In cryptography, a certificate authority, or certification authority, (CA) is an entity that issues digital certificates.

learn more… | top users | synonyms (1)

23
votes
4answers
14k views

Certification authority root certificate expiry and renewal

In 2004, I set up a small certification authority using OpenSSL on Linux and the simple management scripts provided with OpenVPN. In accordance with the guides I found at the time, I set the validity ...
22
votes
5answers
2k views

How to secure your CA's private key?

I'm about to implement my own Certification Authority (CA) for interal use only. Now there is a problem, that the CA private should never ever be exploited. So right now the private key is encrypted. ...
15
votes
2answers
2k views

Can MS Certificate Services be a Subordinate to CA created with OpenSSL

I want to setup a enterprise certification authority for my domain. So I can issue certificates for various purposes. I would like to follow the best practice of having an offline CA as the root, ...
13
votes
3answers
3k views

Windows 2008 R2 CA and auto-enrollment: how to get rid of >100,000 issued certificates?

The basic problem I'm having is that I have >100,000 useless machine certificates cluttering up my CA, and I'd like to delete them, without deleting all certs, or time jumping the server ahead, and ...
11
votes
4answers
14k views

How to update cURL CA bundle on RedHat?

I am running into issues where the CA bundle that has been bundled with my version of cURL is outdated. curl: (60) SSL certificate problem, verify that the CA cert is OK. Details: error:14090086:SSL ...
10
votes
6answers
671 views

Replacing sick NTP server source and re-synching (with internal time currently 2 minutes late)

One of the external NTP servers (the primary one--currently) we're using as source seems to not be responding to NTP calls. Unfortunately, on our core router (Cisco 6509), the NTP functionality ...
10
votes
3answers
477 views

Why issue a SSL certificate that expires in 2037?

In Firefox, if I view the Verisign Universal Root Certificate Authority, I notice that it expires in 2037. (Settings tab -> advanced -> view certificates -> VeriSign Universal Root Certification ...
10
votes
2answers
1k views

Cost of getting in-house certificate authority trusted

My company has an in-house certificate authority that is currently self-signed. Since we want to start using it for external SSL and secure email to our customers, we need to get it trusted. Does ...
10
votes
1answer
253 views

Utilizing an alternate CA (Like Microsoft Certificate Services) with Puppet

I'm investigating whether I can somehow make the puppet ecosystem utilize our existing Microsoft Enterprise CA rather than being its own CA. Since puppet touts that all of the system is "standard ...
8
votes
2answers
137 views

Powershell Remotely Delete PKI Certificates

I recently rebuilt my PKI and I would like to delete the certificates that were issued to all client machines across my network. Sounds like a job for Powershell! So I wrote this script to be ...
8
votes
1answer
1k views

Deploy internal CA to linux clients

I have a large number of workstations that run RedHat Enterprise Linux 5 and 6. I'd like to deploy our new internal CA (Active Directory) to these machines. I can manually import the certificate ...
7
votes
1answer
346 views

What happens to encrypted mails when CA certificate expires in my Windows Domain

does anybody know what will happen to encrypted /signed mails when a root authority certificate expires in my domain network? Can the certificate still be validated from the clients and will the ...
6
votes
3answers
13k views

Can I create my own S/MIME certificate for email encryption?

I'm having a bit of an issue here. Bear with me as this may be a case of "not asking the right question". Background: Using Apple Mail. Want to encrypt/decrypt email but GPGMail (and apparently ...
6
votes
3answers
765 views

How to decide where to purchase a wildcard SSL certificate?

Recently I needed to purchase a wildcard SSL certificate (because I need to secure a number of subdomains), and when I first searched for where to buy one I was overwhelmed with the number of choices, ...
6
votes
1answer
1k views

Purpose behind subordinate Certificate Authorities

At my place of employment, we are setting up a PKI infrastructure using Microsoft products. We have a totally clean slate here and want to have a good start. We're wondering why anyone would set up ...
6
votes
8answers
23k views

svn won't accept my invalid certificate

I have a server running apache with a self-signed certificate (the server) with subversion hooked in It requires a username to checkout or update from the repo. I have a checkout from the repo that ...
6
votes
2answers
6k views

Adding new root/enterprise CA without disturbing existing one?

I am looking at installing a new AD-integrated enterprise certificate authority structure, but have discovered that somebody already has created a CA (mostly used for SSL on internal websites). I ...
6
votes
3answers
2k views

Outlook Encrypted Emails boo boo

I just reinstalled my Windows OS 7 and forgot to backup my Email Certificate for Outlook 2010 beforehand. Now I can't read any encrypted emails. When I try, it says "Cannot open this item. Your ...
6
votes
1answer
134 views

Does Apache needs to know about intermediate certificates for client authentication?

I have a following hierarchy of certificates. And I need to do a client authentication on Apache. . └── root (CA) - self signed ├── intermediate 1 (CA) | ├── client1 | ├── client2 ...
5
votes
3answers
2k views

Pros and Cons of Creating an Internal Cerificate Authority

What are the pros and cons of spinning up an internal certificate authority (primarily Windows 2003 CA)? We have the need to encypt server-server traffic on a project that has 20+ certificates. We ...
5
votes
1answer
709 views

Microsoft CA certificate templates expires sooner than expected

The certificates my Microsoft CA is generating do not match the time period indicated in the template used. How can I resolve this? I recently created a new certificate template for use on my Linux ...
5
votes
1answer
410 views

Windows 2012R2 seems to automatically download and install intermediate root certificates

Whilst preparing a new Windows 2012R2 server for production I needed to install a (GlobalSign Domain) SSL certificate for the website powering our application. I did this by generating a certificate ...
5
votes
1answer
114 views

How does this 2048bit SSL requirement affect existing internal PKIs?

We have our own CA which we've used for years to create hundreds of server certs and thousands of client certs. The CA cert itself is 1024bit and the certs it signed are 1024bit Symantec has been ...
5
votes
1answer
645 views

IIS no longer trusts any CAs for client authentication

Yesterday the IIS on our build server (running Windows Server 2012) started refusing our clients' certificates. The certificates are signed using our own self-signed CA cert that has been added to ...
5
votes
1answer
353 views

How to get certificate common name from PEM file

Various articles online have lead me to believe that a server certificate's common name must be an exact match to the root URL it is valid for. However, when I look at a bunch of the files in ...
5
votes
2answers
5k views

Certificate Template Missing from “Certificate Template to Issue”

I'm having a problem similar to that posted in this question: Missing Certificate template From certificate to issue The short version is that I've created a duplicate certificate template and I'm ...
5
votes
1answer
283 views

How do I configure AD CS to support Name Constraints (4.2.1.11 in RFC 2459)?

I am trying to figure out how to do Qualified Subordination with the critical extension set, but I'm unable to figure out how to do this in MSFT AD CS. For a given certificate, how do I make sure ...
5
votes
1answer
89 views

Windows PKI: How can I import, sign/issue and export a large number of CSRs?

I have a lot of CSRs that I need to have signed/issued and exported in windows. I was hoping I could batch process them somehow (certutil sounds like it can do some of the work) but I'm not quite sure ...
4
votes
1answer
2k views

CA and Primary Domain Controller on the same server

i am setting up a Microsoft AD to be my CA. After research it looks like i need to have a domain controller before i can issue certs thru the CA. Would it be possible to place both the CA and the DC ...
4
votes
1answer
4k views

SSL certificate: unable to get local issuer certificate [closed]

I'm running Debian (Lenny). When I run this: curl --ssl https://www.google.com I get this error: curl: (60) SSL certificate problem: unable to get local issuer certificate More details here: ...
4
votes
1answer
434 views

How large is the certificate OCSP and CRL cache in my Windows server?

How can I see the size of the in-memory OCSP cache to a CRL cache in my Domain Controllers? In other words, most Windows process that uses CryptoAPIs have an in-memory cache of every CRL and OCSP ...
4
votes
2answers
85 views

Beginning a company's digital certificate infrastructure [closed]

What type of digital certificate product do I need to begin a digital security infrastructure within my company and for use by our customers (pre-trusted by chaining)? I believe I need some kind of ...
4
votes
3answers
2k views

Docs for OpenSSH CA-based certificate based authentication

OpenSSH 5.4 added a new method for certificate authentication (changes). * Add support for certificate authentication of users and hosts using a new, minimal OpenSSH certificate format (not ...
4
votes
1answer
3k views

Certificate Authority issuing Basic EFS certificates without Autoenroll

We have observed some puzzling behavior from the CAs we have set up in both the past and present. For some reason unknown to us, it seems that our CAs are randomly issuing "Basic EFS" certificates to ...
4
votes
2answers
915 views

Standalone or Enterprise CA - what do I have?

When you install a Windows forest CA you have the option to make it standalone or enterprise. I have an existing installation which I am assuming is standalone as it doesn't have a certificate ...
4
votes
2answers
321 views

Migrate an intermediate CA to a new root

Using the Microsoft CA is there any way to cut over to a new certificate authority from an intermediate authority? Both my systems are Microsoft CAs - I have a 2008 R2 Enterprise CA (intermediate) ...
4
votes
1answer
2k views

What causes automatic install of trusted root certificate authorities into local machine's certificate store?

I spend whole day by diagnosing issue with my test services using mutual HTTPS. Services are hosted in IIS 7 on a test server running Windows Server 2008 Enterprise edition. Suddenly few weeks ago ...
4
votes
1answer
752 views

Windows 2003 x32 CA to Windows 2008 x64 CA migration

In the following period I have to migrate the AD over to 2008 schema level. I currently have a x64 Windows 2008 R2 domain controller and one x32 Windows Server 2003 domain controller. The x32 server ...
4
votes
1answer
9k views

How to configure what certificates can be issued using Web Enrollment in Windows Server 2008 R2 Enterprise?

I have a CA installed on of my Windows Servers in a small farm of systems. I've installed the Certification Authority Web Enrollment and Certificate Enrollment Web Service roles on the CA. I want to ...
3
votes
2answers
231 views

Why do I need to create symbolic links for certificates?

Other than noticing something like this: yourid@linuxtpf:~/certificates> ls -l lrwxrwxrwx 1 yourid users 9 2009-04-07 18:06 50a694ac.0 -> cert2.pem #<-- was missing lrwxrwxrwx 1 yourid ...
3
votes
1answer
133 views

Is there a low cost certificate authority that is generally accepted for TLS over SMTP? [closed]

I'm getting ready to enable TLS on my Postfix servers. I am doing this as a result of being told that there are some sending servers that refuse to send messages if TLS is not available. Since I ...
3
votes
2answers
389 views

Email results of PowerShell Script

I have a powershell script that check the certificate store for expiring certificates. It will display these results within the CLI. I want to modify this script to email the results of the output in ...
3
votes
2answers
191 views

“Countersigning” a CA with openssl

I'm pretty used to creating the PKI used for x509 authentication for whatever reason, SSL Client Verification being the main reason for doing it. I've just started to dabble with OpenVPN (Which I ...
3
votes
1answer
4k views

Install a root certificate in CentOS 6

I know it has been already asked, but despite many hours of research I couldn't find a working solution. I am trying to install my root certificate in my server, so internal service can bind to each ...
3
votes
2answers
319 views

Windows PKI with offline root (maybe with OpenSSL) - Possible?

I'm trying to setup a two-tier PKI and I have a ton of questions. Since there's the tombstone limit for the AD, I'm assuming that the root (which will be offline) shouldn't be part of the AD. Am I ...
3
votes
2answers
3k views

Configuring client certificate authentication in apache

I am trying to set up part of a Virtualhost in apache to require client authentication. The VirtualHost in question also acts as a reverse proxy for the actual web server. Here's what I have done: ...
3
votes
1answer
79 views

Publish root CA and sub ca certificate to the Trusted root certificate store

I have a root CA which is standalone and I have subordinate CA which is domain joined. I recently renewed the certificate of my root CA and sub CA. How do I push these certificates in the trusted root ...
3
votes
2answers
680 views

Disabling EFS--what to do if there are any encrypted files?

I am in the process of retiring an old Windows-integrated CA and bringing online a new, properly-configured one (several, actually). Most of our systems are unable to use EFS thanks to Group Policy... ...
3
votes
1answer
23 views

What is the purpose of a custom Certificate Trust List?

You can create and deploy a certificate trust list as detailed here, but I'm trying to understand the advantages of this over just deploying root and intermediate certs with group policy the normal ...
3
votes
1answer
200 views

How can I get an OID for a certificate template?

I'm using C# (or VBScript) to issue a certificate from an Enterprise CA. According to this answer, I need to specify the OID instead of the certificate name, and place it in an unexpected portion of ...