In cryptography, a certificate authority, or certification authority, (CA) is an entity that issues digital certificates.

learn more… | top users | synonyms (1)

0
votes
1answer
237 views

OSX doesn't recognize certificate's signing authority

I have my own root certificate that I have imported into my OSX 'login' keychain and told it to trust across the board. I am now creating a certificate for S/MIME. I create the CSR in Keychain Access ...
1
vote
0answers
729 views

Sendmail Server Authentication: Certificate based: Error

I have configured my setup for a server certificate based authentication. Both Server and Client are sendmail systems and both have the same set of certificates. However when client communicated ...
1
vote
1answer
249 views

sendmail (Smart Host) authentication with server using certificates

We are trying to prepare a setup with following configuration: We have a Central mail server which acts as a gateway to the internet for our domain. We have some client machines which access ...
3
votes
2answers
432 views

Windows PKI with offline root (maybe with OpenSSL) - Possible?

I'm trying to setup a two-tier PKI and I have a ton of questions. Since there's the tombstone limit for the AD, I'm assuming that the root (which will be offline) shouldn't be part of the AD. Am I ...
1
vote
1answer
250 views

Code signing certificate not available to sign macros

We are trying to give one of our user the ability to sign his macros in Excel with a certificate issued by Certficate Authority. The Certificate Authority role is installed on the Domain Controller ...
0
votes
1answer
944 views

Can't locate SBS 2011 Certification Authority Web interface

Certification Authority Installed Certification Authority Web Enrollment Installed Certification Enrollment Web Services Not Installed Certification Enrollment policy web service Not Installed ...
0
votes
1answer
353 views

Error when install SSL certificate on MediaTemple GS server

Here is what happened: I generate the CSR via the MediaTemple site (that is the only way to do it. since a GS is a share server). Send it over the namecheap.com (its signed by RapidSSL). When I got ...
0
votes
2answers
906 views

Generating SAN SSL Certificate that works for firefox and chrome

I am trying to generate a SSL certificate that after being signed by my own CA will work for multiple domains. My openssl configuration file looks like this: [ req ] default_bits = 2048 ...
2
votes
1answer
327 views

Is there a cmd/certutils to copy a certificate from one store to another?

I would like to know if there is a cmd to copy an existing certificate from one store to another. I am trying to copy a certificate from the Users Intermediate Certification Authorities store ...
0
votes
1answer
33 views

nginx ssl with CA

I have a Premium SSL Cert with a provider and they sent me chain.cer, site.pem and site.cer. Do I need to do something special to avoid getting "The site's security certificate is not trusted!" when ...
3
votes
2answers
8k views

Error code: ssl_error_rx_record_too_long

I have nginx with the following setup: server { listen 80; server_name site.com www.site.com; root /home/site/public_html; listen 443; ...
0
votes
2answers
85 views

Using an SSL certificate in multiple locations

I have some issues with respect to using SSL Certificates. I have a website hosted in UK and I also have an organisation in South Africa hosting my company application online for web access. The ...
1
vote
0answers
180 views

How to properly replace CA certificate when clients get it bundled in PKCS#12 containers?

I'm about to regenerate a certificate of my CA (maintained by OpenSSL) used mostly to provide OpenVPN access to the intranet for my clients. My question is related to this one — "Certification ...
0
votes
0answers
26 views

Local CA for remote web server

I have two domains and the one I am in has a certificate authority server. The domain I am not in doesn't have a CA server. I want to certify https on that server so that I can get there without the ...
0
votes
1answer
292 views

Can't get self-signed CA cert to request corresponding client cert; Apache

I'm running Apache 2.2 on Windows, and have mod_ssl working fine for delivering a commercially signed server cert. (A wildcard cert, though I don't think it matters.) I'm trying to get the server, ...
-1
votes
2answers
223 views

Update CA Bundle on Redhat 6

I have a few Redhat 6 servers that are unable to verify the certificate of an HTTPS site. I have checked, and they don't appear to have a very current CA bundle. The file ...
0
votes
1answer
353 views

ipa root certificate signing

I am trying to get my ipa certificate signed by openca and its getting rejected due to hostname. The following hostnames were rejected because the system couldn't link them to your account, if they ...
1
vote
1answer
611 views

java keystore can't validate URL

With the same url, this ends up giving a verify return code 20 (unable to get local issuer of certificate): openssl s_client -connect $URL:443 -showcerts -CAfile /etc/ssl/certs/java/cacerts This ...
2
votes
4answers
4k views

Nginx and client certificates from hierarchical OpenSSL-based certification authorities

I'm trying to set up root certification authority, subordinate certification authority and to generate the client certificates signed by any of this CA that nginx 0.7.67 on Debian Squeeze will accept. ...
2
votes
3answers
14k views

Install Trusted root certificate authority certificate via GPO

We have a Win2k8 as a Domain Controller in a domain with workstations that run Windows XP. I would like to be able to install via GPO a new trusted root certificate authority certificate that I've ...
1
vote
2answers
6k views

Can't make httpd use correct SSL

I have a signed CA, issued by my university. I generated my CSR using their public key file as so: openssl genrsa -out myservername.key 2048 (new key) openssl req -new -key myservername.key -out ...
4
votes
1answer
3k views

CA and Primary Domain Controller on the same server

I am setting up a Microsoft AD to be my CA. After research, it looks like I need to have a domain controller before I can issue certs thru the CA. Would it be possible to place both the CA and the DC ...
2
votes
1answer
270 views

When installing a Windows sub CA from an offline root, how do I “recreate” it w/o reinstalling?

I have an offline root and am trying to constrain it using the EKUs so it doesn't have all application policies. Most of this is trial and error and I"d like to make this more efficient rather than ...
2
votes
1answer
603 views

Multiple CA's on Windows Server 2012

Is it possible to create multiple Certficate Authorities in Windows Server 2012? Specifically: I'd like to create a standalone root CA which will have its private key in offline secure storage. The ...
1
vote
1answer
993 views

How do I manually publish a CRL for a certificate?

I have setup a new server and installed Remote Access and Certificate Authority services so I can configure it as a VPN. I have created my own certificate through http://localhost/certsvr, and have ...
0
votes
3answers
1k views

generating client.ovpn file on android

I am developing a open source application wrapper over OpenVPN library for Android. For that I need to generate openvpn conf file. I have followed OpenVPN how but did not understand how to generate ...
1
vote
1answer
2k views

cURL looking for CA in the wrong place

On Redhat Linux, in a PHP script I am setting cURL options as such: curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, True); curl_setopt($ch, CURLOPT_CAINFO, '/home/andrew/share/cacert.pem'); Yet I am ...
10
votes
1answer
302 views

Utilizing an alternate CA (Like Microsoft Certificate Services) with Puppet

I'm investigating whether I can somehow make the puppet ecosystem utilize our existing Microsoft Enterprise CA rather than being its own CA. Since puppet touts that all of the system is "standard ...
1
vote
1answer
196 views

Client side certificates in client browsers with unix server for management

We are currently running Unix dedicated servers for everything (Web cluster, database, FTP, batch, ...) except for a Microsoft Active Directory Certificate Services. The sole purpose of this Windows ...
3
votes
1answer
214 views

Using an audio cable (or similar) to create unidirectional communication from a secure server

I'm interested in exploring how a semi-offline Root CA can be used to update CRLs to the sub CA's. This answer on Security.SE mentions using an audio cable for this purpose. Doe anyone have details ...
5
votes
1answer
5k views

SSL certificate: unable to get local issuer certificate [closed]

I'm running Debian (Lenny). When I run this: curl --ssl https://www.google.com I get this error: curl: (60) SSL certificate problem: unable to get local issuer certificate More details here: ...
2
votes
1answer
229 views

Backing up Windows 2003 Server that has Certificate Authority

I want to export and migrate a Certificate Authority CA role from a Windows 2003 machine to a new copy of Windows 2008 R2 virtual machine. I was told that I cannot have 2 CA roles on the same network ...
3
votes
2answers
2k views

How does IE/Chrome know which Intermediate CA to use when not part of chain?

A server on my network is signed with a certificate issued by RapidSSL CA but does not supply to complete issuer chain (RapidSSL CA's certificate is issued by GeoTrust CA which is a trusted root ...
0
votes
2answers
145 views

What kind of SSL Cert do I need and where do I get it?

I want to have subdomains with SSL within my domain. The main difference is that each subdomain is hosted by a different person with a different public key/private key pair. Let me illustrate with an ...
1
vote
1answer
370 views

Certificates compartments (certmgr.msc)?

After reading a while , Im trying to understand what kind of certificates will be found at : Personal Other People Trusted Root Certicfiation Authorities will personal will contains only private ...
0
votes
1answer
2k views

AD Certificate Templates does not appear

I'm following what should be simple instructions to enable LDAP SSL on our domain controller (instructions here). Duplicating the Kerberos certificate is successful however, when attempting to select ...
2
votes
1answer
162 views

Missing subject field values in user certificate (Windows)

I am trying to enroll (on behalf of) a user certificate but certain fields appear to be missing in the subject field. Specifically, O and OU. Using ADSI, I see that the fields have the values I want ...
5
votes
1answer
1k views

Microsoft CA certificate templates expires sooner than expected

The certificates my Microsoft CA is generating do not match the time period indicated in the template used. How can I resolve this? I recently created a new certificate template for use on my Linux ...
3
votes
1answer
562 views

Use “Server Certificates” remotely in IIS

I'm using IIS Manager to remotely manage another IIS server. When I'm managing the local server, I can select the "Server Certificates" icon under IIS when I select the local server in the list to ...
4
votes
2answers
398 views

Migrate an intermediate CA to a new root

Using the Microsoft CA is there any way to cut over to a new certificate authority from an intermediate authority? Both my systems are Microsoft CAs - I have a 2008 R2 Enterprise CA (intermediate) ...
0
votes
2answers
3k views

Create and use intermediate certificate authority on Windows Server 2012?

Background: Server OS is Windows Server 2012. GUI is installed as we come upto speed with powershell. Setup is staging, not production (yet). We have our (internal, domain limited) Root CA installed. ...
10
votes
6answers
829 views

Replacing sick NTP server source and re-synching (with internal time currently 2 minutes late)

One of the external NTP servers (the primary one--currently) we're using as source seems to not be responding to NTP calls. Unfortunately, on our core router (Cisco 6509), the NTP functionality ...
0
votes
2answers
2k views

How to secure an internal website for internal users, using SSL and Server 2008 as a CA?

I'm needing an experienced person to guide me on this little project :-) We have one Domain Controller [Win2k8 R2] with the Active Directory Certificate Services role. Let's call it ...
1
vote
2answers
666 views

Cannot start httpd service with SSL

Have an issue where I have installed new certificates on Centos 5 and modified the conf file for the following lines: SSLCertificateFile /etc/pki/tls.certs/name.crt SSLCertificateKeyFile ...
14
votes
3answers
3k views

Windows 2008 R2 CA and auto-enrollment: how to get rid of >100,000 issued certificates?

The basic problem I'm having is that I have >100,000 useless machine certificates cluttering up my CA, and I'd like to delete them, without deleting all certs, or time jumping the server ahead, and ...
4
votes
1answer
2k views

What causes automatic install of trusted root certificate authorities into local machine's certificate store?

I spend whole day by diagnosing issue with my test services using mutual HTTPS. Services are hosted in IIS 7 on a test server running Windows Server 2008 Enterprise edition. Suddenly few weeks ago ...
3
votes
1answer
142 views

Is there a low cost certificate authority that is generally accepted for TLS over SMTP? [closed]

I'm getting ready to enable TLS on my Postfix servers. I am doing this as a result of being told that there are some sending servers that refuse to send messages if TLS is not available. Since I ...
3
votes
3answers
943 views

Check if root ca certificate is installed

We are having a custom CA for our local-domains. The Root CA certificate is installed on all the corporate machines by default, but sometimes it happens that we have someone here who doesn't have it ...
2
votes
1answer
605 views

Deleted a CA improperly and receiving a 10009 Event ID error

The basic run down is I didn't know what I was doing and I deleted a CA I stood up but I couldn't get to work properly. I know dumb. But that being said not much I can do about it now. I went through ...
1
vote
1answer
529 views

Do I need to replace my Windows Server 2003 Certificate authority?

I had a windows 2003 domain controller fail. The power supply went and took averything with it. Luckily, I have 2 other domain controllers. The only sticking point is that the server that failed was ...