Questions tagged [certificate-authority]
In cryptography, a certificate authority, or certification authority, (CA) is an entity that issues digital certificates.
815
questions
1
vote
1
answer
28
views
Specifying Dynamic filenames for AIA and CDP in CAPolicy?
In the "CAPolicy.inf" file where you define [AuthorityInformationAccess] and [CRLDistributionPoint], can these sections use dynamic values? For instance:
[CRLDistirubtionPoint]
URL="...
- 133
3
votes
1
answer
222
views
How to create an Authenticode Signing infrastructure?
I am attempting to create the necessary infrastructure to allow authorised users to sign PowerShell scripts and have them be trusted by the organisation, this allows deploying scripts to computers ...
- 133
1
vote
2
answers
48
views
Why does Active Directory Certificate Services require Remote Registry Service?
I'm setting up a two-tier certificate authority using Active Directory Certificate Services. The offline air-gapped root certificate authority was easy to set up and get going. The intermediate ...
1
vote
1
answer
23
views
How to reenroll certificate on behalf of someone else? Windows Certification Authority
I have Windows Server 2022 CA with a configured Enrollment Agent.
I can enroll new certificate on behalf of another user but I can't do the same with renewing it, while logged on as the Enrollment ...
- 19
0
votes
0
answers
27
views
OpenWISP -- inputing a certification authority
We're trying to set up OpenWISP using a paid-for wildcard (*.ngv.com.au) SSL certificate. The certificate comes to us as a ZIP of these files:
AAACertificateServices.crt
...
2
votes
1
answer
64
views
What happens if the startdate of a CA is later that the startdate of a X509 certificate signed by it?
I am in the process of extending the lifetime of a private CA creating a new certificate with the same name, serial number, private/public keys, etc. The only change would be the "startdate" ...
- 263
0
votes
1
answer
67
views
How to make kubeadm init work with external CAs?
I am trying to bootstrap a Kubernetes cluster using my own Certificate Authorities (CAs). I am following the Kubernetes Hardening Guide, which recommends having separate CAs for etcd and the rest of ...
- 11
0
votes
0
answers
144
views
Creating Web Secure Proxy in GCP - Certificate Issue
I am trying to configure GCP Secure Web Proxy https://cloud.google.com/secure-web-proxy/docs/overview.
The proxy is under IP: 10.10.0.16. Besides that, it has a local DNS Zone proxy.carecode.lan that ...
google-cloud-platform
0
votes
1
answer
67
views
TLS through CDN
I'm trying to understand how TLS is terminated between a client and an origin when a CDN is involved.
I think it's pretty straightforward when a client connects directly to an origin, a handshake can ...
- 133
0
votes
0
answers
75
views
Add a new Subordinate CA on a single ROOT CA environment
I'll have an ROOT CA that is already joined to an Active Directory, this one has been serving certificates to the Joined Computers.
Now we want to add a subordinate/intermediate CA to deploy new ...
- 105
0
votes
2
answers
269
views
Should a subordinate CA appear under the Trusted Root CA?
Recently I needed to setup PKI for VDI solution as smart card functionality was needed to handle SSO with Azure. I configured an offline Root CA and a domain joined subordinate CA per MS instructions ...
- 1
0
votes
0
answers
462
views
Verify return code: 21 unable to verify the first certificate
I'm encountering an issue on my Ubuntu server when attempting to establish an email connection from the frontend application. The error message I receive reads: "Verify return code: 21 unable to ...
0
votes
1
answer
571
views
Docker- Giving Container access to Host's CA certs
I was wondering security wise if there was anything wrong with volume mounting the host's ca certs into a container. I.e,
docker run \
-v /usr/local/share/ca-certificates:/usr/local/share/ca-...
- 111
0
votes
1
answer
207
views
How do I create a replacement root CA without migrating old certificates?
Expanding on my post here: How do I fix missing or multiple CA certificates causing chain issues?
I believe the issue above is that there are missing root CA certs in the CA itself and group policy ...
- 192
0
votes
0
answers
87
views
Windows Certification Authority Autoenrollment when Issuance Requirements is set
I have domain computers CA template which autoenrolls to machines without issues
I activated Issuance Requirements
I can automatically renew existing certificates, but cannot automatically/manyally ...
- 115
0
votes
1
answer
243
views
Why is certificate request invalid from Exchange 2019?
I am creating a cert request in powershell on an exchange 2019 server as follows:
$binrequest = New-ExchangeCertificate -Server "exchange" -BinaryEncoded -GenerateRequest -FriendlyName "...
- 1,852
-2
votes
1
answer
218
views
Active Directory TLS authentication issue (Windows Server 2019 & 2012 R2)
I am facing an issue with AD TLS communication-related issues.
Six months before I could authenticate the user on SSL communication using the CA certificate alone.
Currently, I cannot authenticate ...
- 7
0
votes
1
answer
1k
views
How to extract CA Certificate from .pfx file and add it to a trust store file
I have a .pfx file that has multiple certificates, one of them is the signing CA certificate of a server certificate assigned to the IBM i Remote Command Server in DCM.
I managed to use openssl and ...
- 109
0
votes
0
answers
98
views
Multiple certificate chains in a single file
My company has a Windows-based PKI with a single standalone root CA and several subordinate CAs for different audiences/purposes (e.g. two subordinate CAs for user/machine auto-enrollment, an ...
- 101
1
vote
0
answers
233
views
Windows CA Publishing Expired Certs in CRL When not configured to do so
I have a Windows ADDS CA that for some reason is publishing revoked but expired certificates in the CRL and I can't for the life of me figure out why. Here is my configuration:
Server 2012 R2
...
- 13
0
votes
1
answer
652
views
Why doesn't Google Chrome on Mac pick up local Certificate Authority as the other browsers?
I have generated local CA and Cert on my Mac, from this walkthrough: https://blog.arrogantrabbit.com/ssl/Root-CA-macOS/
I then provide the certificate/key to nginx local server, that I visit with my ...
- 101
0
votes
1
answer
502
views
How can I add a CRL to an existing Certificate Authority Certificate?
We have our own CA for internal use that secures about ten servers/services. We don't actually have or need a Certificate Revocation List.
But, as we are attempting to setup Dovecot to verify the ...
- 4,656
1
vote
1
answer
372
views
Implementing PKI on an Active Directory domain
I would like to implement a two-tier PKI in a relatively small Windows environment: about 35 users and five virtual servers. Although I have little experience with Linux, I am trying to use XCA on a ...
- 11
1
vote
1
answer
249
views
FreeIPA subject name encoding mismatch when renewing certificate
When reading this question and answer, it seems this should be possible but I need a little more help understanding the answer.
Is there a way to change the string format for an existing CSR "...
- 11
2
votes
0
answers
419
views
openssl s_client shows an incorrect certificate chain
On one of my servers belonging to a customer I "suddenly" cannot verify any public TLS certificates. All requests to "the public" fail on an invalid certificate. I can, however, ...
- 219
1
vote
1
answer
372
views
Bluehost - wrong certificate presented by host for API call to Twilio
Bluehost VPS running CentOS, but cat /etc/redhat-release reveals CloudLinux release 6.10 (Final).
Executing curl commands against Twilio APIs on my local PC (Win11/IIS/PHP) works fine. When I attempt ...
2
votes
1
answer
281
views
Unable to enroll Windows workstation in enterprise CA - DNS_ERROR_NAME_DOES_NOT_EXIST
I have a single machine, out of hundreds, that will not pull a certificate from our enterprise CA when trying to enroll it.
The CA shows a failed request with error: DNS name does not exist. ...
- 3,860
0
votes
1
answer
2k
views
Cannot pull images from Kubernetes from a private registry with self-sign certificates if I change CA
I created a private registry with a self-sign certificate
If I'll try to pull the image from it w/o importing the CA into trusted certificates, it will fail.
If I'll try to update trusted certificates ...
- 101
2
votes
1
answer
534
views
OpenVPN Revoke a certificate without the CRT file with Easy RSA
I'm confused, I have an OpenVPN server on Debian. The previous system administrator who was in charge of this server deleted the user certificates (.crt file) with the command "rm -f example.crt&...
- 23
0
votes
1
answer
536
views
Attributes Windows CA templates
Windows Enterprise CA.
I have been requested that in the certificates appear the following attributes: OU, C (country) and O (organization).
I have seen that in the certificate template in the "...
- 39
1
vote
1
answer
191
views
Warning with sending emails from Thunderbird to Postfix using its own CA
I'm asking for help because I simply don't have the strength anymore, I've spent a lot of time and I'm still left with an unsolved puzzle.
My problem: I keep getting "Wrong Site" warnings ...
- 31
0
votes
0
answers
424
views
Must a valid SSL/TLS certificate include "client authentication" purpose (OID 1.3.6.1.5.5.7.3.2)?
In other words, could the missing "client authentication" purpose in our CA-issued SSL cert be the reason it's not trusted by browsers?
If so, how do I add that purpose / OID in a CSR (...
- 306
0
votes
4
answers
400
views
Can Standalone (online) CA + Subordinate Enterprise CA configuration issue valid intranet SSL certs?
The question is purely about whether this config is capable of issuing valid intranet SSL certs (i.e. SSL certs for internally facing sites), and not any other implications or concerns.
(The focus of ...
- 306
0
votes
1
answer
682
views
Find issued certs based on signing templates
I am looking for a way to query on issued certs from my CA based on their signing template. Here is what I start using (based on PSPKI 4.0.0 module);
$AllCerts= Get-CertificationAuthority -name ...
- 27
0
votes
1
answer
354
views
CA Offline Standard publish Active Directory
I have a hierarchy of one offline CA (standard) and 2 subCAs (enterprise).
The offline CA is not published in Active Directory and the 2 SubCa's are published in AD.
Can the offline CA be modified to ...
- 39
0
votes
0
answers
33
views
CA template Windows
In a Windows CA, I have mistakenly removed permissions from a template and now I can't modify it.
How do I modify or delete this template to create it again?
Thanks
- 39
0
votes
0
answers
45
views
Request Certificate CA
I have a Windows server configured as a Certificate Authority (CA).
When requesting a certificate via https://server/certServ and choosing the template to request (Request Certificate->Advance ...
- 39
0
votes
1
answer
1k
views
How to renew the Root CA Certificate on Microsoft Active Directory Enterprise CA
How to renew the Root CA certificate on Microsoft Active Directory Enterprise Root Certificate Authority Windows Server 2012 R2?
The certificate expired on 27 Aug. 2023, getting the error below while ...
Shakeel Parkar
0
votes
1
answer
129
views
CA: Certificate User for VPN
From a subordinate Enterprise CA I want to generate a user certificate that serves as an authentication method for VPN connections.
I want to install this certificate with autoenroll on the domain ...
- 39
0
votes
0
answers
323
views
Migrating a CA to a new server - CA services won't start
We have an Enterprise Root CA running on Server 2012 R2. I built a replacement server running Server 2019 and followed the steps in the below article, I backed up the CA and relevant registry keys, ...
- 1
0
votes
1
answer
1k
views
LDAPS certificate isn't working on new server for third parties
About 5-6 years ago I setup LDAPS on my Primary Domain controller. I setup Active Directory Certificate Services (all on the same server), forwarded the port 636 on my firewall, and was able to ...
- 634
0
votes
0
answers
298
views
Are crl updated automatically to user after a certificate is being revoke?
I'm clueless on how does this CRL/OCSP works. We do have a local enterprise CA, and was set on the CRL publication interval to 8 days. As what was told, when the certificate is revoked, it does not ...
- 1
1
vote
1
answer
189
views
SubCA certificate of trust
I have deployed a PKI infrastructure with a Stand-Alone Root CA (which will be kept off) and 4 Enterprise SubCA's which depends on this Root CA.
To make the computers trust the Root CA, I am going to ...
- 39
0
votes
0
answers
157
views
SSH CA-signed key does not work from certain hosts
I've tried to setup CA signed ssh user keys.
I got my configuration working on most clients, there seems to be problem on a few specific ones.
The key verification fails and they are prompted for ...
0
votes
0
answers
199
views
How to setup https website when I have own CA
I have very interesting question for me... I'm runnig webserver on linux machine (debian 10) with apache. In the same domain I have Windows Server on which are my DNS server and Certificate authority.
...
- 25
0
votes
0
answers
192
views
How to submit certificate request from RedHat machine to Windows CA?
I’m looking for solution, which helps me send certificate request from domain-joined RedHat Enterprise Linux machine to Certification Authority on Windows Sever 2022. Is there any solution to do this? ...
- 19
1
vote
1
answer
380
views
Kubernetes cluster with certificate authority
Certificate error after upgrade of kubernetes
Error is SSL certificate problem:unable to get local issuer certificate
After doing multiple modifications Now I'm getting above error.
1
vote
1
answer
991
views
PKI hierarchy. Root CA CAand subordinate
I have to deploy a new PKI hierarchy
I have one domain and several subdomains
I had thought about having a Root CA and a Sub CA.
What are the advantages of this option over having a root CA only?
Do ...
- 39
0
votes
1
answer
287
views
How can we stop a repeated request for the same certificate in ADCS?
If I submit the same CSR file twice to my Active Directory Certificate Services (online via the certsrv web interface), I am issued two different certificates (judging by the serial numbers).
Is there ...
- 23
-1
votes
1
answer
553
views
What could be causing PowerMTA not to forward emails over port 465 SSL...?
We have a PowerMTA server that receives incoming e-mail. and forward it to external SMTP server that's not running PowerMTA i tried to do it using port 587 and port 25 both working fine and emails ...
