In cryptography, a certificate authority, or certification authority, (CA) is an entity that issues digital certificates.

learn more… | top users | synonyms (1)

0
votes
0answers
20 views

no local computer physical store, only registry and smartcard

I'm currently encountering an issue whereby i cannot see the "local computer" physical store, under trusted root CA, when attempting to install a cert. Instead the only stores i see are "Registry" and ...
1
vote
2answers
226 views

How to change root CA certificate?

I am running an own CA for my network, just to have it installed into the browser, so that I can see if a server still has the certificate I created (vulgar: having the green lock). Of course I just ...
0
votes
0answers
27 views

Can't seem to get Apache SSL client certificate authentication working with an intermediate CA

I'm restructuring my personal CA system and trying to add an intermediate CA into the mix. I have a self-signed root CA whose certificate is imported into all appropriate browsers/OSes. I seem to be ...
0
votes
0answers
19 views

Update Root CA Certificate values (Country/location(locality)/etc)

Our Offline Root CA server was setup prior to my joining the company and has com as the country code which is invalid for several things that I'm needing to do...primarily to get clients to stop ...
0
votes
1answer
131 views

Could Certificate Authorities have been compromised by the Heartbleed bug? [closed]

OpenSSL is widely used and was affected by the Heartbleed bug for years. A lot of services were impacted and everybody is trying to recover from this bug by updating there system, generating new ...
0
votes
1answer
38 views

How should I structure my CA hierarchy?

My current setup involved a self signed root CA, which has then signed my SSL/TLS CA and my OpenVPN client CA. The SSL/TLS CA signs the certificates of my servers, and the OpenVPN client CA signs the ...
3
votes
1answer
41 views

If I get a certificate signed for ECDSA will older browsers be able to use RSA?

I'm looking into using ECDHE-ECDSA and there are a lot of great articles on why (https://hynek.me/articles/hardening-your-web-servers-ssl-ciphers/) and ...
1
vote
1answer
44 views

Windows Server 2008 R2 CA not issuing more than 2 years

I have active directory environment in 2003 R2. I have installed 2008 R2 Enterprise Edition CA. Then I have created custom template from web server template and add expiry date as 15 years. my root ...
3
votes
2answers
173 views

Why do I need to create symbolic links for certificates?

Other than noticing something like this: yourid@linuxtpf:~/certificates> ls -l lrwxrwxrwx 1 yourid users 9 2009-04-07 18:06 50a694ac.0 -> cert2.pem #<-- was missing lrwxrwxrwx 1 yourid ...
1
vote
0answers
12 views

How to include all dns records and IP address of a server in automatic certificate enrollment of Microsoft AD CS?

In my company there are a lot of servers which users remotely login to them to do their duties. We have enabled computer certificate auto enrollment for them to assure secure connection. But because ...
0
votes
1answer
11 views

Time stamped digital signatures with AD-CS

We are planning to implement a time proof digital signature solution in our intranet. Currently we have a Enterprise AD CS up and running. We are planning to use these signatures only inside our ...
0
votes
1answer
77 views

SSL on AWS? Cert installed but still having issues

We bought an SSL certificate (From Comodo) and when I visit the page in Chrome I see the green padlock and it has the following information: Your connection to ...... is encrypted with 128-bit ...
1
vote
2answers
36 views

Does a domain computer trust certs from domain CA

I have investigated this but have been unable to find a definitive answer to my question. I have never used certificate services in active directory before so am unsure of its possible ...
1
vote
2answers
21 views

How to determine if the user requested a certificate using “Mark keys as exportable”?

We have a Windows 2008 R2 running a standalone CA (certificate authority) and the web enrollment, so the users access http://[server-name]/certsrv websote for request certificates. The Advanced ...
0
votes
0answers
22 views

Windows Server 2008 Certificate Authority setup

Help!!! Our Root CA expired on 2/28/2014 and the original server has been reloaded with an OS. I am in dire need as many of our external sites are now not working - no surprise! I have not ...
1
vote
0answers
26 views

EFS file access problems

in my organization, i have a deadline to deploy EFS using AD CS, and i am working with a single windows server 2003 box, which is the Root CA, and is the same server responsible to certificate ...
0
votes
1answer
25 views

Win2008 SRV Certutil csv option not present

I have an Enterprise Certificate Authority running well. I am attempting to automate some monitoring tasks using batch files and the certutil.exe command. After reading the documentation at: ...
5
votes
1answer
70 views

How do I configure AD CS to support Name Constraints (4.2.1.11 in RFC 2459)?

I am trying to figure out how to do Qualified Subordination with the critical extension set, but I'm unable to figure out how to do this in MSFT AD CS. For a given certificate, how do I make sure ...
0
votes
0answers
26 views

certificate authority service wont start

I have this CA service issue which is not starting hence not issuing any new certificate to my wireless users, when ever we try to start that this comes back with the Bad Key. 0x80090003 (-2146893821) ...
1
vote
2answers
40 views

Which operating systems ship with StartCom_Certification_Authority.pem

I purchased some (cheap) HTTPS certificates from StartSSL. They work great on all browsers I tested. According to this post they are even recognized in IE 7 and 8, which good enough for me. However, ...
9
votes
3answers
323 views

Why issue a SSL certificate that expires in 2037?

In Firefox, if I view the Verisign Universal Root Certificate Authority, I notice that it expires in 2037. (Settings tab -> advanced -> view certificates -> VeriSign Universal Root Certification ...
0
votes
0answers
23 views

Auto-enrollment certificate without enroll permission

I am Domain Admin of a company. We implement Active Directory Certificate Services in our company for email signature and encryption. Because we have more than 1000 users in our company, we want to ...
0
votes
1answer
172 views

LDAP-based Apache auth (mod_ldap + mod_authnz_ldap) using own CA for SSL/TLS

SOLVED: Turned out problem was caused by forgotten legacy LDAPTrustedGlobalCert directives in various config files, using old certificate for the same FQDN tl;dr: We uses a self-signed CA and we ...
1
vote
0answers
78 views

ADCS WebEnrollment : The context was acquired as silent

I have setup Active Directory Certificate Services with Web Enrollment and I have the following error when enrolling certificate on other computers that are in the same domain : Certificate ...
0
votes
1answer
56 views

Is it safe to delete Exchange/IIs server certificate that is not tied to any service?

Exchange [EMC] View of certs Name: Blank Self Signed: False Status: The cert is valid for exchange server usage Services: None Subject: CN=Servername.domain.local Issuer: CN=Domain-servername-CA ...
0
votes
0answers
34 views

How to get/build a CA bundle file from a local OpenSSL CA

If I establish a standard OpenSSL CA directory structure and presence (such as by using "CA.sh -newca"), how do I get/build a CA bundle for it? I don't have anything that resembles something like the ...
0
votes
1answer
20 views

How can I get HTTPS working with this particular site?

I am trying to make an SSL wrapper to a website (and eventually redirect all HTTP requests to the HTTPS domain), on a Saucy EC2 instance. Right now Apache restarts without reported error, and it ...
1
vote
2answers
115 views

Postfix, TLS and StartSSL certificates

I recently changed my postfix installation to use TLS with a certificate issued by StartSSL. I then ran SMTP and TLS checks with no errors or warnings. Everything seemed to work fine. My problem now ...
-1
votes
1answer
48 views

How can I create a free certificate for HTTPS with Apache / Ubuntu?

I have been presently muddling with StartSSL and have found it something of a challenge. Most recently I had, I thought, created and downloaded a private key, and a certificate... but they don't ...
0
votes
2answers
37 views

Send a server certificate to a customer in pkcs?

I was asked by a customer / partner company to send them the certificate for one our webservers and the corresponding root ca certificate in .pkcs or .pem format to install it in his Riverbed proxy ...
2
votes
1answer
29 views

Does certificate-based Hyper-V replication work when the CA is offline?

We are using Hyper-V replication on Windows Server 2012+ outside Active Directory, so we are using SSL certificates issued by our own internal CA. When setting up replication, I made sure that both ...
2
votes
1answer
50 views

How to issue a cert for web hosting using ad cert authority

I need to issue a certificate for SSL binding in IIS using Active Directory Certificate Authority. As far as I understand it should have Purpose=Auth Server and contain private key/be exportable. ...
0
votes
1answer
101 views

Change certificate auto enrollment settings from long gone CA to new CA

We started getting event ID 13 from a our domain controllers: Certificate enrollment for Local system failed to enroll for a DomainController certificate with request ID N/A from ...
2
votes
1answer
68 views

In place upgrade on a Windows 2003 with Certificate services

I'm looking to do an in-place upgrade for 2 Windows 2003 servers domain controllers running certificates to Windows 2008 R2. Will it work, has anyone tried this, and will I need to do anything with ...
1
vote
1answer
438 views

Install a root certificate in CentOS 6

I know it has been already asked, but despite many hours of research I couldn't find a working solution. I am trying to install my root certificate in my server, so internal service can bind to each ...
1
vote
1answer
41 views

Anyone know of a way to find all certs that weren't auto-enrolled?

I'm in the process of moving an Active Directory Certificate Services role over to a new 2012 server. The new server will be issuing new certs and I need to find all certs that weren't handed out by ...
2
votes
1answer
45 views

OpenVPN fails while openssl verifies ok

I have recently created a new CA certificate, as the old one was about to expire. I deployed this certificate to our OpenVPN server, and on it the verification of local certificate goes ok with both ...
1
vote
1answer
60 views

LDAPS Only Works on Domain Certificate Authority and Not on Other Domain Controllers - Active Directory Certificate Services - Windows Server 2008 R2

I have 3 Domain Controllers with Active Directory role installed on them. I installed Certificate Services on one of the Domain Controllers. I am able to LDAPS to it, but not the others even though ...
0
votes
0answers
35 views

override specific DN fields when signing csr

When signing CSR on CA side, how can I override specific DN fields by custom value? I want to ignore what is written in CSR. For example in C= and O= fields and replace them by something static. Other ...
0
votes
0answers
36 views

Installing the Apple Root Certificate Authority on CentOS CLI

I could be barking up the wrong tree here, but I'm looking for help on installing Apple's Root certificate (http://www.apple.com/certificateauthority/) on a CentOS server via the command line - which ...
0
votes
1answer
121 views

Windows Server 2008 R2 creating a multi-year client certificate using the IIS certsrv page while deploying SSTP VPN

I am trying to follow instructions on Technet about deploying a Standard (non-enterprise) SSTP based VPN) that were originally written for Server 2008, but I am using Server 2008 R2, I have gotten as ...
1
vote
0answers
287 views

How do I set up an 802.1X infrastructure for use with OS X and iPads?

At my workplace I have been tasked with setting up machine certificate based 802.1X wireless authentication for our Apple devices. It seems like on the client side this will be handled by Profiles ...
0
votes
1answer
50 views

OpenVPN: Single certificate authority, multiple VPNs

The company in which I work has a single site (I'll refer it as "Site A"). There are several private networks within site A. We have a running instance of OpenVPN which allows some employees to ...
3
votes
2answers
74 views

Using our own certificate authority for business email encryption

I've read the available similar questions on serverfault but I haven't quite found a definite answer to the security aspect of it - hence here's my question: I'm administrator of an office working ...
0
votes
1answer
72 views

Windows Xp Autoenrollment Issue

i've trouble to auto enroll for Xp Clients. I setup up an two tier ca on windows 2012 and configured Autoenrollment. So far i just have been testing with Windows 7 Client and i have no issue at all. I ...
0
votes
1answer
29 views

OpenSSL not using CA directory

OpenSSL will not verify a cert $openssl s_client -connect <host>:443 ... Verify return code: 21 (unable to verify the first certificate) However, if we figure out the location of the store $ ...
0
votes
1answer
10 views

What refer/mean “Remote Server Authentication” at Apache mod_ssl doc?

The part of the doc in that such term is used is this. Can anybody give some context or explain me what mean Remote Server Authentication there? I know that Apache server can authenticate clients but ...
2
votes
1answer
139 views

Where to get root CA certificates for Windows Server now that Microsoft no longer updates them?

Microsoft removed root CA updates from WSUS in January 2013. I now have some fresh installs of Windows Server 2012 that have an insufficient set of root CAs (basically just Microsoft's own CAs). This ...
0
votes
0answers
224 views

How to configure IPSEC for windows server 2012

I am trying to configure an ipsec connection between 2 windows 2012 servers but i have some problems. I am new to windows server configuration so any help will be really appreciated. Lets start with ...
2
votes
1answer
54 views

Openvpn signing certificates with wrong CA

I have a working (until now) ubuntu openvpn server. I think that my server is using a wrong CA to sign client CRTs. E.g: I use "source ./vars" followed by "./build-key john.doe" and it all works ...