In cryptography, a certificate authority, or certification authority, (CA) is an entity that issues digital certificates.

learn more… | top users | synonyms (1)

0
votes
0answers
13 views

Windows CA - Pending Request created during reboot

Each time a machine reboots in our environment (Windows Server 2012R2), certificate request is created under "Pending Requests" on the Certificate Authority server. It is the same Certificate ...
2
votes
1answer
32 views

MySQL SSL Connection

I'm trying set ssl connection with MySQL Server. I've read this and many more articles https://dev.mysql.com/doc/refman/5.7/en/using-secure-connections.html There is one thing i still don't know, ...
-1
votes
0answers
17 views

Create a certificate request failed in domino server

I had a problem when I was setting up a Domino CA so that we can use IBM verse by SSL. I referred to the IBM redbook about domino certification authority and SSL Certificate and followed it step by ...
3
votes
3answers
129 views

Using an SSL certificate in multiple locations

I have a website hosted in the UK and I also have an organisation in South Africa hosting my company application online for web access. I want to implement SSL for both servers, as it requires login ...
-1
votes
0answers
11 views

Why to make a domain Certificate we need to make active directory certificate in domain controller?

Guys I am Working On SharePoint 2013 and in central administration all my subscription is up and running.Now as per the msdn document I am following it says to create the Domain Name Certificate.So I ...
0
votes
0answers
23 views

Invalid CRL distribution points in certs after CA migration

I have recently migrated an Enterprise CA from a Windows Server 2003 box to a Windows Server 2012 R2 box using the Active Directory Certificate Services Migration Guide. The CA was running entirely ...
2
votes
2answers
3k views

How to make Firefox trust system CA certificates?

Our network admin recently enabled HTTPS inspection on our firewall/router. For IE users this is fine because the certs have all been distributed via Active Directory for domain-joined machines. ...
1
vote
1answer
74 views

E-mail address for Certificate Signing Request

Should an e-mail address in a Certificate Signing Request (CSR) for a server with a domain name aaa.bbb.ccc.ddd contain exactly all domain zones or it can be MyName@ccc.ddd (in other words, just an ...
0
votes
1answer
27 views

PKI SHA1 Upgrade - Thumbprint Algorithm Explanation

PKI SHA1 Upgrade - What is the difference between the Signature Algorithm and the Thumbprint Algorithm?
1
vote
1answer
1k views

Root Certificate Update Solution - Windows Server 2008

We have an application attempting to run licensing checks via http over the web. The machines this software resides on are Server 2008 vm's with no domain configured. While tracking what is ...
21
votes
5answers
46k views

How to update cURL CA bundle on RedHat?

I am running into issues where the CA bundle that has been bundled with my version of cURL is outdated. curl: (60) SSL certificate problem, verify that the CA cert is OK. Details: error:14090086:SSL ...
50
votes
5answers
15k views

How to decide where to purchase a wildcard SSL certificate?

Recently I needed to purchase a wildcard SSL certificate (because I need to secure a number of subdomains), and when I first searched for where to buy one I was overwhelmed with the number of choices, ...
1
vote
1answer
37 views

OpenSSL - Add Subject Alternate Name (SAN) when signing with CA

How can I add a Subject Alternate Name when signing a certificate request using OpenSSL (in Windows if that matters)? I've generated a basic certificate signing request (CSR) from the IIS interface. ...
0
votes
1answer
72 views

how do I covert a certificate with extension .cer to .asc

I have a certificate file (with extension .cer) that has content which looks something like this. -----BEGIN CERTIFICATE----- lots of data here -----END CERTIFICATE----- It is our signing ...
1
vote
1answer
50 views

Can OpenDirectory on OS X reasonably be configured to use an intermediate CA cert from an existing CA?

We're trying to set up OpenDirectory. It seems to want to create its own CA, and then an intermediate CA with a certificate signed by its own CA. I'd prefer to generate an intermediate CA certificate ...
1
vote
0answers
36 views

network device enrollment service greyed out

I've recently installed AD Certification Authority on one of our DCs. It acts as a subordinate enterprise CA, the Root CA is a standalone offline root CA and there is no connection between those two ...
2
votes
1answer
23 views

Finding Certificate Template in Certificate Authority

I'm following this tutorial: https://technet.microsoft.com/en-us/library/dn781428(v=ws.11).aspx I am on this step: Click to select the Certificate Templates container (under the CA name, not the ...
30
votes
1answer
2k views

Trusting an untrustworthy CA - Can I restrict how system trusts it?

(Posted to ServerFault instead of StackOverflow because I feel it concerns OS configuration more than programming code). I'm currently responsible for maintaining a system which connects to a third-...
11
votes
2answers
2k views

Cost of getting in-house certificate authority trusted

My company has an in-house certificate authority that is currently self-signed. Since we want to start using it for external SSL and secure email to our customers, we need to get it trusted. Does ...
0
votes
1answer
22 views

Can SHA-1 certs exist in a SHA-2 Microsoft Certificate Authority during migration?

I'm starting the process of migrating our internal Microsoft certificate authority to support SHA-2 and haven't been able to find out an answer on the ramifications of this process. I have found the ...
0
votes
2answers
52 views

Common way to adminstrating ca-certificates on linux?

I have to administrate a bunch of linux machines (server and clients) with different distributions. We want to use docker in the future, so it may be, that there would be more different distris in the ...
1
vote
2answers
66 views

Do web Servers send the certificate chain to the Web Client?

If my web server (latest Apache) has a valid (not expired or revoked) Verisign certificate chain (root -> intermediate -> leaf/my server), then does the server send the entire(?) chain to the client? ...
0
votes
2answers
15 views

automatic redirect in HTTPS for users which recognised CaCert authority

I use CaCert certificates for my domains. I want to redirect my users to HTTPS only if they recognised the CaCert authority. What is the best way to do this ?
2
votes
3answers
4k views

No Certificate Templates in Certification Authority

I have installed AD Certificate Services on a Windows Server 2012 R2 Standard edition. But when I open Certification Authority snap-in, there is no Certificate Templates folder: Why? Have I missed ...
1
vote
1answer
137 views

OpenSSL on Debian 8 can't authenticate certificates from Akamai (GTE/Baltimore CyberTrust Global Root)

On Debian 8.4 (with ca-certificates package) openssl doesn't seem to know about CAs required to verify connections to Akamai signed by "GTE CyberTrust" and "Baltimore CyberTrust". The GTE CyberTrust ...
2
votes
1answer
143 views

How to include all dns records and IP address of a server in automatic certificate enrollment of Microsoft AD CS?

In my company there are a lot of servers which users remotely login to them to do their duties. We have enabled computer certificate auto enrollment for them to assure secure connection. But because ...
1
vote
3answers
72 views

Can I purchase 2 wildcard certificates with the same subject from 2 different CA vendors?

Say I have an existing wildcard cert (*.example.com) from Vendor A (eg Symantec) licensed for 2 servers. And now I want to purchase the same subject (*.example.com) from Vendor B (eg. RapidSSL) for ...
1
vote
1answer
58 views

Unable to start Active Directory Certificate Services afer migrating from 2003 to 2012 R2

I was in the process migrating our CA from a 2003 server to a 2012 R2 using this guide After a server restart the CA service will no longer start. I receive error 21: The device is not ready. Is it ...
1
vote
1answer
67 views

PKI EJBCA : extract CA from EJBCA instance and just keep sub-CA

I'm looking for a solution to extract the CA from EJBCA instance, put it on an external drive, which is secured in a safe-deposit for instance. So I only keep the sub-ca for signing the end user ...
0
votes
2answers
38 views

Does Root CA need to be online?

I am trying to setup an IPv6-only Exchange Server 2013, running on Server 2012 R2 Datacenter. This is a 1-machine-setup in a VirtualBox for testing purposes. Everything is running ok so far. I.e. I ...
1
vote
0answers
27 views

OpenSource PKI Solution : user feedback and advices [closed]

I work on securing data exchange over the Internet. We plan to use a VPN together with certificates to authenticates users. To do so I've identified various PKI solutions. EJBCA : Installed and ...
0
votes
0answers
17 views

Windows: Verifying intermediate CA on dark network with keystore (.kdb)

Background: We have Windows Server 2012's (Server A and B) whose Internet Explorer (IE) connects to RHEL's Apache server (IBM HTTP Server). PKI: Apache serves a certificate whose intermediate CA was ...
2
votes
1answer
56 views

HTTPS not working with two intermediate certificates

Iʼm trying to create my own certificate authority using the XCA software. I have successfully created the root CA (Fisir Technologies CA) and intermediate CA (Fisir Technologies Intermediate CA X1). ...
0
votes
2answers
1k views

CA XCOM Data Transport - XCOMU0474E xcomd is already running. Multiple instances not supported

Does anybody know the problem described below? It's a Red Hat Enterprise Linux running Computer Associates XCOM Data Transport. #/usr/sbin/xcomd 2009/05/18 08:46:48 PRG=xcomd PID=7618 ...
1
vote
1answer
169 views

client SSL certificate verify error: (27:certificate not trusted)

I'm having some difficulty with nginx's client authentication while using an intermediate CA (self-created). Although the same certificate bundle (intermediate + root certificates in a single .pem ...
1
vote
0answers
59 views

How to configure Apache direct trust for CA signed certificates

I'm working on a corporate network which unfortunately is flat and has led to an interesting security requirement which I'm sure is possible (I just can't figure out how) The corperation has its own ...
1
vote
0answers
13 views

Is it possible to use subjectAltName with one word domains? [duplicate]

I'm running my own CA. My new cert's desired CSR has CN papaya. I'm looking to add some local domain structure with subjectAltName, but browsers are rejecting the added domains. This is my openssl....
0
votes
0answers
77 views

Certification Authority Error ID 44 Error Code 0x80040112

I had a windows server SP2 with the CA role activated, so the domain users could ask for a personal certificate. Suddenly, the Certification authority role has stoped, and when I try to bring it up it ...
0
votes
0answers
21 views

OpenSSL certificate shows “Issued to: Administrator” as Common Name

I'm trying to issue a certificate which was generated by openssl. $ openssl req -out vpn_certrequest.csr -key vpn_key.key -new -sha256 You are about to be asked to enter information that will be ...
1
vote
1answer
657 views

List all available templates from CA certutil or certreq

I need to request a certificate via command line I have investigated that certreq is the tool that can request the certificate. I am used to the gui to request the certificate by selecting one of the ...
3
votes
2answers
2k views

How can I get an OID for a certificate template?

I'm using C# (or VBScript) to issue a certificate from an Enterprise CA. According to this answer, I need to specify the OID instead of the certificate name, and place it in an unexpected portion of ...
0
votes
2answers
36 views

Create exchange certificate from linux CA

I am setting up exchange 2013 in a lab, where we are trying to replace Windows hosts with Linux hosts. We have exchange up and running, but connections complain that we need a valid certificate. I'...
1
vote
2answers
50 views

TinyCA generated cert refused by Exchange 2013

I've created a CA using TinyCA2, and have created a certificate for my Exchange 2013 server. Although the certificate installed fine on exchange, Exchange always says "Revocation Check Failed". (I'...
0
votes
3answers
114 views

How to trust a self signed certificate with different issuer?

I have a certificate and private key files which are created by my colleague. There are placed in Apache /etc/apache/ssl directory and all the configurations set properly. I opened the site with ...
1
vote
2answers
50 views

Client-side certificate signing

One of my partners wanted to do client side SSL certificate authentication. They wanted us to sign the certificate using a recognized CA. I was under the impression that for client side SSL ...
0
votes
0answers
40 views

How to disable Microsoft CA version extension in a Standalone Root CA?

I was looking for a way to exclude CA version from the ca extensions, but found nothing. We use Windows Server 2012 and it is needed for a Standalone root ca. Is there any way?
14
votes
3answers
4k views

Windows 2008 R2 CA and auto-enrollment: how to get rid of >100,000 issued certificates?

The basic problem I'm having is that I have >100,000 useless machine certificates cluttering up my CA, and I'd like to delete them, without deleting all certs, or time jumping the server ahead, and ...
3
votes
2answers
4k views

Renewing Service Certificates for NDES on Windows Server 2008 R2

We currently use the NDES Service on Windows 2008 R2 Enterprise where the same box is also the standalone Certificate Authority. During initial setup, NDES created 2 service certificates for SCEP ...
0
votes
1answer
116 views

Microsoft Active Directory Certificate Services Response from certsrv

I am trying to use certificates and private keys on embedded systems that were generated from Microsoft Active Directory Certificate Services . NDES and SCEP are currently out of scope so it will need ...
0
votes
1answer
118 views

No Certificates Found on Chrome Android with Comodo Positive SSL and IIS

For software testing reason, I have registered a domain name, set its A record to point to 192.168.1.30 (local PC on my network). I have installed Comodo Positive SSL for this domain on IIS on Windows ...