in Windows Server 2012, IIS. User's are authenticated using client certificates. I used to issue client certificates using Certificate Authority MMC snap-in. Since the ...
-1
votes
1answer
57 views

What type of SSL certificate I need to create CA? [duplicate]

I've a task to create Certificate Authority for company use. Preferably using "valid" ( not self-signed) certificate. The goal is to issue individual certificates for subdomains, instead of wildcard, ...
2
votes
1answer
46 views

W2012 R2 AD certificate Services sha algorithm

So shortly after configuring an offline root CA and online AD subordiante CA with SHA512 for future proofing. We discovered a thin client vender (teradici zero client with View 6) only supports SHA1 ...
2
votes
1answer
69 views

Removing Certificate Authority

I'm trying to rename an old server ( 2008 R2 Standard) of ours that will be used for a SQL DEV(Used to be old prod), but the options to change computer name/domain is greyed out. I found that it's ...
0
votes
0answers
49 views

haproxy client certificate authentication signed by 'common' CA

I am setting up haproxy as an SSL terminator/load balancer in front of an API that we need to expose over the internet to a customer. The plan was to use mutual (2-way) SSL/HTTPS to verify that both ...
4
votes
2answers
179 views

Should I need to provide a root certificate when setting SSL cert on nginx

In Qualys SSL test always warn me that the root certificate is an extra download and can be safely removed. However, from Comodo website, their guide on installing cert on nginx is NGINX Needed for ...
0
votes
1answer
78 views

Windows server 2008 R2 Certificate Authority error event viewer

I am getting the error "The windows default policy module initialize method returned an error. The specified domain either doesn't exists or could not be contacted the error code is 0x8007054b. The ...
0
votes
1answer
68 views

Automatic S/MIME certificate distribution/outlook integration for signed/encrypted email

I have a Windows Server 2008 R2 Machine and an Exchange 2010 Server on two seperate machines. The WS2008R2 machine is configured with a certificate authority in which I have configured certificate ...
7
votes
2answers
237 views

Enable Certificate Enrollment Policy and Request a Cert using PowerShell

Right now, I'm doing the following to request a cert from a CEP server: Open gpedit.msc Under Computer Configuration > Windows Settings > Security Settings > Public Key Policies, double click ...
3
votes
1answer
91 views

Where does a Windows Certification Authority store its root private key?

I have a Windows Server 2012 R2 Enterprise Root Certification Authority on a Hyper-V virtual machine which, due to currently unkown reasons, doesn't boot anymore. I don't know if the VM will ever ...
1
vote
1answer
106 views

Squid: how to enable verification for SSL self-signed certificates

I'm using Squid 3.4.8 as a reverse proxy which is forwarding request to a specific server. The communication between Squid and the server is in HTTPS. The certificate used by the server is ...
3
votes
1answer
87 views

Wildcard cert for local SSL Certificate Authority?

This seems like it should work, but PKI is complicated and I'd like to ask people who can give an authoritative answer. BACKGROUND: I am the network engineer for a company; for sake of argument ...
0
votes
0answers
72 views

setup SSL with CA for multiple local sites in Apache and authenticate in a specific location (Error code: ssl_error_handshake_failure_alert) Ubuntu

i'm trying to implement SSL (HTTPs) on my local web-server to protect specified directories on Apache's websites where a user log's-in, combining SSL and HTTP Authentication Basic. I have follow ...
5
votes
2answers
80 views

Does the “Enterprise PKI” MMC allow for any automated testing of the PKI?

I'm using the Enterprise PKI snap in to diagnose and check the health of a MSFT PKI system. Is there any way to script/automate this tool to alert me to the pending expiration of a CRL or missing ...
4
votes
1answer
147 views

Allow users to install certificates in their home directory?

Usually SSL certificates are installed system-wide (e.g. in /etc/ssl/certs). Is it possible to configure OpenSSL in a way that allows user to put certificates in their home directory (for example in ...
2
votes
1answer
71 views

Dovecot SSL Certificate is not accepted

I have certificates issued from StartSSL, which is a trusted authority for certificates, and my websites work with its certificates with no problems and no complaints from all browsers about any trust ...
0
votes
1answer
26 views

Trust Internal CA on WES7

We have set up an RDS farm with a certificate issued by our internal Enterprise CA. I'm trying to connect some Wyse thin clients to it running WES7, however it reports a certificate error as the thin ...
4
votes
1answer
72 views

What is the purpose of a custom Certificate Trust List?

You can create and deploy a certificate trust list as detailed here, but I'm trying to understand the advantages of this over just deploying root and intermediate certs with group policy the normal ...
1
vote
0answers
17 views

Can OpenDirectory on OS X reasonably be configured to use an intermediate CA cert from an existing CA?

We're trying to set up OpenDirectory. It seems to want to create its own CA, and then an intermediate CA with a certificate signed by its own CA. I'd prefer to generate an intermediate CA certificate ...
1
vote
0answers
48 views

How to setup digital signatures on Microsoft CA (AD-CS)?

I've been trying to research across the web on how to setup a Microsoft CA (AD-CS on Windows Server 2008 R2) in order to create a certificate for digital signatures, allowing you to digitally sign ...
1
vote
0answers
282 views

How to replace Zentyal CA certificates and key with an already existing CA

The context: we're using a CA which is deployed on all our client machines, and a lot of hosts and web servers. It seems that Zentyal CA module only allows to issue a new CA using the GUI, but not to ...
0
votes
0answers
177 views

How can I resolve element not found in AD CA?

I had to move our AD CA from server 2008 32bit to server 2008r2 64bit, both domain controllers too! I now know this was BAD. Is there any way to resolve the "Element not found" in AD CA? Or do I ...
1
vote
1answer
188 views

New root CA will not list schema version 2 & 3 certificate templates

I'm trying to decommission a Server 2008 machine that hosts DC, NPS, and CA. I've deployed two new servers to take over as root CA and RADIUS server (both new servers are 2012R2). The new root CA is ...
1
vote
2answers
221 views

'Turn off Automatic Root Certificates Update' and 3rd party root certificates

The group policy setting 'Turn off Automatic Root Certificates Update' prevents Windows from deleting certificates that it cannot verify. If a third party has provided me with their own self-signed ...
1
vote
1answer
557 views

Trusted root certificate being automatically removed from store

I have a trusted third party's root certificate. I install this to the 'Trusted Root Certification Authorities' certificate store in Windows Server 2008, but it disappears from the certificate store ...
0
votes
2answers
53 views

New SSL Cert causes no connection to website on POST from web application

I have a web application which will not connect to a website to POST after they changed their SSL cert. The URL and REF post is mentioned below. Is there anything else I should try on the server? ...
0
votes
0answers
24 views

SQL Client failing SSL certificate encryption under a AD Domain

I have a client machine (web server) that is attempting to connect to a SQL server. The SQL server is 2008 and has the force encryption flag turned on. Both servers are joined to the domain. The ...
1
vote
0answers
77 views

Remote Desktop Certificate Template Application Policy Extension

We are setting up remote desktop authentication with the use of certificates and ran into an issue in one of the environments. I am editing the RemoteDesktopComputer2008 certificate template, in ...
2
votes
1answer
91 views

Why does Windows CA Server issue multiple certificates for the same user?

I am currently implementing an EAP/TLS WIFI implementation to replace our EAP/MSCHAP2 wifi implementation. I am using Windows Server 2008 and I've installed a certificate authority. User certificates ...
1
vote
1answer
51 views

Add issuing CA to online root CA windows 2008 r2

we have an existing internal root CA standalone that issue certificate for our domain mycompany.com. We have multiple certificate installed all over the company from this CA. The problem we're facing ...
0
votes
1answer
115 views

Root certificate invalid on a WHM site [closed]

I am a newbie in SSL certificates and was given the task on troubleshooting a site's WHM page that uses https but it displays an red "x" on the https section of the URL. On Google Chrome, details of ...
1
vote
1answer
65 views

Unnecessary Certificate Authority in Domain

I have an organization with a file server that is a secondary domain controller(2003 R2), an Exchange server(2008 R2), and a primary domain controller(2008 R2). We also have what used to be the ...
2
votes
2answers
1k views

OS X Not Trusting Thawte Primary Root CA - G3

We recently renewed our Nginx webserver's Thawte SSL certificate. Previously we'd been using SHA1 as the signing algorithm, but this time used SHA256 which leads to a new root certificate known as ...
0
votes
0answers
12 views

Publishing extra AD CA CRLs for clients

I am attempting to configure Workplace Join in my Lab Environment. I have my AD CS infrastructure in place and have configured an additional CDP/CRL list with an accessible DNS name for non-domain ...
1
vote
0answers
319 views

Unable to convert JKS keystore to Oracle Wallet using orapki

I have generated jks keystore using keytool and using the jks keystore I have csr. The same csr I have sent to Signing authority. The Signing authority have given the trusted ...
-1
votes
1answer
214 views

FreeRADIUS certificate is going to expired

Recently I've created a RADIUS server (Freeradius) that authenticate with Active Directory. I follow this link to create this server: Now, when I see the "server.cnf" file into /etc/raddb/cert , I ...
1
vote
1answer
72 views

Adding OCSP and NDES into existing environment? What can be installed together?

Currently have one offline CA and one Sub Issuing CA that just has the Web Enrollment installed. Looking at also implementing NDES and OCSP. I know the web enrollment can be installed on the Issuing ...
0
votes
1answer
103 views

How can I generate a non ec private key from openssl via Windows?

I'm experiencing different behavior with an openssl from a linux host and a windows host. I have a pfx that I generated via a windows ca. I use openssl to dissect that pfx to create 3 pem files (ca ...
2
votes
1answer
568 views

Windows CA and .pfx Files

What is the proper way to obtain a certificate, ca cert, and private key (aka .pfx file) from a Windows CA via command line? The way I've been doing it is I create a request file using notepad with ...
0
votes
1answer
186 views

ADCS Create a new certificate or Rename?

Just joined a new company. Apparently back last year they got rid of the old CA and restored the certificate on a new server. (2003 to 2012). I was about to renew the certificate (self signed) on the ...
2
votes
1answer
384 views

Certificate revocation check fails for non-domain guest in spite of accessible CRL

When we try to use certificates on computers that are not part of the domain, Windows complains that The revocation function was unable to check revocation because the revocation server was ...
2
votes
1answer
924 views

Difference between ca-bundle.crt and ca-bundle.trust.crt

On CentOS 6.5, in /etc/pki/tls/certs I have: ca-bundle.crt and ca-bundle.trust.crt With different file sizes. Which should I use as the trust path for nginx proxy_ssl_trusted_certificate.