In cryptography, a certificate authority, or certification authority, (CA) is an entity that issues digital certificates.

learn more… | top users | synonyms (1)

0
votes
1answer
192 views

Change certificate auto enrollment settings from long gone CA to new CA

We started getting event ID 13 from a our domain controllers: Certificate enrollment for Local system failed to enroll for a DomainController certificate with request ID N/A from ...
2
votes
1answer
98 views

In place upgrade on a Windows 2003 with Certificate services

I'm looking to do an in-place upgrade for 2 Windows 2003 servers domain controllers running certificates to Windows 2008 R2. Will it work, has anyone tried this, and will I need to do anything with ...
2
votes
1answer
2k views

Install a root certificate in CentOS 6

I know it has been already asked, but despite many hours of research I couldn't find a working solution. I am trying to install my root certificate in my server, so internal service can bind to each ...
1
vote
1answer
49 views

Anyone know of a way to find all certs that weren't auto-enrolled?

I'm in the process of moving an Active Directory Certificate Services role over to a new 2012 server. The new server will be issuing new certs and I need to find all certs that weren't handed out by ...
2
votes
1answer
111 views

OpenVPN fails while openssl verifies ok

I have recently created a new CA certificate, as the old one was about to expire. I deployed this certificate to our OpenVPN server, and on it the verification of local certificate goes ok with both ...
1
vote
1answer
77 views

LDAPS Only Works on Domain Certificate Authority and Not on Other Domain Controllers - Active Directory Certificate Services - Windows Server 2008 R2

I have 3 Domain Controllers with Active Directory role installed on them. I installed Certificate Services on one of the Domain Controllers. I am able to LDAPS to it, but not the others even though ...
0
votes
0answers
58 views

override specific DN fields when signing csr

When signing CSR on CA side, how can I override specific DN fields by custom value? I want to ignore what is written in CSR. For example in C= and O= fields and replace them by something static. Other ...
0
votes
0answers
57 views

Installing the Apple Root Certificate Authority on CentOS CLI

I could be barking up the wrong tree here, but I'm looking for help on installing Apple's Root certificate (http://www.apple.com/certificateauthority/) on a CentOS server via the command line - which ...
0
votes
1answer
193 views

Windows Server 2008 R2 creating a multi-year client certificate using the IIS certsrv page while deploying SSTP VPN

I am trying to follow instructions on Technet about deploying a Standard (non-enterprise) SSTP based VPN) that were originally written for Server 2008, but I am using Server 2008 R2, I have gotten as ...
1
vote
0answers
467 views

How do I set up an 802.1X infrastructure for use with OS X and iPads?

At my workplace I have been tasked with setting up machine certificate based 802.1X wireless authentication for our Apple devices. It seems like on the client side this will be handled by Profiles ...
0
votes
1answer
64 views

OpenVPN: Single certificate authority, multiple VPNs

The company in which I work has a single site (I'll refer it as "Site A"). There are several private networks within site A. We have a running instance of OpenVPN which allows some employees to ...
3
votes
2answers
94 views

Using our own certificate authority for business email encryption

I've read the available similar questions on serverfault but I haven't quite found a definite answer to the security aspect of it - hence here's my question: I'm administrator of an office working ...
0
votes
1answer
105 views

Windows Xp Autoenrollment Issue

i've trouble to auto enroll for Xp Clients. I setup up an two tier ca on windows 2012 and configured Autoenrollment. So far i just have been testing with Windows 7 Client and i have no issue at all. I ...
0
votes
1answer
45 views

OpenSSL not using CA directory

OpenSSL will not verify a cert $openssl s_client -connect <host>:443 ... Verify return code: 21 (unable to verify the first certificate) However, if we figure out the location of the store $ ...
0
votes
1answer
12 views

What refer/mean “Remote Server Authentication” at Apache mod_ssl doc?

The part of the doc in that such term is used is this. Can anybody give some context or explain me what mean Remote Server Authentication there? I know that Apache server can authenticate clients but ...
2
votes
1answer
293 views

Where to get root CA certificates for Windows Server now that Microsoft no longer updates them?

Microsoft removed root CA updates from WSUS in January 2013. I now have some fresh installs of Windows Server 2012 that have an insufficient set of root CAs (basically just Microsoft's own CAs). This ...
0
votes
0answers
266 views

How to configure IPSEC for windows server 2012

I am trying to configure an ipsec connection between 2 windows 2012 servers but i have some problems. I am new to windows server configuration so any help will be really appreciated. Lets start with ...
2
votes
1answer
74 views

Openvpn signing certificates with wrong CA

I have a working (until now) ubuntu openvpn server. I think that my server is using a wrong CA to sign client CRTs. E.g: I use "source ./vars" followed by "./build-key john.doe" and it all works ...
0
votes
1answer
661 views

Renewing Service Certificates for NDES on Windows Server 2008 R2

We currently use the NDES Service on Windows 2008 R2 Enterprise where the same box is also the standalone Certificate Authority. During initial setup, NDES created 2 service certificates for SCEP ...
5
votes
1answer
430 views

IIS no longer trusts any CAs for client authentication

Yesterday the IIS on our build server (running Windows Server 2012) started refusing our clients' certificates. The certificates are signed using our own self-signed CA cert that has been added to ...
2
votes
1answer
755 views

Windows 2012 SSTP The revocation function was unable to check revocation because the revocation server was offline

In order to get rid of "Error 0×80092013: The revocation function was unable to check revocation because the revocation server was offline" you have to install base/delta CRLs on the client you want ...
1
vote
0answers
421 views

Thunderbird not trusting certificate signed with self-signed authority

I have generated a self-signed certificate authority using mydomain.org as the common name. I imported the public certificate using Thunderbird's certificate manager under the "Authorities" tab. So ...
5
votes
1answer
185 views

How to get certificate common name from PEM file

Various articles online have lead me to believe that a server certificate's common name must be an exact match to the root URL it is valid for. However, when I look at a bunch of the files in ...
-1
votes
1answer
99 views

LDAPS certificate not working with IP address

I have a certificate assigned to my Domain Controller/Certificate Authority that has no subject name assigned but has two FQDN's and and IP in the alternative names under DNS and IPv4 respectively. ...
0
votes
1answer
167 views

Preventing Windows from deleteing our root CA

I am trying to create a Windows server with an IIS server that has a web site with client certificate authentication. The client certificates are signed by our own root CA. Because of that we must ...
3
votes
0answers
49 views

Windows PKI: How can I import, sign/issue and export a large number of CSRs?

I have a lot of CRS that I need to have signed/issued and exported in windows. I was hoping I could batch process them somehow (certutil sounds like it can do some of the work) but I'm not quite sure ...
3
votes
1answer
308 views

Microsoft offline root CA CDP and AIA http URLs are hard coded - trouble ahead?

I'm new with ADCS, and there is a lot to understand. I set up a 2-tier PKI, and have placed the offline root CA certificate (CRT) and CRL files on a web server pointing to with a CNAME in DNS. When I ...
5
votes
1answer
99 views

How does this 2048bit SSL requirement affect existing internal PKIs?

We have our own CA which we've used for years to create hundreds of server certs and thousands of client certs. The CA cert itself is 1024bit and the certs it signed are 1024bit Symantec has been ...
1
vote
0answers
299 views

The revocation function was unable to check revocation for the certificate

I need to pass IIS certificate authentication on Windows Server 2012. The root cert haven't got any revocation lists but I'm getting exception: The revocation function was unable to check ...
1
vote
2answers
204 views

Remove old Certificate Templates

We decommissioned our old Exchange 2003 server over a month ago. The server was also our CA(which wasn't widely used). I've removed all traces of this old CA in Sites and Services except for the ...
2
votes
4answers
243 views

Managing a block of text with Puppet

I'm attempting to insert a block of text into my CA certificate file on CentOS hosts with Puppet. I asked about this before, and it seems CentOS is sorely lacking in certificate management ...
1
vote
2answers
146 views

Enabling Certificate Authority Auto-enrollment on Domain via GPO, any “dangers” I should be aware of?

I deployed a Standalone Offline Root CA and created a Sub Enterprise CA that handles enrollment and policy. There all setup correctly. I am getting ready to enable Auto-enrollment to the whole domain ...
3
votes
1answer
775 views

AD CS: Certificate Template not available

In short, a Certificate Template I want to use is not available for enrollment. The template in question is a copy of the "RAS and IAS Server" template. What's frustrating is that I've gotten this ...
0
votes
1answer
114 views

OSX doesn't recognize certificate's signing authority

I have my own root certificate that I have imported into my OSX 'login' keychain and told it to trust across the board. I am now creating a certificate for S/MIME. I create the CSR in Keychain Access ...
1
vote
0answers
363 views

Sendmail Server Authentication: Certificate based: Error

I have configured my setup for a server certificate based authentication. Both Server and Client are sendmail systems and both have the same set of certificates. However when client communicated ...
1
vote
1answer
142 views

sendmail (Smart Host) authentication with server using certificates

We are trying to prepare a setup with following configuration: We have a Central mail server which acts as a gateway to the internet for our domain. We have some client machines which access ...
3
votes
2answers
240 views

Windows PKI with offline root (maybe with OpenSSL) - Possible?

I'm trying to setup a two-tier PKI and I have a ton of questions. Since there's the tombstone limit for the AD, I'm assuming that the root (which will be offline) shouldn't be part of the AD. Am I ...
1
vote
1answer
109 views

Code signing certificate not available to sign macros

We are trying to give one of our user the ability to sign his macros in Excel with a certificate issued by Certficate Authority. The Certificate Authority role is installed on the Domain Controller ...
0
votes
1answer
318 views

Can't locate SBS 2011 Certification Authority Web interface

Certification Authority Installed Certification Authority Web Enrollment Installed Certification Enrollment Web Services Not Installed Certification Enrollment policy web service Not Installed ...
0
votes
1answer
137 views

Error when install SSL certificate on MediaTemple GS server

Here is what happened: I generate the CSR via the MediaTemple site (that is the only way to do it. since a GS is a share server). Send it over the namecheap.com (its signed by RapidSSL). When I got ...
0
votes
1answer
378 views

Generating SAN SSL Certificate that works for firefox and chrome

I am trying to generate a SSL certificate that after being signed by my own CA will work for multiple domains. My openssl configuration file looks like this: [ req ] default_bits = 2048 ...
2
votes
1answer
172 views

Is there a cmd/certutils to copy a certificate from one store to another?

I would like to know if there is a cmd to copy an existing certificate from one store to another. I am trying to copy a certificate from the Users Intermediate Certification Authorities store ...
0
votes
1answer
29 views

nginx ssl with CA

I have a Premium SSL Cert with a provider and they sent me chain.cer, site.pem and site.cer. Do I need to do something special to avoid getting "The site's security certificate is not trusted!" when ...
1
vote
1answer
3k views

Error code: ssl_error_rx_record_too_long

I have nginx with the following setup: server { listen 80; server_name site.com www.site.com; root /home/site/public_html; listen 443; ...
0
votes
2answers
78 views

Using an SSL certificate in multiple locations

I have some issues with respect to using SSL Certificates. I have a website hosted in UK and I also have an organisation in South Africa hosting my company application online for web access. The ...
1
vote
0answers
107 views

How to properly replace CA certificate when clients get it bundled in PKCS#12 containers?

I'm about to regenerate a certificate of my CA (maintained by OpenSSL) used mostly to provide OpenVPN access to the intranet for my clients. My question is related to this one — "Certification ...
0
votes
0answers
26 views

Local CA for remote web server

I have two domains and the one I am in has a certificate authority server. The domain I am not in doesn't have a CA server. I want to certify https on that server so that I can get there without the ...
0
votes
0answers
54 views

Combining CA's into a single PEM

I have been wondering if it is possible to combine two CA certificates into a single .pem, then use that pem to allow clients with certs signed by either CA to create TLS connections with an LDAP ...
0
votes
1answer
201 views

Can't get self-signed CA cert to request corresponding client cert; Apache

I'm running Apache 2.2 on Windows, and have mod_ssl working fine for delivering a commercially signed server cert. (A wildcard cert, though I don't think it matters.) I'm trying to get the server, ...
-1
votes
1answer
116 views

Update CA Bundle on Redhat 6

I have a few Redhat 6 servers that are unable to verify the certificate of an HTTPS site. I have checked, and they don't appear to have a very current CA bundle. The file ...