In cryptography, a certificate authority, or certification authority, (CA) is an entity that issues digital certificates.

learn more… | top users | synonyms (1)

0
votes
1answer
28 views

How to change/remove CRL on root cert?

A few years ago we installed certificate authority onto a widnows 2003 server (CAserver1). we created a self-signed root cert, and issued certs for internal services (https, WCF services, etc). Fast ...
1
vote
3answers
1k views

How can an OpenVPN server be setup to use multiple certificates?

The OpenVPN documentation sets up a single certificate from a single CA to be used for all clients. Is there a way to set the server to enable multiple certificates from different CAs so long as the ...
2
votes
1answer
33 views

Windows CA Certificate Request via Commandline

I have a non-domain PC (windows 7) attempting to obtain a cert from a Windows 2008 R2 Enterprise CA. I have the root ca and crl's installed on the non-domain client. I'm working on a script that will ...
0
votes
0answers
16 views

APNS server side Entrust certificate installation process

To ensure you can continue to validate your server's connection to the Apple Push Notification service, you will need to update your push notification server with a copy of the 2048-bit root ...
-5
votes
1answer
27 views

Enterprise Certificate Authority [closed]

I have an application that sends files to my customers i need to use my Enterpris CA to sign those files to encrypt them and give the the private key of the certificate to my customers to import it to ...
0
votes
2answers
2k views

Create and use intermediate certificate authority on Windows Server 2012?

Background: Server OS is Windows Server 2012. GUI is installed as we come upto speed with powershell. Setup is staging, not production (yet). We have our (internal, domain limited) Root CA installed. ...
8
votes
2answers
70 views

Powershell Remotely Delete PKI Certificates

I recently rebuilt my PKI and I would like to delete the certificates that were issued to all client machines across my network. Sounds like a job for Powershell! So I wrote this script to be ...
3
votes
2answers
86 views

Email results of PowerShell Script

I have a powershell script that check the certificate store for expiring certificates. It will display these results within the CLI. I want to modify this script to email the results of the output in ...
1
vote
0answers
39 views

No Certificate Templates in Certification Authority

I have installed AD Certificate Services on a Windows Server 2012 R2 Standard edition. But when I open Certification Authority snap-in, there is no Certificate Templates folder: Why? Have I missed ...
0
votes
1answer
715 views

Renewing Service Certificates for NDES on Windows Server 2008 R2

We currently use the NDES Service on Windows 2008 R2 Enterprise where the same box is also the standalone Certificate Authority. During initial setup, NDES created 2 service certificates for SCEP ...
3
votes
1answer
34 views

How can I get an OID for a certificate template?

I'm using C# (or VBScript) to issue a certificate from an Enterprise CA. According to this answer, I need to specify the OID instead of the certificate name, and place it in an unexpected portion of ...
4
votes
2answers
803 views

Standalone or Enterprise CA - what do I have?

When you install a Windows forest CA you have the option to make it standalone or enterprise. I have an existing installation which I am assuming is standalone as it doesn't have a certificate ...
5
votes
1answer
260 views

Windows 2012R2 seems to automatically download and install intermediate root certificates

Whilst preparing a new Windows 2012R2 server for production I needed to install a (GlobalSign Domain) SSL certificate for the website powering our application. I did this by generating a certificate ...
1
vote
1answer
24 views

How to install a root certificate from file

We are in the process of migrating to Exchange 2013 on Server 2012 R2, and will be using third party certificates once fully up and running. In the meantime, however, I have been asked to use a root ...
3
votes
1answer
32 views

Publish root CA and sub ca certificate to the Trusted root certificate store

I have a root CA which is standalone and I have subordinate CA which is domain joined. I recently renewed the certificate of my root CA and sub CA. How do I push these certificates in the trusted root ...
1
vote
1answer
726 views

cURL looking for CA in the wrong place

On Redhat Linux, in a PHP script I am setting cURL options as such: curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, True); curl_setopt($ch, CURLOPT_CAINFO, '/home/andrew/share/cacert.pem'); Yet I am ...
1
vote
1answer
68 views

Do I need to resign/regen a cert when moving IPs?

Are these errors related to moving a site to a new IP and keeping the same SSL CERT? Will I need to regen/sign to fix this? [Sun Jun 22 07:13:11.054280 2014] [mpm_worker:notice] [pid 2775:tid ...
1
vote
1answer
21 views

ADCS - How can I diagnose the exact reason a certificate request was denied by a policy module?

I need to develop operational procedures to audit and understand why a specific request was rejected by an Active Directory Certificate Services (ADCS) Policy Module. I've attempted turning on all ...
0
votes
3answers
2k views

SSL troubles - Generate .key from .crt? (AlphaSSL)

This is greatly troubling me, I have generated a .csr and .key file to send to dynadot (which sends that to AlphaSSL) with this command: openssl req -out foo.com.csr -new -newkey rsa:2048 -nodes ...
1
vote
1answer
158 views

Root certificate authority works windows/linux but not mac osx - (malformed)

I have created a self-signed root certificate authority which if I install onto windows, linux, or even using the certificate store in firefox (windows/linux/macosx) will work perfectly with my ...
2
votes
4answers
2k views

Nginx and client certificates from hierarchical OpenSSL-based certification authorities

I'm trying to set up root certification authority, subordinate certification authority and to generate the client certificates signed by any of this CA that nginx 0.7.67 on Debian Squeeze will accept. ...
0
votes
2answers
109 views

How to decide where to purchase a wildcard SSL certificate?

Recently I needed to purchase a wildcard SSL certificate (because I need to secure a number of subdomains), and when I first searched for where to buy one I was overwhelmed with the number of choices, ...
0
votes
0answers
123 views

The OCSP server has no status for the certificate. (Error code: sec_error_ocsp_unknown_cert)

Just set up a website (Apache/Centos) with SSL where the free cert came from startssl. I've used startssl before, and never had any problems. I have no problems accessing the site from IE and ...
1
vote
0answers
37 views

Exchange on WP7 - 80072F0D

Last week, the self-signed certificate on our Exchange 2010 mailserver expired, so we made a new one. Everything works fine after this, except mail on Windows Phone 7. All phones are giving an error ...
3
votes
1answer
818 views

AD CS: Certificate Template not available

In short, a Certificate Template I want to use is not available for enrollment. The template in question is a copy of the "RAS and IAS Server" template. What's frustrating is that I've gotten this ...
0
votes
0answers
42 views

SSL warning appears only to some devices

I have godaddy ssl certificate for domain.There wasn't any problems with my SSL certificate and visiting my domain(Haven't receiveed any errors), but couple times(two weeks ago) when I visited site ...
-1
votes
1answer
84 views

intermediate certificate not sent by WAMP

I have a strange problem that noone can help me with. I will really appreciate any help figuring this out. I have a wamp installation running apache 2.4.4 and latest openssl (which i downloaded and ...
6
votes
1answer
84 views

Does Apache needs to know about intermediate certificates for client authentication?

I have a following hierarchy of certificates. And I need to do a client authentication on Apache. . └── root (CA) - self signed ├── intermediate 1 (CA) | ├── client1 | ├── client2 ...
0
votes
1answer
98 views

Unable to install Certificate Enrolment Policy Web Service

I'm running on Windows 2k8 Enterprise edition, and when adding the Active Directory Certificate Services, I don't see the option to add the Certificate Enrolment Policy Web service in the dialog box. ...
4
votes
2answers
76 views

Beginning a company's digital certificate infrastructure [closed]

What type of digital certificate product do I need to begin a digital security infrastructure within my company and for use by our customers (pre-trusted by chaining)? I believe I need some kind of ...
0
votes
0answers
29 views

no local computer physical store, only registry and smartcard

I'm currently encountering an issue whereby i cannot see the "local computer" physical store, under trusted root CA, when attempting to install a cert. Instead the only stores i see are "Registry" and ...
1
vote
2answers
259 views

How to change root CA certificate?

I am running an own CA for my network, just to have it installed into the browser, so that I can see if a server still has the certificate I created (vulgar: having the green lock). Of course I just ...
0
votes
0answers
179 views

Can't seem to get Apache SSL client certificate authentication working with an intermediate CA

I'm restructuring my personal CA system and trying to add an intermediate CA into the mix. I have a self-signed root CA whose certificate is imported into all appropriate browsers/OSes. I seem to be ...
0
votes
0answers
58 views

Update Root CA Certificate values (Country/location(locality)/etc)

Our Offline Root CA server was setup prior to my joining the company and has com as the country code which is invalid for several things that I'm needing to do...primarily to get clients to stop ...
0
votes
1answer
135 views

Could Certificate Authorities have been compromised by the Heartbleed bug? [closed]

OpenSSL is widely used and was affected by the Heartbleed bug for years. A lot of services were impacted and everybody is trying to recover from this bug by updating there system, generating new ...
0
votes
1answer
44 views

How should I structure my CA hierarchy?

My current setup involved a self signed root CA, which has then signed my SSL/TLS CA and my OpenVPN client CA. The SSL/TLS CA signs the certificates of my servers, and the OpenVPN client CA signs the ...
1
vote
1answer
60 views

Windows Server 2008 R2 CA not issuing more than 2 years

I have active directory environment in 2003 R2. I have installed 2008 R2 Enterprise Edition CA. Then I have created custom template from web server template and add expiry date as 15 years. my root ...
3
votes
1answer
158 views

If I get a certificate signed for ECDSA will older browsers be able to use RSA?

I'm looking into using ECDHE-ECDSA and there are a lot of great articles on why (https://hynek.me/articles/hardening-your-web-servers-ssl-ciphers/) and ...
3
votes
2answers
191 views

Why do I need to create symbolic links for certificates?

Other than noticing something like this: yourid@linuxtpf:~/certificates> ls -l lrwxrwxrwx 1 yourid users 9 2009-04-07 18:06 50a694ac.0 -> cert2.pem #<-- was missing lrwxrwxrwx 1 yourid ...
2
votes
3answers
402 views

Run `certutil -DCInfo` on a different target domain

It seems that running certutil.exe -DCInfo Verify will check the certificates for all domain controllers in the domain of the logged-in user account. In our AD forest, we have a handful of domains. I ...
1
vote
0answers
28 views

How to include all dns records and IP address of a server in automatic certificate enrollment of Microsoft AD CS?

In my company there are a lot of servers which users remotely login to them to do their duties. We have enabled computer certificate auto enrollment for them to assure secure connection. But because ...
0
votes
1answer
40 views

Time stamped digital signatures with AD-CS

We are planning to implement a time proof digital signature solution in our intranet. Currently we have a Enterprise AD CS up and running. We are planning to use these signatures only inside our ...
0
votes
1answer
274 views

SSL on AWS? Cert installed but still having issues

We bought an SSL certificate (From Comodo) and when I visit the page in Chrome I see the green padlock and it has the following information: Your connection to ...... is encrypted with 128-bit ...
1
vote
2answers
112 views

Does a domain computer trust certs from domain CA

I have investigated this but have been unable to find a definitive answer to my question. I have never used certificate services in active directory before so am unsure of its possible ...
1
vote
2answers
24 views

How to determine if the user requested a certificate using “Mark keys as exportable”?

We have a Windows 2008 R2 running a standalone CA (certificate authority) and the web enrollment, so the users access http://[server-name]/certsrv websote for request certificates. The Advanced ...
5
votes
1answer
132 views

How do I configure AD CS to support Name Constraints (4.2.1.11 in RFC 2459)?

I am trying to figure out how to do Qualified Subordination with the critical extension set, but I'm unable to figure out how to do this in MSFT AD CS. For a given certificate, how do I make sure ...
0
votes
0answers
33 views

Windows Server 2008 Certificate Authority setup

Help!!! Our Root CA expired on 2/28/2014 and the original server has been reloaded with an OS. I am in dire need as many of our external sites are now not working - no surprise! I have not ...
1
vote
0answers
29 views

EFS file access problems

in my organization, i have a deadline to deploy EFS using AD CS, and i am working with a single windows server 2003 box, which is the Root CA, and is the same server responsible to certificate ...
0
votes
1answer
51 views

Win2008 SRV Certutil csv option not present

I have an Enterprise Certificate Authority running well. I am attempting to automate some monitoring tasks using batch files and the certutil.exe command. After reading the documentation at: ...
9
votes
3answers
351 views

Why issue a SSL certificate that expires in 2037?

In Firefox, if I view the Verisign Universal Root Certificate Authority, I notice that it expires in 2037. (Settings tab -> advanced -> view certificates -> VeriSign Universal Root Certification ...