In cryptography, a certificate authority, or certification authority, (CA) is an entity that issues digital certificates.

learn more… | top users | synonyms (1)

2
votes
1answer
15 views

Dovecot SSL Certificate is not accepted

I have certificates issued from StartSSL, which is a trusted authority for certificates, and my websites work with its certificates with no problems and no complaints from all browsers about any trust ...
0
votes
1answer
15 views

Trust Internal CA on WES7

We have set up an RDS farm with a certificate issued by our internal Enterprise CA. I'm trying to connect some Wyse thin clients to it running WES7, however it reports a certificate error as the thin ...
4
votes
1answer
2k views

CA and Primary Domain Controller on the same server

I am setting up a Microsoft AD to be my CA. After research, it looks like I need to have a domain controller before I can issue certs thru the CA. Would it be possible to place both the CA and the DC ...
3
votes
1answer
26 views

What is the purpose of a custom Certificate Trust List?

You can create and deploy a certificate trust list as detailed here, but I'm trying to understand the advantages of this over just deploying root and intermediate certs with group policy the normal ...
1
vote
0answers
5 views

Can OpenDirectory on OS X reasonably be configured to use an intermediate CA cert from an existing CA?

We're trying to set up OpenDirectory. It seems to want to create its own CA, and then an intermediate CA with a certificate signed by its own CA. I'd prefer to generate an intermediate CA certificate ...
1
vote
2answers
714 views

Thunderbird not trusting certificate signed with self-signed authority

I have generated a self-signed certificate authority using mydomain.org as the common name. I imported the public certificate using Thunderbird's certificate manager under the "Authorities" tab. So ...
1
vote
0answers
12 views

How to setup digital signatures on Microsoft CA (AD-CS)?

I've been trying to research across the web on how to setup a Microsoft CA (AD-CS on Windows Server 2008 R2) in order to create a certificate for digital signatures, allowing you to digitally sign ...
0
votes
1answer
96 views

Auto-enrollment certificate without enroll permission

I am Domain Admin of a company. We implement Active Directory Certificate Services in our company for email signature and encryption. Because we have more than 1000 users in our company, we want to ...
2
votes
3answers
1k views

Does any Certificate Authority support both SAN and wildcards?

My basic quandry is that wildcard certificates don't support subdomains of subdomains, nor do they help with alternate domain names. Basically, if my CN is example.com, I want a Subject Alternative ...
8
votes
2answers
140 views

Powershell Remotely Delete PKI Certificates

I recently rebuilt my PKI and I would like to delete the certificates that were issued to all client machines across my network. Sounds like a job for Powershell! So I wrote this script to be ...
1
vote
0answers
62 views

How to replace Zentyal CA certificates and key with an already existing CA

The context: we're using a CA which is deployed on all our client machines, and a lot of hosts and web servers. It seems that Zentyal CA module only allows to issue a new CA using the GUI, but not to ...
1
vote
1answer
1k views

Renewing Service Certificates for NDES on Windows Server 2008 R2

We currently use the NDES Service on Windows 2008 R2 Enterprise where the same box is also the standalone Certificate Authority. During initial setup, NDES created 2 service certificates for SCEP ...
0
votes
0answers
37 views

How can I resolve element not found in AD CA?

I had to move our AD CA from server 2008 32bit to server 2008r2 64bit, both domain controllers too! I now know this was BAD. Is there any way to resolve the "Element not found" in AD CA? Or do I ...
1
vote
2answers
66 views

'Turn off Automatic Root Certificates Update' and 3rd party root certificates

The group policy setting 'Turn off Automatic Root Certificates Update' prevents Windows from deleting certificates that it cannot verify. If a third party has provided me with their own self-signed ...
1
vote
1answer
58 views

New root CA will not list schema version 2 & 3 certificate templates

I'm trying to decommission a Server 2008 machine that hosts DC, NPS, and CA. I've deployed two new servers to take over as root CA and RADIUS server (both new servers are 2012R2). The new root CA is ...
1
vote
1answer
94 views

Trusted root certificate being automatically removed from store

I have a trusted third party's root certificate. I install this to the 'Trusted Root Certification Authorities' certificate store in Windows Server 2008, but it disappears from the certificate store ...
1
vote
2answers
49 views

New SSL Cert causes no connection to website on POST from web application

I have a web application which will not connect to a website to POST after they changed their SSL cert. The URL and REF post is mentioned below. Is there anything else I should try on the server? ...
-1
votes
1answer
95 views

FreeRADIUS certificate is going to expired

Recently I've created a RADIUS server (Freeradius) that authenticate with Active Directory. I follow this link to create this server: Now, when I see the "server.cnf" file into /etc/raddb/cert , I ...
1
vote
1answer
1k views

Unrevoke a certificate which was revoked with a status different from Certificate Hold

Is there a way to unrevoke a revoked certificate, which was revoked with the “Superseded” reason code? I'm using the Certification Authority provided with Windows Server 2008 SP2.
0
votes
0answers
14 views

SQL Client failing SSL certificate encryption under a AD Domain

I have a client machine (web server) that is attempting to connect to a SQL server. The SQL server is 2008 and has the force encryption flag turned on. Both servers are joined to the domain. The ...
1
vote
0answers
51 views

Remote Desktop Certificate Template Application Policy Extension

We are setting up remote desktop authentication with the use of certificates and ran into an issue in one of the environments. I am editing the RemoteDesktopComputer2008 certificate template, in ...
1
vote
1answer
56 views

Why does Windows CA Server issue multiple certificates for the same user?

I am currently implementing an EAP/TLS WIFI implementation to replace our EAP/MSCHAP2 wifi implementation. I am using Windows Server 2008 and I've installed a certificate authority. User certificates ...
11
votes
4answers
14k views

How to update cURL CA bundle on RedHat?

I am running into issues where the CA bundle that has been bundled with my version of cURL is outdated. curl: (60) SSL certificate problem, verify that the CA cert is OK. Details: error:14090086:SSL ...
3
votes
2answers
191 views

“Countersigning” a CA with openssl

I'm pretty used to creating the PKI used for x509 authentication for whatever reason, SSL Client Verification being the main reason for doing it. I've just started to dabble with OpenVPN (Which I ...
1
vote
2answers
5k views

Error code: ssl_error_rx_record_too_long

I have nginx with the following setup: server { listen 80; server_name site.com www.site.com; root /home/site/public_html; listen 443; ...
1
vote
1answer
30 views

Add issuing CA to online root CA windows 2008 r2

we have an existing internal root CA standalone that issue certificate for our domain mycompany.com. We have multiple certificate installed all over the company from this CA. The problem we're facing ...
1
vote
1answer
406 views

Difference between ca-bundle.crt and ca-bundle.trust.crt

On CentOS 6.5, in /etc/pki/tls/certs I have: ca-bundle.crt and ca-bundle.trust.crt With different file sizes. Which should I use as the trust path for nginx proxy_ssl_trusted_certificate.
0
votes
1answer
59 views

Root certificate invalid on a WHM site [closed]

I am a newbie in SSL certificates and was given the task on troubleshooting a site's WHM page that uses https but it displays an red "x" on the https section of the URL. On Google Chrome, details of ...
1
vote
1answer
50 views

Unnecessary Certificate Authority in Domain

I have an organization with a file server that is a secondary domain controller(2003 R2), an Exchange server(2008 R2), and a primary domain controller(2008 R2). We also have what used to be the ...
1
vote
1answer
402 views

OS X Not Trusting Thawte Primary Root CA - G3

We recently renewed our Nginx webserver's Thawte SSL certificate. Previously we'd been using SHA1 as the signing algorithm, but this time used SHA256 which leads to a new root certificate known as ...
6
votes
3answers
785 views

How to decide where to purchase a wildcard SSL certificate?

Recently I needed to purchase a wildcard SSL certificate (because I need to secure a number of subdomains), and when I first searched for where to buy one I was overwhelmed with the number of choices, ...
5
votes
1answer
89 views

Windows PKI: How can I import, sign/issue and export a large number of CSRs?

I have a lot of CSRs that I need to have signed/issued and exported in windows. I was hoping I could batch process them somehow (certutil sounds like it can do some of the work) but I'm not quite sure ...
0
votes
0answers
10 views

Publishing extra AD CA CRLs for clients

I am attempting to configure Workplace Join in my Lab Environment. I have my AD CS infrastructure in place and have configured an additional CDP/CRL list with an accessible DNS name for non-domain ...
1
vote
0answers
157 views

Unable to convert JKS keystore to Oracle Wallet using orapki

I have generated jks keystore using keytool and using the jks keystore I have csr. The same csr I have sent to Signing authority. The Signing authority have given the trusted ...
1
vote
1answer
805 views

How do I manually publish a CRL for a certificate?

I have setup a new server and installed Remote Access and Certificate Authority services so I can configure it as a VPN. I have created my own certificate through http://localhost/certsvr, and have ...
0
votes
1answer
86 views

ADCS Create a new certificate or Rename?

Just joined a new company. Apparently back last year they got rid of the old CA and restored the certificate on a new server. (2003 to 2012). I was about to renew the certificate (self signed) on the ...
0
votes
1answer
82 views

How can I generate a non ec private key from openssl via Windows?

I'm experiencing different behavior with an openssl from a linux host and a windows host. I have a pfx that I generated via a windows ca. I use openssl to dissect that pfx to create 3 pem files (ca ...
1
vote
1answer
43 views

Adding OCSP and NDES into existing environment? What can be installed together?

Currently have one offline CA and one Sub Issuing CA that just has the Web Enrollment installed. Looking at also implementing NDES and OCSP. I know the web enrollment can be installed on the Issuing ...
2
votes
1answer
218 views

Windows CA and .pfx Files

What is the proper way to obtain a certificate, ca cert, and private key (aka .pfx file) from a Windows CA via command line? The way I've been doing it is I create a request file using notepad with ...
2
votes
1answer
141 views

Certificate revocation check fails for non-domain guest in spite of accessible CRL

When we try to use certificates on computers that are not part of the domain, Windows complains that The revocation function was unable to check revocation because the revocation server was ...
2
votes
2answers
86 views

Certificate distribution and management

I am planning to setup PKI for our organization as we're fed up with all of these security warnings when using self-signed certs. I want an offline root CA and two issuing CAs and I want to set that ...
0
votes
1answer
43 views

Solution for SSL client certificates with user self service

I'm administrating a linux-based small business network. User information is centrally stored in an OpenLDAP directory. There is an existing CA which is currently used to sign server certificates. It ...
6
votes
1answer
2k views

Purpose behind subordinate Certificate Authorities

At my place of employment, we are setting up a PKI infrastructure using Microsoft products. We have a totally clean slate here and want to have a good start. We're wondering why anyone would set up ...
1
vote
0answers
63 views

Windows - Replace subject from CSR when issuing certificate

I've received a CSR from a client with a CN, but not with all the subject fields we require. According to this answer from Scott*, it should be possible to specify the final subject values when the ...
0
votes
1answer
45 views

How to change/remove CRL on root cert?

A few years ago we installed certificate authority onto a widnows 2003 server (CAserver1). we created a self-signed root cert, and issued certs for internal services (https, WCF services, etc). Fast ...
1
vote
3answers
2k views

How can an OpenVPN server be setup to use multiple certificates?

The OpenVPN documentation sets up a single certificate from a single CA to be used for all clients. Is there a way to set the server to enable multiple certificates from different CAs so long as the ...
2
votes
1answer
481 views

Windows CA Certificate Request via Commandline

I have a non-domain PC (windows 7) attempting to obtain a cert from a Windows 2008 R2 Enterprise CA. I have the root ca and crl's installed on the non-domain client. I'm working on a script that will ...
0
votes
0answers
83 views

APNS server side Entrust certificate installation process

To ensure you can continue to validate your server's connection to the Apple Push Notification service, you will need to update your push notification server with a copy of the 2048-bit root ...
0
votes
2answers
2k views

Create and use intermediate certificate authority on Windows Server 2012?

Background: Server OS is Windows Server 2012. GUI is installed as we come upto speed with powershell. Setup is staging, not production (yet). We have our (internal, domain limited) Root CA installed. ...
3
votes
2answers
402 views

Email results of PowerShell Script

I have a powershell script that check the certificate store for expiring certificates. It will display these results within the CLI. I want to modify this script to email the results of the output in ...