0
votes
1answer
142 views

Unable to install Certificate Enrolment Policy Web Service

I'm running on Windows 2k8 Enterprise edition, and when adding the Active Directory Certificate Services, I don't see the option to add the Certificate Enrolment Policy Web service in the dialog box. ...
1
vote
1answer
65 views

Windows Server 2008 R2 CA not issuing more than 2 years

I have active directory environment in 2003 R2. I have installed 2008 R2 Enterprise Edition CA. Then I have created custom template from web server template and add expiry date as 15 years. my root ...
1
vote
2answers
25 views

How to determine if the user requested a certificate using “Mark keys as exportable”?

We have a Windows 2008 R2 running a standalone CA (certificate authority) and the web enrollment, so the users access http://[server-name]/certsrv websote for request certificates. The Advanced ...
0
votes
1answer
64 views

Win2008 SRV Certutil csv option not present

I have an Enterprise Certificate Authority running well. I am attempting to automate some monitoring tasks using batch files and the certutil.exe command. After reading the documentation at: ...
2
votes
1answer
126 views

In place upgrade on a Windows 2003 with Certificate services

I'm looking to do an in-place upgrade for 2 Windows 2003 servers domain controllers running certificates to Windows 2008 R2. Will it work, has anyone tried this, and will I need to do anything with ...
1
vote
1answer
812 views

Renewing Service Certificates for NDES on Windows Server 2008 R2

We currently use the NDES Service on Windows 2008 R2 Enterprise where the same box is also the standalone Certificate Authority. During initial setup, NDES created 2 service certificates for SCEP ...
2
votes
1answer
913 views

Windows 2012 SSTP The revocation function was unable to check revocation because the revocation server was offline

In order to get rid of "Error 0×80092013: The revocation function was unable to check revocation because the revocation server was offline" you have to install base/delta CRLs on the client you want ...
-1
votes
1answer
119 views

LDAPS certificate not working with IP address

I have a certificate assigned to my Domain Controller/Certificate Authority that has no subject name assigned but has two FQDN's and and IP in the alternative names under DNS and IPv4 respectively. ...
3
votes
1answer
392 views

Microsoft offline root CA CDP and AIA http URLs are hard coded - trouble ahead?

I'm new with ADCS, and there is a lot to understand. I set up a 2-tier PKI, and have placed the offline root CA certificate (CRT) and CRL files on a web server pointing to with a CNAME in DNS. When I ...
3
votes
2answers
265 views

Windows PKI with offline root (maybe with OpenSSL) - Possible?

I'm trying to setup a two-tier PKI and I have a ton of questions. Since there's the tombstone limit for the AD, I'm assuming that the root (which will be offline) shouldn't be part of the AD. Am I ...
2
votes
3answers
7k views

Install Trusted root certificate authority certificate via GPO

We have a Win2k8 as a Domain Controller in a domain with workstations that run Windows XP. I would like to be able to install via GPO a new trusted root certificate authority certificate that I've ...
4
votes
1answer
1k views

CA and Primary Domain Controller on the same server

i am setting up a Microsoft AD to be my CA. After research it looks like i need to have a domain controller before i can issue certs thru the CA. Would it be possible to place both the CA and the DC ...
0
votes
1answer
1k views

AD Certificate Templates does not appear

I'm following what should be simple instructions to enable LDAP SSL on our domain controller (instructions here). Duplicating the Kerberos certificate is successful however, when attempting to select ...
4
votes
1answer
2k views

What causes automatic install of trusted root certificate authorities into local machine's certificate store?

I spend whole day by diagnosing issue with my test services using mutual HTTPS. Services are hosted in IIS 7 on a test server running Windows Server 2008 Enterprise edition. Suddenly few weeks ago ...
1
vote
1answer
579 views

Domain Environment + Certificate Authority + Server 2008 R2

I have recently been delegated the task to setup a CA in our domain environment and have a question on why Microsoft does somethings the way they do lol. I have been trying to read up on what the ...
2
votes
1answer
548 views

How long can a Microsoft Server CA be down before a cert will fail?

We are using self-signed certificates for internal development machines and other internal connection encryption. The certificates were created using Microsoft Certificate Server. I need to move ...
1
vote
1answer
375 views

Why do I get certificate error when connecting to “trusted PEAP server?”

I'm trying to connect Windows 7 machine to my wireless network secured with WPA2-Enterprise PEAP. PEAP uses server authentication so I have created root CA named FesbCA on my Windows server 2008 R2 ...
1
vote
1answer
1k views

Can I remove the DC role from a W2k8 server being an Enterprise CA?

Is it possible to run a W2k8 Enterprise (AD-integrated) Certificate Authority on a server that it not a domain controller - mine currently is a DC and I do not remember whether this was a requirement? ...
5
votes
2answers
4k views

Certificate Template Missing from “Certificate Template to Issue”

I'm having a problem similar to that posted in this question: Missing Certificate template From certificate to issue The short version is that I've created a duplicate certificate template and I'm ...
0
votes
1answer
234 views

Disaster Recovery with one 2008R2 DC and a 2003R2 DC

I am working out DR scenarios and one was making me scratch my head: Currently our domain has a 2008R2 DC and a 2003R2 DC. I know bringing restoring DCs can sometimes be harmful to an AD if others ...
0
votes
1answer
134 views

Understating certificate authority nesting

Given we have the following network/CA structure: Win2K8R2 - Root CA - no idea where its' certificate is? Win2K8R2 - Sub CA - obtained CA certificate from Root CA Win2K8R2 - OWA 2010 (Basically, a ...
0
votes
1answer
586 views

Renewing a OCSP and OWA certificates for Exchange 2010

We have been using an Exchange 2010 mail server for a year now. Today the certificates used in Exchange, as well as of Forefront TMG expired. We had the following certificate chain: Root CA issued a ...
0
votes
1answer
129 views

Use Certificate Autoenrolment with third-party Certificate Authority

Is it possible to setup Windows Domain to use Certificate Autoenrolment and third-party Certificate Authority? We think that it can be done in Windows Server 2008 only but don`t know exactly, please ...
1
vote
0answers
392 views

Change name of Win Server 2008 computer after CA install

I am importing an old certificate database into the new CA on a new server I'm installing. I am warned by Windows that I can't change the computer name, domain settings, etc., after installing the CA. ...
7
votes
1answer
308 views

What happens to encrypted mails when CA certificate expires in my Windows Domain

does anybody know what will happen to encrypted /signed mails when a root authority certificate expires in my domain network? Can the certificate still be validated from the clients and will the ...
2
votes
1answer
514 views

What are the steps to create a local domain CA certificate for code signing (and export it to .pfx)?

I want to sign a .NET assembly with a code signing certificate from my local domain CA. I tried sending a certificate request and got back a signed certificate from my local domain CA in my local ...
0
votes
1answer
1k views

Certification Authority Service starts and stops SBS 2008

We moved from a SBS 2003 Server to a SBS 2008 server relatively recently because the SBS 2003 was having major hardware issues. I followed the Migration guide to the letter and everything seemed to ...
0
votes
1answer
623 views

Authentication with USB tokens on IIS, Windows Server 2008

I only have a installed Windows Server 2008 with Active Directory Domain, Web Server (IIS) and a bunch of USB Tokens on the table. Which are the steps to install the necessary components and ...
2
votes
1answer
890 views

Windows Server 2008 SBS bind to OS X Server Open Directory

I'm trying to bind Windows 2008 SBS server to OS X Open Directory, but the Change domain button is grayed out with this message: Note: The identification of the computer cannot be changed because: - ...
6
votes
1answer
1k views

Purpose behind subordinate Certificate Authorities

At my place of employment, we are setting up a PKI infrastructure using Microsoft products. We have a totally clean slate here and want to have a good start. We're wondering why anyone would set up ...