5
votes
1answer
238 views

Windows 2012R2 seems to automatically download and install intermediate root certificates

Whilst preparing a new Windows 2012R2 server for production I needed to install a (GlobalSign Domain) SSL certificate for the website powering our application. I did this by generating a certificate ...
0
votes
1answer
81 views

Unable to install Certificate Enrolment Policy Web Service

I'm running on Windows 2k8 Enterprise edition, and when adding the Active Directory Certificate Services, I don't see the option to add the Certificate Enrolment Policy Web service in the dialog box. ...
0
votes
0answers
29 views

no local computer physical store, only registry and smartcard

I'm currently encountering an issue whereby i cannot see the "local computer" physical store, under trusted root CA, when attempting to install a cert. Instead the only stores i see are "Registry" and ...
1
vote
0answers
29 views

EFS file access problems

in my organization, i have a deadline to deploy EFS using AD CS, and i am working with a single windows server 2003 box, which is the Root CA, and is the same server responsible to certificate ...
2
votes
1answer
76 views

How to issue a cert for web hosting using ad cert authority

I need to issue a certificate for SSL binding in IIS using Active Directory Certificate Authority. As far as I understand it should have Purpose=Auth Server and contain private key/be exportable. ...
0
votes
1answer
195 views

Change certificate auto enrollment settings from long gone CA to new CA

We started getting event ID 13 from a our domain controllers: Certificate enrollment for Local system failed to enroll for a DomainController certificate with request ID N/A from ...
2
votes
1answer
296 views

Where to get root CA certificates for Windows Server now that Microsoft no longer updates them?

Microsoft removed root CA updates from WSUS in January 2013. I now have some fresh installs of Windows Server 2012 that have an insufficient set of root CAs (basically just Microsoft's own CAs). This ...
5
votes
1answer
431 views

IIS no longer trusts any CAs for client authentication

Yesterday the IIS on our build server (running Windows Server 2012) started refusing our clients' certificates. The certificates are signed using our own self-signed CA cert that has been added to ...
0
votes
1answer
167 views

Preventing Windows from deleteing our root CA

I am trying to create a Windows server with an IIS server that has a web site with client certificate authentication. The client certificates are signed by our own root CA. Because of that we must ...
3
votes
0answers
49 views

Windows PKI: How can I import, sign/issue and export a large number of CSRs?

I have a lot of CRS that I need to have signed/issued and exported in windows. I was hoping I could batch process them somehow (certutil sounds like it can do some of the work) but I'm not quite sure ...
1
vote
2answers
146 views

Enabling Certificate Authority Auto-enrollment on Domain via GPO, any “dangers” I should be aware of?

I deployed a Standalone Offline Root CA and created a Sub Enterprise CA that handles enrollment and policy. There all setup correctly. I am getting ready to enable Auto-enrollment to the whole domain ...
3
votes
1answer
164 views

Using an audio cable (or similar) to create unidirectional communication from a secure server

I'm interested in exploring how a semi-offline Root CA can be used to update CRLs to the sub CA's. This answer on Security.SE mentions using an audio cable for this purpose. Doe anyone have details ...
1
vote
1answer
166 views

Backing up Windows 2003 Server that has Certificate Authority

I want to export and migrate a Certificate Authority CA role from a Windows 2003 machine to a new copy of Windows 2008 R2 virtual machine. I was told that I cannot have 2 CA roles on the same network ...
2
votes
2answers
1k views

How does IE/Chrome know which Intermediate CA to use when not part of chain?

A server on my network is signed with a certificate issued by RapidSSL CA but does not supply to complete issuer chain (RapidSSL CA's certificate is issued by GeoTrust CA which is a trusted root ...
13
votes
3answers
2k views

Windows 2008 R2 CA and auto-enrollment: how to get rid of >100,000 issued certificates?

The basic problem I'm having is that I have >100,000 useless machine certificates cluttering up my CA, and I'd like to delete them, without deleting all certs, or time jumping the server ahead, and ...
4
votes
1answer
591 views

Windows 2003 x32 CA to Windows 2008 x64 CA migration

In the following period I have to migrate the AD over to 2008 schema level. I currently have a x64 Windows 2008 R2 domain controller and one x32 Windows Server 2003 domain controller. The x32 server ...
1
vote
1answer
288 views

Decommissioning PKI - How do I set a CRL Next update to null?

I am planning on deploying two Windows 2008R2 PKIs: One for legacy devices that don't support SHA-2 / ECP and another one that does support it. When the time comes to decommission the SHA1 ...
0
votes
1answer
340 views

There is no certificate chain in portal certificate file

I am trying to install Mcafee EMM in a lab environment. I have created an enterprise CA and created a certificate. But while installing the EMM, its showing the error of there is no certificate ...
1
vote
1answer
361 views

I can't install Enterprise root CA in windows 2003

I am trying to install Enterprise CA in my windows server 2003.But I can select only stand alone root CA and the stand alone subordinate CA. Other two options are not highlighted. Can anybody give me ...
2
votes
2answers
568 views

Disabling EFS--what to do if there are any encrypted files?

I am in the process of retiring an old Windows-integrated CA and bringing online a new, properly-configured one (several, actually). Most of our systems are unable to use EFS thanks to Group Policy... ...
1
vote
1answer
629 views

Windows 2008 CA and Windows 2003 AD?

I have a Windows 2003 AD and I set up a root ca and a sub ca both of which are windows 2008(joined to domain).I need to use the sub ca to generate end user certificates for digital signature , they ...
2
votes
1answer
910 views

How do you revoke a certificate?

In a network of more than 300 machines all running on Windows Server 2003 and clients running Windows 2000 Professional and Windows XP Professional, Microsoft Certification Server in enterprise CA ...
4
votes
2answers
792 views

Standalone or Enterprise CA - what do I have?

When you install a Windows forest CA you have the option to make it standalone or enterprise. I have an existing installation which I am assuming is standalone as it doesn't have a certificate ...