In cryptography, a certificate authority, or certification authority, (CA) is an entity that issues digital certificates.

learn more… | top users | synonyms (1)

2
votes
3answers
17k views

Install Trusted root certificate authority certificate via GPO

We have a Win2k8 as a Domain Controller in a domain with workstations that run Windows XP. I would like to be able to install via GPO a new trusted root certificate authority certificate that I've ...
1
vote
2answers
8k views

Can't make httpd use correct SSL

I have a signed CA, issued by my university. I generated my CSR using their public key file as so: openssl genrsa -out myservername.key 2048 (new key) openssl req -new -key myservername.key -out ...
4
votes
1answer
5k views

CA and Primary Domain Controller on the same server

I am setting up a Microsoft AD to be my CA. After research, it looks like I need to have a domain controller before I can issue certs thru the CA. Would it be possible to place both the CA and the DC ...
2
votes
1answer
290 views

When installing a Windows sub CA from an offline root, how do I “recreate” it w/o reinstalling?

I have an offline root and am trying to constrain it using the EKUs so it doesn't have all application policies. Most of this is trial and error and I"d like to make this more efficient rather than ...
2
votes
1answer
706 views

Multiple CA's on Windows Server 2012

Is it possible to create multiple Certficate Authorities in Windows Server 2012? Specifically: I'd like to create a standalone root CA which will have its private key in offline secure storage. The ...
1
vote
1answer
1k views

How do I manually publish a CRL for a certificate?

I have setup a new server and installed Remote Access and Certificate Authority services so I can configure it as a VPN. I have created my own certificate through http://localhost/certsvr, and have ...
0
votes
3answers
1k views

generating client.ovpn file on android

I am developing a open source application wrapper over OpenVPN library for Android. For that I need to generate openvpn conf file. I have followed OpenVPN how but did not understand how to generate ...
1
vote
1answer
3k views

cURL looking for CA in the wrong place

On Redhat Linux, in a PHP script I am setting cURL options as such: curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, True); curl_setopt($ch, CURLOPT_CAINFO, '/home/andrew/share/cacert.pem'); Yet I am ...
10
votes
1answer
347 views

Utilizing an alternate CA (Like Microsoft Certificate Services) with Puppet

I'm investigating whether I can somehow make the puppet ecosystem utilize our existing Microsoft Enterprise CA rather than being its own CA. Since puppet touts that all of the system is "standard ...
1
vote
1answer
202 views

Client side certificates in client browsers with unix server for management

We are currently running Unix dedicated servers for everything (Web cluster, database, FTP, batch, ...) except for a Microsoft Active Directory Certificate Services. The sole purpose of this Windows ...
3
votes
1answer
236 views

Using an audio cable (or similar) to create unidirectional communication from a secure server

I'm interested in exploring how a semi-offline Root CA can be used to update CRLs to the sub CA's. This answer on Security.SE mentions using an audio cable for this purpose. Doe anyone have details ...
6
votes
1answer
5k views

SSL certificate: unable to get local issuer certificate [closed]

I'm running Debian (Lenny). When I run this: curl --ssl https://www.google.com I get this error: curl: (60) SSL certificate problem: unable to get local issuer certificate More details here: ...
2
votes
1answer
251 views

Backing up Windows 2003 Server that has Certificate Authority

I want to export and migrate a Certificate Authority CA role from a Windows 2003 machine to a new copy of Windows 2008 R2 virtual machine. I was told that I cannot have 2 CA roles on the same network ...
3
votes
2answers
2k views

How does IE/Chrome know which Intermediate CA to use when not part of chain?

A server on my network is signed with a certificate issued by RapidSSL CA but does not supply to complete issuer chain (RapidSSL CA's certificate is issued by GeoTrust CA which is a trusted root ...
0
votes
2answers
155 views

What kind of SSL Cert do I need and where do I get it?

I want to have subdomains with SSL within my domain. The main difference is that each subdomain is hosted by a different person with a different public key/private key pair. Let me illustrate with an ...
1
vote
1answer
429 views

Certificates compartments (certmgr.msc)?

After reading a while , Im trying to understand what kind of certificates will be found at : Personal Other People Trusted Root Certicfiation Authorities will personal will contains only private ...
0
votes
1answer
2k views

AD Certificate Templates does not appear

I'm following what should be simple instructions to enable LDAP SSL on our domain controller (instructions here). Duplicating the Kerberos certificate is successful however, when attempting to select ...
2
votes
1answer
206 views

Missing subject field values in user certificate (Windows)

I am trying to enroll (on behalf of) a user certificate but certain fields appear to be missing in the subject field. Specifically, O and OU. Using ADSI, I see that the fields have the values I want ...
5
votes
1answer
1k views

Microsoft CA certificate templates expires sooner than expected

The certificates my Microsoft CA is generating do not match the time period indicated in the template used. How can I resolve this? I recently created a new certificate template for use on my Linux ...
3
votes
1answer
679 views

Use “Server Certificates” remotely in IIS

I'm using IIS Manager to remotely manage another IIS server. When I'm managing the local server, I can select the "Server Certificates" icon under IIS when I select the local server in the list to ...
4
votes
2answers
482 views

Migrate an intermediate CA to a new root

Using the Microsoft CA is there any way to cut over to a new certificate authority from an intermediate authority? Both my systems are Microsoft CAs - I have a 2008 R2 Enterprise CA (intermediate) ...
0
votes
2answers
3k views

Create and use intermediate certificate authority on Windows Server 2012?

Background: Server OS is Windows Server 2012. GUI is installed as we come upto speed with powershell. Setup is staging, not production (yet). We have our (internal, domain limited) Root CA installed. ...
10
votes
6answers
907 views

Replacing sick NTP server source and re-synching (with internal time currently 2 minutes late)

One of the external NTP servers (the primary one--currently) we're using as source seems to not be responding to NTP calls. Unfortunately, on our core router (Cisco 6509), the NTP functionality ...
0
votes
2answers
3k views

How to secure an internal website for internal users, using SSL and Server 2008 as a CA?

I'm needing an experienced person to guide me on this little project :-) We have one Domain Controller [Win2k8 R2] with the Active Directory Certificate Services role. Let's call it ...
1
vote
2answers
781 views

Cannot start httpd service with SSL

Have an issue where I have installed new certificates on Centos 5 and modified the conf file for the following lines: SSLCertificateFile /etc/pki/tls.certs/name.crt SSLCertificateKeyFile ...
14
votes
3answers
4k views

Windows 2008 R2 CA and auto-enrollment: how to get rid of >100,000 issued certificates?

The basic problem I'm having is that I have >100,000 useless machine certificates cluttering up my CA, and I'd like to delete them, without deleting all certs, or time jumping the server ahead, and ...
4
votes
1answer
2k views

What causes automatic install of trusted root certificate authorities into local machine's certificate store?

I spend whole day by diagnosing issue with my test services using mutual HTTPS. Services are hosted in IIS 7 on a test server running Windows Server 2008 Enterprise edition. Suddenly few weeks ago ...
3
votes
1answer
151 views

Is there a low cost certificate authority that is generally accepted for TLS over SMTP? [closed]

I'm getting ready to enable TLS on my Postfix servers. I am doing this as a result of being told that there are some sending servers that refuse to send messages if TLS is not available. Since I ...
3
votes
3answers
1k views

Check if root ca certificate is installed

We are having a custom CA for our local-domains. The Root CA certificate is installed on all the corporate machines by default, but sometimes it happens that we have someone here who doesn't have it ...
2
votes
1answer
684 views

Deleted a CA improperly and receiving a 10009 Event ID error

The basic run down is I didn't know what I was doing and I deleted a CA I stood up but I couldn't get to work properly. I know dumb. But that being said not much I can do about it now. I went through ...
1
vote
1answer
596 views

Do I need to replace my Windows Server 2003 Certificate authority?

I had a windows 2003 domain controller fail. The power supply went and took averything with it. Luckily, I have 2 other domain controllers. The only sticking point is that the server that failed was ...
0
votes
1answer
6k views

How can I get SBS2011 to issue certificates?

I want to use certificates to authenticate both client and server for a new internal service. Since all our servers already have the SBS (2011 Standard) server's Cert installed as a Trusted Root, ...
7
votes
3answers
2k views

Outlook Encrypted Emails boo boo

I just reinstalled my Windows OS 7 and forgot to backup my Email Certificate for Outlook 2010 beforehand. Now I can't read any encrypted emails. When I try, it says "Cannot open this item. Your ...
0
votes
1answer
41 views

CA is not listed on Autoenrollment dialogs

I've had for a long time a 2003 AD Root CA in the domain and Admins have been able to request certificates to this CA through IIS interface without the need to generate a request file using the Create ...
1
vote
0answers
2k views

Certificate enrollment for Local system failed to enroll Event ID:13

I've just finished installing a second domain controller to gain redundancy in the network. (and to solve some issues) After installation and configuring all errors are gone but one that is: Event ...
2
votes
1answer
2k views

Slow starting Domain Controller after installing Enterprise Certificate Authority in Windows 2008 R2

Because I want to test SSL in the local domain I've installed Enterprise Certificate Authority with the use of this tutorial. The Install went successful and after install I rebooted the DC. While ...
3
votes
2answers
5k views

Configuring client certificate authentication in apache

I am trying to set up part of a Virtualhost in apache to require client authentication. The VirtualHost in question also acts as a reverse proxy for the actual web server. Here's what I have done: ...
4
votes
1answer
1k views

Windows 2003 x32 CA to Windows 2008 x64 CA migration

In the following period I have to migrate the AD over to 2008 schema level. I currently have a x64 Windows 2008 R2 domain controller and one x32 Windows Server 2003 domain controller. The x32 server ...
1
vote
0answers
958 views

OpenVPN without Root-CA

Simple OpenVPN Setup with SSL Authentication. SSL-Setup: Root-CA > Intermediate-CA > Issuing-CA All certificates (vpn-server and -clients) are issued by the "Issuing-CA". I tried to use the ...
1
vote
1answer
320 views

How to extract CRL location from x509 certificate using OpenSSL utility

I need to extract the crl location from a certificate authority so I can use that in verifying certificates. Is this possible using the openssl utility other than using the -text option and attempting ...
1
vote
1answer
3k views

Microsoft Standalone CA - Set expiration date of an individual request

I have set up a Microsoft Standalone CA on 2008 R2 as a root CA. I'm trying to setup a subordinate Enterprise CA. I generated the certificate request, and submitted it to the root CA. Then, I ran ...
1
vote
1answer
358 views

Decommissioning PKI - How do I set a CRL Next update to null?

I am planning on deploying two Windows 2008R2 PKIs: One for legacy devices that don't support SHA-2 / ECP and another one that does support it. When the time comes to decommission the SHA1 ...
4
votes
1answer
566 views

How large is the certificate OCSP and CRL cache in my Windows server?

How can I see the size of the in-memory OCSP cache to a CRL cache in my Domain Controllers? In other words, most Windows process that uses CryptoAPIs have an in-memory cache of every CRL and OCSP ...
17
votes
5answers
28k views

How to update cURL CA bundle on RedHat?

I am running into issues where the CA bundle that has been bundled with my version of cURL is outdated. curl: (60) SSL certificate problem, verify that the CA cert is OK. Details: error:14090086:SSL ...
1
vote
1answer
860 views

Domain Environment + Certificate Authority + Server 2008 R2

I have recently been delegated the task to setup a CA in our domain environment and have a question on why Microsoft does somethings the way they do lol. I have been trying to read up on what the ...
0
votes
1answer
542 views

Self-signed Certificate ( Makecert.exe or CA )

I have configure PowerShell Execution policy on Server as AllSigned, so i want to create a certificate for signing a ps1 script. Can you guide me, which Certificate Should i use? I want to used ...
2
votes
1answer
516 views

Can't request computer certificate

I am using MMC with the snaping of certificates. I am requesting certificates from a brand new installation of a CA. Requesting User certificates works perfectly. Requesting Computer certificates ...
1
vote
1answer
84 views

Broad SSL questions about certificates, domains & servers

I've only done basic stuff with signed certificates (basically follow the instructions from CA). I have general questions moving forward that I hope someone can answer. There are so many different ...
1
vote
3answers
2k views

How can an OpenVPN server be setup to use multiple certificates?

The OpenVPN documentation sets up a single certificate from a single CA to be used for all clients. Is there a way to set the server to enable multiple certificates from different CAs so long as the ...
8
votes
1answer
1k views

Deploy internal CA to linux clients

I have a large number of workstations that run RedHat Enterprise Linux 5 and 6. I'd like to deploy our new internal CA (Active Directory) to these machines. I can manually import the certificate ...