In cryptography, a certificate authority, or certification authority, (CA) is an entity that issues digital certificates.

learn more… | top users | synonyms (1)

2
votes
2answers
8 views

How do I request a certificate from CEP / CES on a Microsoft CA on OSX or Linux?

This article describes how to request a certificate from AD CS (Active Directory Certificate Services) from a non-domain joined windows computer. I would think the same principals apply to non ...
1
vote
1answer
18 views

apache ssl - unable to get local issuer certificate

Somehow just today suddenly my seafile client throwed this error. I don't believe its a seafile issue, because my openssl throws the exact same error: user@nb-user:~$ echo |openssl s_client -connect ...
0
votes
0answers
67 views

setup SSL with CA for multiple local sites in Apache and authenticate in a specific location (Error code: ssl_error_handshake_failure_alert) Ubuntu

i'm trying to implement SSL (HTTPs) on my local web-server to protect specified directories on Apache's websites where a user log's-in, combining SSL and HTTP Authentication Basic. I have follow ...
30
votes
4answers
17k views

Certification authority root certificate expiry and renewal

In 2004, I set up a small certification authority using OpenSSL on Linux and the simple management scripts provided with OpenVPN. In accordance with the guides I found at the time, I set the validity ...
0
votes
3answers
12 views

How to create a digital signature and verify it through a server

I am trying to find out a way to create a digital signature for the employees of my company and place it in a server from where they can retrieve them and attach it with any digital document (Office ...
0
votes
0answers
12 views

After renewing web CA, Outlook 2013 can connect to Exchange 2013 but not Outlook 2010

After renewing web CA, 2013 outlook client are able to connect to 2013 Exchange but not 2010 outlook clients? Anyone run in to this issue please advise!
0
votes
2answers
860 views

Generating SAN SSL Certificate that works for firefox and chrome

I am trying to generate a SSL certificate that after being signed by my own CA will work for multiple domains. My openssl configuration file looks like this: [ req ] default_bits = 2048 ...
2
votes
2answers
1k views

OS X Not Trusting Thawte Primary Root CA - G3

We recently renewed our Nginx webserver's Thawte SSL certificate. Previously we'd been using SHA1 as the signing algorithm, but this time used SHA256 which leads to a new root certificate known as ...
0
votes
2answers
839 views

CA XCOM Data Transport - XCOMU0474E xcomd is already running. Multiple instances not supported

Does anybody know the problem described below? It's a Red Hat Enterprise Linux running Computer Associates XCOM Data Transport. #/usr/sbin/xcomd 2009/05/18 08:46:48 PRG=xcomd PID=7618 ...
2
votes
1answer
61 views

Setup a non-CA Puppet Master

I would like to set up an additional puppet master to act as a non-CA server. I’ve have installed and am successfully using Passenger. The servers in question are all running CentOS 6.6 and are all ...
0
votes
1answer
22 views

Using rsyslog with TLS without generating a self signed cert

Just about every guide I have seen for using TLS with rsyslog involves generating a self signed cert and using that. If the boxes are already set up with a legit signed cert how do you set up the ...
2
votes
1answer
64 views

Removing Certificate Authority

I'm trying to rename an old server ( 2008 R2 Standard) of ours that will be used for a SQL DEV(Used to be old prod), but the options to change computer name/domain is greyed out. I found that it's ...
1
vote
1answer
39 views

Exchange 2010 to Exchange Online cutover migration error

I am in the middle of an Exchange 2010 to Office 365 cutover migration and i keep getting errors when trying to create a migration endpoint on Office 365 hence the migration can't progress. I have ...
1
vote
1answer
2k views

Renewing Service Certificates for NDES on Windows Server 2008 R2

We currently use the NDES Service on Windows 2008 R2 Enterprise where the same box is also the standalone Certificate Authority. During initial setup, NDES created 2 service certificates for SCEP ...
1
vote
1answer
29 views

How to maintain revokation list for client certificates

I have a website running in Windows Server 2012, IIS. User's are authenticated using client certificates. I used to issue client certificates using Certificate Authority MMC snap-in. Since the ...
2
votes
3answers
5k views

apache Client Certificate Authentication errors: Certificate Verification: Error (18): self signed certificate

So I have been following instructions on setting up Client Certificate Authentication in Apache2 w/ mod_ssl. This is solely for the purpose of testing an application against CAA, not for any sort of ...
-1
votes
1answer
57 views

What type of SSL certificate I need to create CA? [duplicate]

I've a task to create Certificate Authority for company use. Preferably using "valid" ( not self-signed) certificate. The goal is to issue individual certificates for subdomains, instead of wildcard, ...
4
votes
2answers
176 views

Should I need to provide a root certificate when setting SSL cert on nginx

In Qualys SSL test always warn me that the root certificate is an extra download and can be safely removed. However, from Comodo website, their guide on installing cert on nginx is NGINX Needed for ...
2
votes
1answer
42 views

W2012 R2 AD certificate Services sha algorithm

So shortly after configuring an offline root CA and online AD subordiante CA with SHA512 for future proofing. We discovered a thin client vender (teradici zero client with View 6) only supports SHA1 ...
0
votes
0answers
37 views

haproxy client certificate authentication signed by 'common' CA

I am setting up haproxy as an SSL terminator/load balancer in front of an API that we need to expose over the internet to a customer. The plan was to use mutual (2-way) SSL/HTTPS to verify that both ...
1
vote
1answer
2k views

Windows 2003 Domain - Certificate Authority - New Automatic Certificate Request

I have an issue with a certificate authority in a windows 2003 domain. We need one configured to allow ssl/tls encrypted traffic over LDAP so that our Application Gateway server is able to allow users ...
0
votes
1answer
67 views

Windows server 2008 R2 Certificate Authority error event viewer

I am getting the error "The windows default policy module initialize method returned an error. The specified domain either doesn't exists or could not be contacted the error code is 0x8007054b. The ...
13
votes
5answers
17k views

How to update cURL CA bundle on RedHat?

I am running into issues where the CA bundle that has been bundled with my version of cURL is outdated. curl: (60) SSL certificate problem, verify that the CA cert is OK. Details: error:14090086:SSL ...
-1
votes
2answers
185 views

Update CA Bundle on Redhat 6

I have a few Redhat 6 servers that are unable to verify the certificate of an HTTPS site. I have checked, and they don't appear to have a very current CA bundle. The file ...
1
vote
1answer
144 views

override specific DN fields when signing csr

When signing CSR on CA side, how can I override specific DN fields by custom value? I want to ignore what is written in CSR. For example in C= and O= fields and replace them by something static. Other ...
0
votes
1answer
63 views

Automatic S/MIME certificate distribution/outlook integration for signed/encrypted email

I have a Windows Server 2008 R2 Machine and an Exchange 2010 Server on two seperate machines. The WS2008R2 machine is configured with a certificate authority in which I have configured certificate ...
0
votes
2answers
2k views

Certification Authority Service starts and stops SBS 2008

We moved from a SBS 2003 Server to a SBS 2008 server relatively recently because the SBS 2003 was having major hardware issues. I followed the Migration guide to the letter and everything seemed to ...
5
votes
2answers
76 views

Does the “Enterprise PKI” MMC allow for any automated testing of the PKI?

I'm using the Enterprise PKI snap in to diagnose and check the health of a MSFT PKI system. Is there any way to script/automate this tool to alert me to the pending expiration of a CRL or missing ...
7
votes
2answers
214 views

Enable Certificate Enrollment Policy and Request a Cert using PowerShell

Right now, I'm doing the following to request a cert from a CEP server: Open gpedit.msc Under Computer Configuration > Windows Settings > Security Settings > Public Key Policies, double click ...
3
votes
1answer
83 views

Where does a Windows Certification Authority store its root private key?

I have a Windows Server 2012 R2 Enterprise Root Certification Authority on a Hyper-V virtual machine which, due to currently unkown reasons, doesn't boot anymore. I don't know if the VM will ever ...
0
votes
3answers
1k views

generating client.ovpn file on android

I am developing a open source application wrapper over OpenVPN library for Android. For that I need to generate openvpn conf file. I have followed OpenVPN how but did not understand how to generate ...
1
vote
1answer
95 views

Squid: how to enable verification for SSL self-signed certificates

I'm using Squid 3.4.8 as a reverse proxy which is forwarding request to a specific server. The communication between Squid and the server is in HTTPS. The certificate used by the server is ...
3
votes
1answer
80 views

Wildcard cert for local SSL Certificate Authority?

This seems like it should work, but PKI is complicated and I'd like to ask people who can give an authoritative answer. BACKGROUND: I am the network engineer for a company; for sake of argument ...
2
votes
3answers
496 views

Run `certutil -DCInfo` on a different target domain

It seems that running certutil.exe -DCInfo Verify will check the certificates for all domain controllers in the domain of the logged-in user account. In our AD forest, we have a handful of domains. I ...
4
votes
1answer
146 views

Allow users to install certificates in their home directory?

Usually SSL certificates are installed system-wide (e.g. in /etc/ssl/certs). Is it possible to configure OpenSSL in a way that allows user to put certificates in their home directory (for example in ...
2
votes
1answer
68 views

Dovecot SSL Certificate is not accepted

I have certificates issued from StartSSL, which is a trusted authority for certificates, and my websites work with its certificates with no problems and no complaints from all browsers about any trust ...
0
votes
1answer
26 views

Trust Internal CA on WES7

We have set up an RDS farm with a certificate issued by our internal Enterprise CA. I'm trying to connect some Wyse thin clients to it running WES7, however it reports a certificate error as the thin ...
4
votes
1answer
3k views

CA and Primary Domain Controller on the same server

I am setting up a Microsoft AD to be my CA. After research, it looks like I need to have a domain controller before I can issue certs thru the CA. Would it be possible to place both the CA and the DC ...
4
votes
1answer
70 views

What is the purpose of a custom Certificate Trust List?

You can create and deploy a certificate trust list as detailed here, but I'm trying to understand the advantages of this over just deploying root and intermediate certs with group policy the normal ...
1
vote
0answers
15 views

Can OpenDirectory on OS X reasonably be configured to use an intermediate CA cert from an existing CA?

We're trying to set up OpenDirectory. It seems to want to create its own CA, and then an intermediate CA with a certificate signed by its own CA. I'd prefer to generate an intermediate CA certificate ...
1
vote
2answers
984 views

Thunderbird not trusting certificate signed with self-signed authority

I have generated a self-signed certificate authority using mydomain.org as the common name. I imported the public certificate using Thunderbird's certificate manager under the "Authorities" tab. So ...
1
vote
0answers
46 views

How to setup digital signatures on Microsoft CA (AD-CS)?

I've been trying to research across the web on how to setup a Microsoft CA (AD-CS on Windows Server 2008 R2) in order to create a certificate for digital signatures, allowing you to digitally sign ...
0
votes
1answer
118 views

Auto-enrollment certificate without enroll permission

I am Domain Admin of a company. We implement Active Directory Certificate Services in our company for email signature and encryption. Because we have more than 1000 users in our company, we want to ...
2
votes
3answers
1k views

Does any Certificate Authority support both SAN and wildcards?

My basic quandry is that wildcard certificates don't support subdomains of subdomains, nor do they help with alternate domain names. Basically, if my CN is example.com, I want a Subject Alternative ...
8
votes
2answers
201 views

Powershell Remotely Delete PKI Certificates

I recently rebuilt my PKI and I would like to delete the certificates that were issued to all client machines across my network. Sounds like a job for Powershell! So I wrote this script to be ...
1
vote
0answers
269 views

How to replace Zentyal CA certificates and key with an already existing CA

The context: we're using a CA which is deployed on all our client machines, and a lot of hosts and web servers. It seems that Zentyal CA module only allows to issue a new CA using the GUI, but not to ...
0
votes
0answers
166 views

How can I resolve element not found in AD CA?

I had to move our AD CA from server 2008 32bit to server 2008r2 64bit, both domain controllers too! I now know this was BAD. Is there any way to resolve the "Element not found" in AD CA? Or do I ...
1
vote
2answers
211 views

'Turn off Automatic Root Certificates Update' and 3rd party root certificates

The group policy setting 'Turn off Automatic Root Certificates Update' prevents Windows from deleting certificates that it cannot verify. If a third party has provided me with their own self-signed ...
1
vote
1answer
174 views

New root CA will not list schema version 2 & 3 certificate templates

I'm trying to decommission a Server 2008 machine that hosts DC, NPS, and CA. I've deployed two new servers to take over as root CA and RADIUS server (both new servers are 2012R2). The new root CA is ...
1
vote
1answer
506 views

Trusted root certificate being automatically removed from store

I have a trusted third party's root certificate. I install this to the 'Trusted Root Certification Authorities' certificate store in Windows Server 2008, but it disappears from the certificate store ...