In cryptography, a certificate authority, or certification authority, (CA) is an entity that issues digital certificates.

learn more… | top users | synonyms (1)

1
vote
1answer
23 views

OpenSSL - Add Subject Alternate Name (SAN) when signing with CA

How can I add a Subject Alternate Name when signing a certificate request using OpenSSL (in Windows if that matters)? I've generated a basic certificate signing request (CSR) from the IIS interface. ...
0
votes
1answer
40 views

how do I covert a certificate with extension .cer to .asc

I have a certificate file (with extension .cer) that has content which looks something like this. -----BEGIN CERTIFICATE----- lots of data here -----END CERTIFICATE----- It is our signing ...
1
vote
0answers
23 views

network device enrollment service greyed out

I've recently installed AD Certification Authority on one of our DCs. It acts as a subordinate enterprise CA, the Root CA is a standalone offline root CA and there is no connection between those two ...
2
votes
1answer
21 views

Finding Certificate Template in Certificate Authority

I'm following this tutorial: https://technet.microsoft.com/en-us/library/dn781428(v=ws.11).aspx I am on this step: Click to select the Certificate Templates container (under the CA name, not the ...
0
votes
1answer
22 views

Can SHA-1 certs exist in a SHA-2 Microsoft Certificate Authority during migration?

I'm starting the process of migrating our internal Microsoft certificate authority to support SHA-2 and haven't been able to find out an answer on the ramifications of this process. I have found the ...
30
votes
1answer
2k views

Trusting an untrustworthy CA - Can I restrict how system trusts it?

(Posted to ServerFault instead of StackOverflow because I feel it concerns OS configuration more than programming code). I'm currently responsible for maintaining a system which connects to a ...
0
votes
2answers
46 views

Common way to adminstrating ca-certificates on linux?

I have to administrate a bunch of linux machines (server and clients) with different distributions. We want to use docker in the future, so it may be, that there would be more different distris in the ...
1
vote
2answers
54 views

Do web Servers send the certificate chain to the Web Client?

If my web server (latest Apache) has a valid (not expired or revoked) Verisign certificate chain (root -> intermediate -> leaf/my server), then does the server send the entire(?) chain to the client? ...
0
votes
2answers
14 views

automatic redirect in HTTPS for users which recognised CaCert authority

I use CaCert certificates for my domains. I want to redirect my users to HTTPS only if they recognised the CaCert authority. What is the best way to do this ?
1
vote
1answer
111 views

OpenSSL on Debian 8 can't authenticate certificates from Akamai (GTE/Baltimore CyberTrust Global Root)

On Debian 8.4 (with ca-certificates package) openssl doesn't seem to know about CAs required to verify connections to Akamai signed by "GTE CyberTrust" and "Baltimore CyberTrust". The GTE CyberTrust ...
1
vote
1answer
57 views

PKI EJBCA : extract CA from EJBCA instance and just keep sub-CA

I'm looking for a solution to extract the CA from EJBCA instance, put it on an external drive, which is secured in a safe-deposit for instance. So I only keep the sub-ca for signing the end user ...
1
vote
1answer
55 views

Unable to start Active Directory Certificate Services afer migrating from 2003 to 2012 R2

I was in the process migrating our CA from a 2003 server to a 2012 R2 using this guide After a server restart the CA service will no longer start. I receive error 21: The device is not ready. Is it ...
0
votes
2answers
35 views

Does Root CA need to be online?

I am trying to setup an IPv6-only Exchange Server 2013, running on Server 2012 R2 Datacenter. This is a 1-machine-setup in a VirtualBox for testing purposes. Everything is running ok so far. I.e. I ...
1
vote
0answers
25 views

OpenSource PKI Solution : user feedback and advices [closed]

I work on securing data exchange over the Internet. We plan to use a VPN together with certificates to authenticates users. To do so I've identified various PKI solutions. EJBCA : Installed and ...
0
votes
0answers
17 views

Windows: Verifying intermediate CA on dark network with keystore (.kdb)

Background: We have Windows Server 2012's (Server A and B) whose Internet Explorer (IE) connects to RHEL's Apache server (IBM HTTP Server). PKI: Apache serves a certificate whose intermediate CA was ...
2
votes
1answer
50 views

HTTPS not working with two intermediate certificates

Iʼm trying to create my own certificate authority using the XCA software. I have successfully created the root CA (Fisir Technologies CA) and intermediate CA (Fisir Technologies Intermediate CA X1). ...
1
vote
3answers
71 views

Can I purchase 2 wildcard certificates with the same subject from 2 different CA vendors?

Say I have an existing wildcard cert (*.example.com) from Vendor A (eg Symantec) licensed for 2 servers. And now I want to purchase the same subject (*.example.com) from Vendor B (eg. RapidSSL) for ...
1
vote
0answers
57 views

How to configure Apache direct trust for CA signed certificates

I'm working on a corporate network which unfortunately is flat and has led to an interesting security requirement which I'm sure is possible (I just can't figure out how) The corperation has its own ...
1
vote
0answers
13 views

Is it possible to use subjectAltName with one word domains? [duplicate]

I'm running my own CA. My new cert's desired CSR has CN papaya. I'm looking to add some local domain structure with subjectAltName, but browsers are rejecting the added domains. This is my ...
0
votes
0answers
59 views

Certification Authority Error ID 44 Error Code 0x80040112

I had a windows server SP2 with the CA role activated, so the domain users could ask for a personal certificate. Suddenly, the Certification authority role has stoped, and when I try to bring it up it ...
0
votes
0answers
19 views

OpenSSL certificate shows “Issued to: Administrator” as Common Name

I'm trying to issue a certificate which was generated by openssl. $ openssl req -out vpn_certrequest.csr -key vpn_key.key -new -sha256 You are about to be asked to enter information that will be ...
1
vote
1answer
329 views

List all available templates from CA certutil or certreq

I need to request a certificate via command line I have investigated that certreq is the tool that can request the certificate. I am used to the gui to request the certificate by selecting one of the ...
1
vote
2answers
44 views

TinyCA generated cert refused by Exchange 2013

I've created a CA using TinyCA2, and have created a certificate for my Exchange 2013 server. Although the certificate installed fine on exchange, Exchange always says "Revocation Check Failed". ...
0
votes
2answers
32 views

Create exchange certificate from linux CA

I am setting up exchange 2013 in a lab, where we are trying to replace Windows hosts with Linux hosts. We have exchange up and running, but connections complain that we need a valid certificate. ...
1
vote
2answers
49 views

Client-side certificate signing

One of my partners wanted to do client side SSL certificate authentication. They wanted us to sign the certificate using a recognized CA. I was under the impression that for client side SSL ...
1
vote
1answer
129 views

client SSL certificate verify error: (27:certificate not trusted)

I'm having some difficulty with nginx's client authentication while using an intermediate CA (self-created). Although the same certificate bundle (intermediate + root certificates in a single .pem ...
0
votes
0answers
37 views

How to disable Microsoft CA version extension in a Standalone Root CA?

I was looking for a way to exclude CA version from the ca extensions, but found nothing. We use Windows Server 2012 and it is needed for a Standalone root ca. Is there any way?
0
votes
1answer
103 views

Microsoft Active Directory Certificate Services Response from certsrv

I am trying to use certificates and private keys on embedded systems that were generated from Microsoft Active Directory Certificate Services . NDES and SCEP are currently out of scope so it will need ...
0
votes
3answers
101 views

How to trust a self signed certificate with different issuer?

I have a certificate and private key files which are created by my colleague. There are placed in Apache /etc/apache/ssl directory and all the configurations set properly. I opened the site with ...
0
votes
1answer
94 views

No Certificates Found on Chrome Android with Comodo Positive SSL and IIS

For software testing reason, I have registered a domain name, set its A record to point to 192.168.1.30 (local PC on my network). I have installed Comodo Positive SSL for this domain on IIS on Windows ...
0
votes
1answer
63 views

P7b file and cer file do I need them both

I'm trying to understand why I need the chain at all (p7b). I have imported certificates previously and I didn't need one. Can I bypass this somehow? Well I am getting an error - keytool error: ...
0
votes
0answers
14 views

Special considerations for a new Certificate Authority with multiple UPN suffices?

Our AD domain is foo.com, NetBIOS FOO_D1. A previous employee added a second UPN suffix, bar.com. Our corporate identity now revolves around bar.com, such that it is used in everyone's email address. ...
0
votes
1answer
27 views

Add additional information to auto-enrolled certificates (Windows Active Directory CA)

I successfully enabled auto-enrollment for client computer certificates within our Active Directory domain. However, I want to include additional details in the auto-enrolled certificate such as the ...
0
votes
1answer
182 views

certutil -TCAInfo error message RegConnectRegistry/RegOpenKeyEx: The network path was not found. 0x80070035 (WIN32: 53 ERROR_BAD_NETPATH)

Recently we noticed the following errors were occurring daily in our Event Logs for servers in our DMZ: CertificateServicesClient-CertEnroll EventID 82 Certificate enrollment for Local system failed ...
1
vote
0answers
75 views

Java keystore: How to import the ca certificates correctly?

We have renewed the certificate of one of our server (apache httpd). For a webservice interface (for mobile clients) we need the certificate also on tomcat, means: stored in a java keystore. We have ...
2
votes
1answer
54 views

Microsoft Certificate Authority Provider Compatibilty

So we are a mid-size enterprise refreshing our Microsoft PKI and looking to leverage it heavily across ther org for many things. ie Server to Server/Workstation encryption, Wireless TLS ...
2
votes
1answer
41 views

ssl certificates from SSL Resellers - what are they reselling?

I've seen SSL resellers everywhere (such as namecheap for several of their options). How are they reselling? What are they reselling? Are there any security issues with them?
1
vote
2answers
143 views

how to create a SSL certificate chain from my own CA?

I use my own CA to create SSL certs for services in my infra. These certs are signed directly by my CA. It comes to me that this is likely a weak strategy, as if the cert was to be compromised, I ...
0
votes
0answers
260 views

Win 2008 - certificate renewing - “The certificate request was submitted to the online authority but was not issued. The request was denied”

Heres my previous problem, which was solved: Win 2008 - certificate renewing - I can't choose proper CA But then, after I managed to see and choose proper server on the CA's list, after I click ...
0
votes
1answer
51 views

How to add multiple X509v3 Subject Alternatve names during cerificate request (CSR generation) without editing openssl.cnf file

I want to generate CSR for two domains. I have tried according to this http://apetec.com/support/GenerateSAN-CSR.htm But there is no such section available in openssl.cnf file and i don't want to ...
1
vote
1answer
36 views

Does office365 require certificate renewal

We are using Office365 for our mail in a hybrid setup so we have an exchange server with the transport role installed but all mailboxes are hosted on the Microsoft cloud. I was wondering if you need ...
0
votes
2answers
68 views

Authenticating Client Certificates from Different Issuer

Ok, here's the scenario. A company called "Corp" issues SSL certificates to all their employees for accessing Corp's web resources. Corp also provides a certificate for their Certificate Authority so ...
0
votes
0answers
81 views

Win 2008 - certificate renewing - I can't choose proper CA

I've got a problem with renewing server certificate: when I get to the IIS Manager => Server Certificates and when I try to renew right certificate, I can't find proper CA on the list - theres only ...
3
votes
2answers
39 views

Are Windows internal CA-issued certificates compatible with Mac clients?

I am looking into deploying an internal CA to replace the GlobalSign certificates we use for our internal email encryption: Internal CA would be set up using ADCS in a two-tier hierarchy, no other ...
1
vote
2answers
150 views

AD Certificate services - The combobox to select Template is missing

Has anybody come across an issue where the certificate templates field is missing in the certsrv web-page? I am running 'Windows2012R2 Standard'. The online tutorials all have this combobox, but i am ...
0
votes
2answers
142 views

Importing ca-certificate chain (.crt) - RHEL7

I am fairly new to this but I've done some internet research the last 2 days and I couldn't find an suitable answer. I have been given a ca-certificate chain (cacertchain.crt) which I need to import ...
2
votes
1answer
42 views

Windows CA: switch self-signed root certificate with certificate from provider

In our Windows Domain (2008R2 and 2012R2 Servers), we are running a Domain CA. The root certificate is a self-signed certificate. We also have a x.509 certificate from our internet provider (mostly ...
1
vote
0answers
17 views

Guide on how to create certificates and setup an EAP-TLS on debian [closed]

I need to create an EAP-TLS authentication using a freeradius. Currently I am a working EAp-PEAP setup, it is working fine. However, I now needs to move to an EAP-TLS. For this I need to create some ...
1
vote
1answer
264 views

Self Signed Root Certificate with SAN in child

I am trying to implement a better set of self signed certificates at my company. What I want is this: All certificates are signed by one root certificate, so developers can trust just this root ...
1
vote
0answers
79 views

pki linux auto enrollment

I have a Windows Offline Root CA. I'm looking for a tool which I can install on my secondary CA to import there a certificate from my ROOT CA and to enable certificates auto-enrollment for non Windows ...