In cryptography, a certificate authority, or certification authority, (CA) is an entity that issues digital certificates.

learn more… | top users | synonyms (1)

0
votes
0answers
6 views

Microsoft Windows 2012R2 Certificate Authority performance degredation

I am developing a program that requests certificates from the Windows 2012R2 CA and during this process I have noticed the time taken to service these request is taking longer. At present I am ...
0
votes
0answers
8 views

How to Create Certificate for ip printers in Local CA [closed]

we have Local Microsoft Certificate Authority Installed . i need to create a certificate for ip printer which i can import in the printer browser page . please provide me steps .
0
votes
1answer
27 views

Migrating PKI and CA of a Domain Controller that needs to be demoted

I have a Domain Controller that for some reason beyond me has ADCS installed on it. The domain controller is a 2008 R2 server and needs to be demoted, but first I need to do one of two things. This ...
-1
votes
1answer
37 views

This server's certificate chain is incomplete

After running a test on SSL Server Test, I got This server's certificate chain is incomplete. Later I read in orange: Chain issues Incomplete, Contains anchor. I tried to understand what was wrong ...
0
votes
0answers
13 views

Windows CA - Pending Request created during reboot

Each time a machine reboots in our environment (Windows Server 2012R2), certificate request is created under "Pending Requests" on the Certificate Authority server. It is the same Certificate ...
2
votes
1answer
35 views

MySQL SSL Connection

I'm trying set ssl connection with MySQL Server. I've read this and many more articles https://dev.mysql.com/doc/refman/5.7/en/using-secure-connections.html There is one thing i still don't know, ...
0
votes
0answers
29 views

Invalid CRL distribution points in certs after CA migration

I have recently migrated an Enterprise CA from a Windows Server 2003 box to a Windows Server 2012 R2 box using the Active Directory Certificate Services Migration Guide. The CA was running entirely ...
1
vote
1answer
76 views

E-mail address for Certificate Signing Request

Should an e-mail address in a Certificate Signing Request (CSR) for a server with a domain name aaa.bbb.ccc.ddd contain exactly all domain zones or it can be MyName@ccc.ddd (in other words, just an ...
0
votes
1answer
31 views

PKI SHA1 Upgrade - Thumbprint Algorithm Explanation

PKI SHA1 Upgrade - What is the difference between the Signature Algorithm and the Thumbprint Algorithm?
1
vote
1answer
47 views

OpenSSL - Add Subject Alternate Name (SAN) when signing with CA

How can I add a Subject Alternate Name when signing a certificate request using OpenSSL (in Windows if that matters)? I've generated a basic certificate signing request (CSR) from the IIS interface. ...
0
votes
1answer
101 views

how do I covert a certificate with extension .cer to .asc

I have a certificate file (with extension .cer) that has content which looks something like this. -----BEGIN CERTIFICATE----- lots of data here -----END CERTIFICATE----- It is our signing ...
1
vote
0answers
46 views

network device enrollment service greyed out

I've recently installed AD Certification Authority on one of our DCs. It acts as a subordinate enterprise CA, the Root CA is a standalone offline root CA and there is no connection between those two ...
2
votes
1answer
28 views

Finding Certificate Template in Certificate Authority

I'm following this tutorial: https://technet.microsoft.com/en-us/library/dn781428(v=ws.11).aspx I am on this step: Click to select the Certificate Templates container (under the CA name, not the ...
0
votes
1answer
22 views

Can SHA-1 certs exist in a SHA-2 Microsoft Certificate Authority during migration?

I'm starting the process of migrating our internal Microsoft certificate authority to support SHA-2 and haven't been able to find out an answer on the ramifications of this process. I have found the ...
30
votes
1answer
2k views

Trusting an untrustworthy CA - Can I restrict how system trusts it?

(Posted to ServerFault instead of StackOverflow because I feel it concerns OS configuration more than programming code). I'm currently responsible for maintaining a system which connects to a third-...
0
votes
2answers
56 views

Common way to adminstrating ca-certificates on linux?

I have to administrate a bunch of linux machines (server and clients) with different distributions. We want to use docker in the future, so it may be, that there would be more different distris in the ...
1
vote
2answers
78 views

Do web Servers send the certificate chain to the Web Client?

If my web server (latest Apache) has a valid (not expired or revoked) Verisign certificate chain (root -> intermediate -> leaf/my server), then does the server send the entire(?) chain to the client? ...
0
votes
2answers
15 views

automatic redirect in HTTPS for users which recognised CaCert authority

I use CaCert certificates for my domains. I want to redirect my users to HTTPS only if they recognised the CaCert authority. What is the best way to do this ?
1
vote
1answer
151 views

OpenSSL on Debian 8 can't authenticate certificates from Akamai (GTE/Baltimore CyberTrust Global Root)

On Debian 8.4 (with ca-certificates package) openssl doesn't seem to know about CAs required to verify connections to Akamai signed by "GTE CyberTrust" and "Baltimore CyberTrust". The GTE CyberTrust ...
1
vote
1answer
73 views

PKI EJBCA : extract CA from EJBCA instance and just keep sub-CA

I'm looking for a solution to extract the CA from EJBCA instance, put it on an external drive, which is secured in a safe-deposit for instance. So I only keep the sub-ca for signing the end user ...
1
vote
1answer
64 views

Unable to start Active Directory Certificate Services afer migrating from 2003 to 2012 R2

I was in the process migrating our CA from a 2003 server to a 2012 R2 using this guide After a server restart the CA service will no longer start. I receive error 21: The device is not ready. Is it ...
0
votes
2answers
43 views

Does Root CA need to be online?

I am trying to setup an IPv6-only Exchange Server 2013, running on Server 2012 R2 Datacenter. This is a 1-machine-setup in a VirtualBox for testing purposes. Everything is running ok so far. I.e. I ...
1
vote
0answers
31 views

OpenSource PKI Solution : user feedback and advices [closed]

I work on securing data exchange over the Internet. We plan to use a VPN together with certificates to authenticates users. To do so I've identified various PKI solutions. EJBCA : Installed and ...
0
votes
0answers
18 views

Windows: Verifying intermediate CA on dark network with keystore (.kdb)

Background: We have Windows Server 2012's (Server A and B) whose Internet Explorer (IE) connects to RHEL's Apache server (IBM HTTP Server). PKI: Apache serves a certificate whose intermediate CA was ...
2
votes
1answer
62 views

HTTPS not working with two intermediate certificates

Iʼm trying to create my own certificate authority using the XCA software. I have successfully created the root CA (Fisir Technologies CA) and intermediate CA (Fisir Technologies Intermediate CA X1). ...
1
vote
3answers
73 views

Can I purchase 2 wildcard certificates with the same subject from 2 different CA vendors?

Say I have an existing wildcard cert (*.example.com) from Vendor A (eg Symantec) licensed for 2 servers. And now I want to purchase the same subject (*.example.com) from Vendor B (eg. RapidSSL) for ...
1
vote
0answers
60 views

How to configure Apache direct trust for CA signed certificates

I'm working on a corporate network which unfortunately is flat and has led to an interesting security requirement which I'm sure is possible (I just can't figure out how) The corperation has its own ...
1
vote
0answers
13 views

Is it possible to use subjectAltName with one word domains? [duplicate]

I'm running my own CA. My new cert's desired CSR has CN papaya. I'm looking to add some local domain structure with subjectAltName, but browsers are rejecting the added domains. This is my openssl....
0
votes
0answers
92 views

Certification Authority Error ID 44 Error Code 0x80040112

I had a windows server SP2 with the CA role activated, so the domain users could ask for a personal certificate. Suddenly, the Certification authority role has stoped, and when I try to bring it up it ...
0
votes
0answers
29 views

OpenSSL certificate shows “Issued to: Administrator” as Common Name

I'm trying to issue a certificate which was generated by openssl. $ openssl req -out vpn_certrequest.csr -key vpn_key.key -new -sha256 You are about to be asked to enter information that will be ...
1
vote
1answer
1k views

List all available templates from CA certutil or certreq

I need to request a certificate via command line I have investigated that certreq is the tool that can request the certificate. I am used to the gui to request the certificate by selecting one of the ...
1
vote
2answers
56 views

TinyCA generated cert refused by Exchange 2013

I've created a CA using TinyCA2, and have created a certificate for my Exchange 2013 server. Although the certificate installed fine on exchange, Exchange always says "Revocation Check Failed". (I'...
0
votes
2answers
40 views

Create exchange certificate from linux CA

I am setting up exchange 2013 in a lab, where we are trying to replace Windows hosts with Linux hosts. We have exchange up and running, but connections complain that we need a valid certificate. I'...
1
vote
2answers
51 views

Client-side certificate signing

One of my partners wanted to do client side SSL certificate authentication. They wanted us to sign the certificate using a recognized CA. I was under the impression that for client side SSL ...
1
vote
1answer
214 views

client SSL certificate verify error: (27:certificate not trusted)

I'm having some difficulty with nginx's client authentication while using an intermediate CA (self-created). Although the same certificate bundle (intermediate + root certificates in a single .pem ...
0
votes
0answers
42 views

How to disable Microsoft CA version extension in a Standalone Root CA?

I was looking for a way to exclude CA version from the ca extensions, but found nothing. We use Windows Server 2012 and it is needed for a Standalone root ca. Is there any way?
0
votes
1answer
137 views

Microsoft Active Directory Certificate Services Response from certsrv

I am trying to use certificates and private keys on embedded systems that were generated from Microsoft Active Directory Certificate Services . NDES and SCEP are currently out of scope so it will need ...
0
votes
3answers
124 views

How to trust a self signed certificate with different issuer?

I have a certificate and private key files which are created by my colleague. There are placed in Apache /etc/apache/ssl directory and all the configurations set properly. I opened the site with ...
0
votes
1answer
150 views

No Certificates Found on Chrome Android with Comodo Positive SSL and IIS

For software testing reason, I have registered a domain name, set its A record to point to 192.168.1.30 (local PC on my network). I have installed Comodo Positive SSL for this domain on IIS on Windows ...
0
votes
1answer
112 views

P7b file and cer file do I need them both

I'm trying to understand why I need the chain at all (p7b). I have imported certificates previously and I didn't need one. Can I bypass this somehow? Well I am getting an error - keytool error: ...
0
votes
0answers
19 views

Special considerations for a new Certificate Authority with multiple UPN suffices?

Our AD domain is foo.com, NetBIOS FOO_D1. A previous employee added a second UPN suffix, bar.com. Our corporate identity now revolves around bar.com, such that it is used in everyone's email address. ...
0
votes
1answer
33 views

Add additional information to auto-enrolled certificates (Windows Active Directory CA)

I successfully enabled auto-enrollment for client computer certificates within our Active Directory domain. However, I want to include additional details in the auto-enrolled certificate such as the ...
0
votes
1answer
233 views

certutil -TCAInfo error message RegConnectRegistry/RegOpenKeyEx: The network path was not found. 0x80070035 (WIN32: 53 ERROR_BAD_NETPATH)

Recently we noticed the following errors were occurring daily in our Event Logs for servers in our DMZ: CertificateServicesClient-CertEnroll EventID 82 Certificate enrollment for Local system failed ...
1
vote
0answers
111 views

Java keystore: How to import the ca certificates correctly?

We have renewed the certificate of one of our server (apache httpd). For a webservice interface (for mobile clients) we need the certificate also on tomcat, means: stored in a java keystore. We have ...
2
votes
1answer
83 views

Microsoft Certificate Authority Provider Compatibilty

So we are a mid-size enterprise refreshing our Microsoft PKI and looking to leverage it heavily across ther org for many things. ie Server to Server/Workstation encryption, Wireless TLS Encryption/...
2
votes
1answer
43 views

ssl certificates from SSL Resellers - what are they reselling?

I've seen SSL resellers everywhere (such as namecheap for several of their options). How are they reselling? What are they reselling? Are there any security issues with them?
1
vote
2answers
341 views

how to create a SSL certificate chain from my own CA?

I use my own CA to create SSL certs for services in my infra. These certs are signed directly by my CA. It comes to me that this is likely a weak strategy, as if the cert was to be compromised, I ...
0
votes
0answers
351 views

Win 2008 - certificate renewing - “The certificate request was submitted to the online authority but was not issued. The request was denied”

Heres my previous problem, which was solved: Win 2008 - certificate renewing - I can't choose proper CA But then, after I managed to see and choose proper server on the CA's list, after I click ...
0
votes
1answer
72 views

How to add multiple X509v3 Subject Alternatve names during cerificate request (CSR generation) without editing openssl.cnf file

I want to generate CSR for two domains. I have tried according to this http://apetec.com/support/GenerateSAN-CSR.htm But there is no such section available in openssl.cnf file and i don't want to ...
1
vote
1answer
43 views

Does office365 require certificate renewal

We are using Office365 for our mail in a hybrid setup so we have an exchange server with the transport role installed but all mailboxes are hosted on the Microsoft cloud. I was wondering if you need ...