In cryptography, a certificate authority, or certification authority, (CA) is an entity that issues digital certificates.

learn more… | top users | synonyms (1)

21
votes
5answers
1k views

How to secure your CA's private key?

I'm about to implement my own Certification Authority (CA) for interal use only. Now there is a problem, that the CA private should never ever be exploited. So right now the private key is encrypted. ...
19
votes
4answers
10k views

Certification authority root certificate expiry and renewal

In 2004, I set up a small certification authority using OpenSSL on Linux and the simple management scripts provided with OpenVPN. In accordance with the guides I found at the time, I set the validity ...
15
votes
2answers
2k views

Can MS Certificate Services be a Subordinate to CA created with OpenSSL

I want to setup a enterprise certification authority for my domain. So I can issue certificates for various purposes. I would like to follow the best practice of having an offline CA as the root, ...
13
votes
3answers
2k views

Windows 2008 R2 CA and auto-enrollment: how to get rid of >100,000 issued certificates?

The basic problem I'm having is that I have >100,000 useless machine certificates cluttering up my CA, and I'd like to delete them, without deleting all certs, or time jumping the server ahead, and ...
10
votes
1answer
218 views

Utilizing an alternate CA (Like Microsoft Certificate Services) with Puppet

I'm investigating whether I can somehow make the puppet ecosystem utilize our existing Microsoft Enterprise CA rather than being its own CA. Since puppet touts that all of the system is "standard ...
9
votes
6answers
565 views

Replacing sick NTP server source and re-synching (with internal time currently 2 minutes late)

One of the external NTP servers (the primary one--currently) we're using as source seems to not be responding to NTP calls. Unfortunately, on our core router (Cisco 6509), the NTP functionality ...
9
votes
3answers
347 views

Why issue a SSL certificate that expires in 2037?

In Firefox, if I view the Verisign Universal Root Certificate Authority, I notice that it expires in 2037. (Settings tab -> advanced -> view certificates -> VeriSign Universal Root Certification ...
9
votes
2answers
1k views

Cost of getting in-house certificate authority trusted

My company has an in-house certificate authority that is currently self-signed. Since we want to start using it for external SSL and secure email to our customers, we need to get it trusted. Does ...
8
votes
1answer
897 views

Deploy internal CA to linux clients

I have a large number of workstations that run RedHat Enterprise Linux 5 and 6. I'd like to deploy our new internal CA (Active Directory) to these machines. I can manually import the certificate ...
7
votes
1answer
288 views

What happens to encrypted mails when CA certificate expires in my Windows Domain

does anybody know what will happen to encrypted /signed mails when a root authority certificate expires in my domain network? Can the certificate still be validated from the clients and will the ...
6
votes
3answers
9k views

How to update cURL CA bundle on RedHat?

I am running into issues where the CA bundle that has been bundled with my version of cURL is outdated. curl: (60) SSL certificate problem, verify that the CA cert is OK. Details: error:14090086:SSL ...
6
votes
3answers
12k views

Can I create my own S/MIME certificate for email encryption?

I'm having a bit of an issue here. Bear with me as this may be a case of "not asking the right question". Background: Using Apple Mail. Want to encrypt/decrypt email but GPGMail (and apparently ...
6
votes
1answer
1k views

Purpose behind subordinate Certificate Authorities

At my place of employment, we are setting up a PKI infrastructure using Microsoft products. We have a totally clean slate here and want to have a good start. We're wondering why anyone would set up ...
6
votes
8answers
23k views

svn won't accept my invalid certificate

I have a server running apache with a self-signed certificate (the server) with subversion hooked in It requires a username to checkout or update from the repo. I have a checkout from the repo that ...
6
votes
2answers
5k views

Adding new root/enterprise CA without disturbing existing one?

I am looking at installing a new AD-integrated enterprise certificate authority structure, but have discovered that somebody already has created a CA (mostly used for SSL on internal websites). I ...
6
votes
1answer
81 views

Does Apache needs to know about intermediate certificates for client authentication?

I have a following hierarchy of certificates. And I need to do a client authentication on Apache. . └── root (CA) - self signed ├── intermediate 1 (CA) | ├── client1 | ├── client2 ...
6
votes
1answer
28 views

Powershell Remotely Delete PKI Certificates

I recently rebuilt my PKI and I would like to delete the certificates that were issued to all client machines across my network. Sounds like a job for Powershell! So I wrote this script to be ...
5
votes
3answers
2k views

Pros and Cons of Creating an Internal Cerificate Authority

What are the pros and cons of spinning up an internal certificate authority (primarily Windows 2003 CA)? We have the need to encypt server-server traffic on a project that has 20+ certificates. We ...
5
votes
1answer
453 views

Microsoft CA certificate templates expires sooner than expected

The certificates my Microsoft CA is generating do not match the time period indicated in the template used. How can I resolve this? I recently created a new certificate template for use on my Linux ...
5
votes
1answer
234 views

Windows 2012R2 seems to automatically download and install intermediate root certificates

Whilst preparing a new Windows 2012R2 server for production I needed to install a (GlobalSign Domain) SSL certificate for the website powering our application. I did this by generating a certificate ...
5
votes
3answers
2k views

Outlook Encrypted Emails boo boo

I just reinstalled my Windows OS 7 and forgot to backup my Email Certificate for Outlook 2010 beforehand. Now I can't read any encrypted emails. When I try, it says "Cannot open this item. Your ...
5
votes
1answer
99 views

How does this 2048bit SSL requirement affect existing internal PKIs?

We have our own CA which we've used for years to create hundreds of server certs and thousands of client certs. The CA cert itself is 1024bit and the certs it signed are 1024bit Symantec has been ...
5
votes
1answer
427 views

IIS no longer trusts any CAs for client authentication

Yesterday the IIS on our build server (running Windows Server 2012) started refusing our clients' certificates. The certificates are signed using our own self-signed CA cert that has been added to ...
5
votes
1answer
184 views

How to get certificate common name from PEM file

Various articles online have lead me to believe that a server certificate's common name must be an exact match to the root URL it is valid for. However, when I look at a bunch of the files in ...
5
votes
2answers
4k views

Certificate Template Missing from “Certificate Template to Issue”

I'm having a problem similar to that posted in this question: Missing Certificate template From certificate to issue The short version is that I've created a duplicate certificate template and I'm ...
5
votes
1answer
123 views

How do I configure AD CS to support Name Constraints (4.2.1.11 in RFC 2459)?

I am trying to figure out how to do Qualified Subordination with the critical extension set, but I'm unable to figure out how to do this in MSFT AD CS. For a given certificate, how do I make sure ...
4
votes
1answer
926 views

CA and Primary Domain Controller on the same server

i am setting up a Microsoft AD to be my CA. After research it looks like i need to have a domain controller before i can issue certs thru the CA. Would it be possible to place both the CA and the DC ...
4
votes
1answer
360 views

How large is the certificate OCSP and CRL cache in my Windows server?

How can I see the size of the in-memory OCSP cache to a CRL cache in my Domain Controllers? In other words, most Windows process that uses CryptoAPIs have an in-memory cache of every CRL and OCSP ...
4
votes
2answers
74 views

Beginning a company's digital certificate infrastructure [closed]

What type of digital certificate product do I need to begin a digital security infrastructure within my company and for use by our customers (pre-trusted by chaining)? I believe I need some kind of ...
4
votes
3answers
2k views

Docs for OpenSSH CA-based certificate based authentication

OpenSSH 5.4 added a new method for certificate authentication (changes). * Add support for certificate authentication of users and hosts using a new, minimal OpenSSH certificate format (not ...
4
votes
1answer
3k views

Certificate Authority issuing Basic EFS certificates without Autoenroll

We have observed some puzzling behavior from the CAs we have set up in both the past and present. For some reason unknown to us, it seems that our CAs are randomly issuing "Basic EFS" certificates to ...
4
votes
2answers
791 views

Standalone or Enterprise CA - what do I have?

When you install a Windows forest CA you have the option to make it standalone or enterprise. I have an existing installation which I am assuming is standalone as it doesn't have a certificate ...
4
votes
2answers
246 views

Migrate an intermediate CA to a new root

Using the Microsoft CA is there any way to cut over to a new certificate authority from an intermediate authority? Both my systems are Microsoft CAs - I have a 2008 R2 Enterprise CA (intermediate) ...
4
votes
1answer
2k views

What causes automatic install of trusted root certificate authorities into local machine's certificate store?

I spend whole day by diagnosing issue with my test services using mutual HTTPS. Services are hosted in IIS 7 on a test server running Windows Server 2008 Enterprise edition. Suddenly few weeks ago ...
4
votes
1answer
590 views

Windows 2003 x32 CA to Windows 2008 x64 CA migration

In the following period I have to migrate the AD over to 2008 schema level. I currently have a x64 Windows 2008 R2 domain controller and one x32 Windows Server 2003 domain controller. The x32 server ...
4
votes
1answer
8k views

How to configure what certificates can be issued using Web Enrollment in Windows Server 2008 R2 Enterprise?

I have a CA installed on of my Windows Servers in a small farm of systems. I've installed the Certification Authority Web Enrollment and Certificate Enrollment Web Service roles on the CA. I want to ...
3
votes
2answers
186 views

Why do I need to create symbolic links for certificates?

Other than noticing something like this: yourid@linuxtpf:~/certificates> ls -l lrwxrwxrwx 1 yourid users 9 2009-04-07 18:06 50a694ac.0 -> cert2.pem #<-- was missing lrwxrwxrwx 1 yourid ...
3
votes
1answer
131 views

Is there a low cost certificate authority that is generally accepted for TLS over SMTP? [closed]

I'm getting ready to enable TLS on my Postfix servers. I am doing this as a result of being told that there are some sending servers that refuse to send messages if TLS is not available. Since I ...
3
votes
2answers
240 views

Windows PKI with offline root (maybe with OpenSSL) - Possible?

I'm trying to setup a two-tier PKI and I have a ton of questions. Since there's the tombstone limit for the AD, I'm assuming that the root (which will be offline) shouldn't be part of the AD. Am I ...
3
votes
1answer
29 views

Publish root CA and sub ca certificate to the Trusted root certificate store

I have a root CA which is standalone and I have subordinate CA which is domain joined. I recently renewed the certificate of my root CA and sub CA. How do I push these certificates in the trusted root ...
3
votes
2answers
2k views

Configuring client certificate authentication in apache

I am trying to set up part of a Virtualhost in apache to require client authentication. The VirtualHost in question also acts as a reverse proxy for the actual web server. Here's what I have done: ...
3
votes
1answer
21 views

How can I get an OID for a certificate template?

I'm using C# (or VBScript) to issue a certificate from an Enterprise CA. According to this answer, I need to specify the OID instead of the certificate name, and place it in an unexpected portion of ...
3
votes
1answer
140 views

If I get a certificate signed for ECDSA will older browsers be able to use RSA?

I'm looking into using ECDHE-ECDSA and there are a lot of great articles on why (https://hynek.me/articles/hardening-your-web-servers-ssl-ciphers/) and ...
3
votes
2answers
93 views

Using our own certificate authority for business email encryption

I've read the available similar questions on serverfault but I haven't quite found a definite answer to the security aspect of it - hence here's my question: I'm administrator of an office working ...
3
votes
1answer
305 views

Microsoft offline root CA CDP and AIA http URLs are hard coded - trouble ahead?

I'm new with ADCS, and there is a lot to understand. I set up a 2-tier PKI, and have placed the offline root CA certificate (CRT) and CRL files on a web server pointing to with a CNAME in DNS. When I ...
3
votes
1answer
272 views

Requiring client certificate issued by a specific intermediate CA in Apache

I have a CA hierarchy like this: Root-CA ________|_____________ | | TEST-CA PRODUCTION-CA _____|_____ ...
3
votes
1answer
831 views

Automatically create Subject Alternate Name (SAN) Certificates

We are running an enterprise CA on Windows 2008R2. I just did an update to windows 7 on my workstation. Now every time I connect to a remote server using rdp I get a warning stating that the ...
3
votes
2answers
3k views

Cannot issue Computer cert to standalone computer from my ECA

All Windows 2K8R2 SP1 environment. I have a working Enterprise Certificate Authority in my domain. I want to issue a Computer certificate (for Server Authentication purpose) to an external, ...
3
votes
1answer
773 views

AD CS: Certificate Template not available

In short, a Certificate Template I want to use is not available for enrollment. The template in question is a copy of the "RAS and IAS Server" template. What's frustrating is that I've gotten this ...
3
votes
1answer
163 views

Using an audio cable (or similar) to create unidirectional communication from a secure server

I'm interested in exploring how a semi-offline Root CA can be used to update CRLs to the sub CA's. This answer on Security.SE mentions using an audio cable for this purpose. Doe anyone have details ...