Certificates are a Public Key and Identifying Information

learn more… | top users | synonyms (1)

1
vote
1answer
2k views

Configuring client certificates on IIS8 - Error 403.16

I am trying to implement client certificate authentication on IIS 8. I have deployed my configuration on a development machine and verified it working as expected there. However after setting up on ...
11
votes
4answers
17k views

IIS 7.5 Creating self signed certificates with validation date of more than a year

I am creating self-signed SSL certificates in IIS 7.5 for internal use. The problem I have is that I want to create them so that they last for 10 years as it is only a dev environment. I can't see an ...
0
votes
0answers
19 views

C# Web API is called by CICS cobol over https and it returns 403.16 error

A C# Web API is called by CICS cobol over https and it returns 403.16 error. The mainframe is the HTTP Client. This works with http but not https. A 403 forbidden access error occurs on the Web ...
8
votes
1answer
1k views

certutil -ping fails with 30 seconds timeout - what to do?

The certificate store on my Win7 box is constantly hanging. Observe: C:\>1.cmd C:\>certutil -? | findstr /i ping -ping -- Ping Active Directory Certificate Services Request ...
0
votes
1answer
21 views

Exchange 2010/Outlook certificate errors

We are running Exchange 2010 on SBS 2011. About a year ago, I renewed the certificate for the mail server, however, ever since that time, we receive certificate errors on OWA, and internally, we ...
0
votes
1answer
2k views

Recipients Auto Rejecting Emails Sent With Exchange 2010 - Certificate Error

A strange problem recently developed with one of my Exchange 2010 servers. I have an exchange server setup as part of a Windows Small Business Server 2011 installation. The email for the domain was ...
12
votes
4answers
12k views

Fingerprint of PEM ssh key

I have a PEM file which I add to a running ssh-agent: $ file query.pem query.pem: PEM RSA private key $ ssh-add ./query.pem Identity added: ./query.pem (./query.pem) $ ssh-add -l | grep query 2048 ...
2
votes
1answer
2k views

RDWeb TS connection broken for some users post RemoteApp certificate change

We recently reissued our GoDaddy wildcard cert with the SHA256 signing algorithm (FYI they still revoke the old cert in 72 hours even if you don't re-key it, so you should re-key anyway). We use this ...
0
votes
1answer
57 views

determine assosicate service installed certficate on windows server 2003 or which service is using that certficate

I have been facing issue to determine the purpose of installed certificate on windows server. Further, Is there any way to determine which service is using any particular certificate. So that before ...
3
votes
1answer
2k views

Remote VPN - two-factor authentication with Cisco ASA + OpenLDAP

Can somebody give me a pathway (or link to the documentation / how to) to implement two-factor authentication (LDAP password + certificate) on Cisco ASA for RemoteVPN (with Anyconnect client)? ...
0
votes
2answers
54 views

ADFS and relying party web form

We are in the process of configuring our ADFS server to allow SMAL authentication from a third party web application. We are slightly confused as listed below: We received metadata file and ...
2
votes
3answers
773 views

Will DirectAccess clients renew workstation certificates off-site?

I setup MS DirectAccess nearly a year ago, which required configuring computer certificate auto-enrollment. The first computer certificate is going to expire in about a month, and now I'm wondering ...
7
votes
2answers
3k views

How to manually create Puppet CA and certificates?

I am wondering how to manually (using openssl instead of puppet ca command) create CA that would be usable by Puppet? The goal would be to script creation of such CA's to deploy them on multiple ...
2
votes
1answer
135 views

How to include all dns records and IP address of a server in automatic certificate enrollment of Microsoft AD CS?

In my company there are a lot of servers which users remotely login to them to do their duties. We have enabled computer certificate auto enrollment for them to assure secure connection. But because ...
1
vote
1answer
47 views

PKI EJBCA : extract CA from EJBCA instance and just keep sub-CA

I'm looking for a solution to extract the CA from EJBCA instance, put it on an external drive, which is secured in a safe-deposit for instance. So I only keep the sub-ca for signing the end user ...
0
votes
0answers
16 views

Self signed Cisco VPN Certificate

So I just rented some servers protected with a Cisco Firewall from a data center provider. I plan on accessing these servers through VPN. The instructions from the data center provider was to ...
3
votes
1answer
24 views

How well does haproxy scale for handling client certificate authentication?

My IoT company would like to use client certificate authentication to secure communications between each "thing" and a central server. We deploy about 30K things per year, and they have about a 5-year ...
0
votes
1answer
1k views

error Unable to configure verify locations for client authentication

Starting my apache2 Server on Ubuntu 12.04.5 LTS, I got the following error [error] Unable to configure verify locations for client authentication my Problem, on the server are more than one ...
2
votes
1answer
151 views

How to buy a X.509 certificate for signing digital payloads

I am in a situation where my software is calling a third party web service (SOAP) and using WS-Security for client authentication using a client certificate and digital signing of the message ...
-1
votes
1answer
2k views

Unable to renew certificate in certmgr.msc in windows 2003

I am trying to renew a certificate using CertManager on Windows 2003 Server. (I have also used the certificate plug-in in MMC but its the same thing.) I am logged in with the Administrator account. ...
0
votes
0answers
15 views

Windows: Verifying intermediate CA on dark network with keystore (.kdb)

Background: We have Windows Server 2012's (Server A and B) whose Internet Explorer (IE) connects to RHEL's Apache server (IBM HTTP Server). PKI: Apache serves a certificate whose intermediate CA was ...
1
vote
2answers
41 views

Better way to view windows certs than MMC?

I'm trying to view the windows certs on my box but the UI for certmgr and MMC is terrible. Specifically, I'd like a quick way to view and compare thumbprints and friendly names. Does anyone know a ...
2
votes
1answer
43 views

HTTPS not working with two intermediate certificates

Iʼm trying to create my own certificate authority using the XCA software. I have successfully created the root CA (Fisir Technologies CA) and intermediate CA (Fisir Technologies Intermediate CA X1). ...
0
votes
0answers
49 views

Mac Code Signing Certificate - Can't Renew

Got an alert on server that the certificate is going to expire. I click the "renew" button and it says Unknown Error. So I dig deeper and run the following on the command line sudo ...
0
votes
1answer
66 views

Exchange 2013 ECP ,Redirect loop with wildcard cert

Recently we were unable to log into ECP, after successful login we a re redirected to de login prompt, on our two Exchange servers and no configuration change were made, we are using a wildcart cert ...
0
votes
0answers
11 views

Installing Certificate Enrollment Web Service and Certificate Enrollment Policy Web Service on same computer

I am referencing this MS Technet document: Setting Up Certificate Enrollment Web Services The environment is Windows Server 2008 R2. I am planning for a Certificate Enrollment Web Service and the ...
4
votes
2answers
1k views

Certificate Mismatch RDS Session Host

I've been banging my head against this for the last few days. I have a server 2012 remote desktop setup as follows: 1 Gateway Server 1 RD Web Access Serve 1 Session Broker, which is also a session ...
22
votes
10answers
49k views

IIS7: can't set host name on site with SSL cert and port 443

Consider a Win 2008 SP2 machine with IIS7. The task is to apply a certificate and host name to the one and only Site on this machine. The site's host headers need to be abc.123.example.com The first ...
1
vote
1answer
25 views

java keystore with multiple aliases on apache

A JKS file (Java key store), May contains many aliases, this means it may hold many private+public keys combinations, some aliases may be trusted, some not. When I define jetty to use SSL, as this ...
0
votes
2answers
9k views

Importing certificates on Windows 2008 - “The integrity of this certificate cannot be guaranteed…”

I need to set up secured communications between two windows machines. I have generated a set of certificates for this purpose and saved them as .x509 files. If I set about installing those on ...
3
votes
3answers
33k views

Renewing SBS2011 Exchange Self-Signed Certificate w/o changing home page in IE?

On a previous server when we used the built in SBS wizard to renew the certificate it worked, however it reset all of the computers on the domain's IE home page to companyweb. Is there a way to do ...
0
votes
1answer
13 views

Import Certificate to Machine\personal script/automation?

Is there a automated way to perform this task: I need to import a PFX certificate to computer / personal path on multiple IIS 7.5 servers (Windows Server 2008 R2). I already tried with GPO but there ...
0
votes
1answer
56 views

Authenticated Origin Pulls with CloudFlare and IIS

I'm running Windows Server 2012 R2 with CloudFlare in front and trying to setup authenticated origin pulls as specified here - https://support.cloudflare.com/hc/en-us/articles/204899617 The problem ...
2
votes
1answer
41 views

How to add nameRelativeToCRLIssuer To CRL using OpenSSL

I'm trying to create a certificate using OpenSSL with a nameRelativeToCRLIssuer attribute for the DistributionPoint URL, rather than a fullName attribute. I've been using the following extfile.cnf to ...
9
votes
2answers
1k views

Is it possible to restrict the use of a root certificate to a domain

My customer uses a self signed certificate for an application to work. To be able to work, I have to install the root certificate they used to sign the certificate. Is it possible to configure a root ...
0
votes
0answers
11 views

PEAPv0 Used in Windows Server 2012?

I've read the Wikipedia article on PEAP and have searched Microsoft.com. By all indications, Windows (in my case, Server 2012), uses PEAPv0 (as opposed to PEAPv1 or PEAPv2) to wrap MSCHAPv2. Is ...
0
votes
2answers
50 views

LDAPS on Windows Server 2012 R2 without CA

I am building Splunk in a production environment. The long and short is, in order to get relevant AD things that I need from my Domain Controllers, which are running Windows Server 2012 R2, I need to ...
1
vote
1answer
42 views

Mutual SSL authentication - client certificate vs server certificate

I am setting up a web application which will connect to a remote web service and is required to use a client certificate. My web app uses HTTPS to connect and I have it configured with my existing ...
0
votes
1answer
36 views

nginx client certificate location block

How can I use client certificate authentication with nginx for a folder? The ssl_client_certificate directive isn't allowed in location blocks. Example: I want my website me.tld to be reachable by all ...
1
vote
1answer
1k views

Installing StartSSL certificate in ProFTPD

I am currently experiencing some trouble installing a StartSSL certificate in ProFTPD. These are the files I have: cert.pem - certificate file cert.key - ...
0
votes
1answer
58 views

Client certificate causes http 500.0.64 error in IIS

I have installed a client certificate on my client server. When making an HTTPS request from the client to target server with the client cert the IIS logs report a 500.0.64 error occurred (this is the ...
3
votes
2answers
888 views

Extract private key from Domino keyring

I'm trying to use a multipurpose certificate on an infrastucture that contains a Domino 7 server. To accomplish this, I tried: Generate a CSR outside of Domino: I'm able to use the produced ...
1
vote
1answer
137 views

List all available templates from CA certutil or certreq

I need to request a certificate via command line I have investigated that certreq is the tool that can request the certificate. I am used to the gui to request the certificate by selecting one of the ...
2
votes
1answer
56 views

What is a safe way to allow any windows user to encrypt a file but only a specific application decrypt it

I've developed a service that reads text files from a location. Some of the text files may contain sensitive information. We would like to allow any user to run a standalone tool to encrypt the ...
1
vote
1answer
154 views

Certificate stops working after computer reboot

Got a strange issue that I just can't find any clues. We have a program (Qlikview) which talks to a remote admin service via SSL (Qlikview Server) but it uses the certificate to validate the client. ...
0
votes
1answer
27 views

RDS Session Host RDP SSL Certificate Expiring

We have RDS Deployed with: RD Connection Broker RD Session Host RD Licensing RD Gateway RD Web Access .. For your information our Gateway server name is rdp.sparkorg.org To renew the RDS ...
0
votes
2answers
82 views

Have both Hostname and FQDN in SSL Certificate on IIS

I've been searching here, technet and google but haven't been able to find an answer to my question yet. I have a website running on IIS 7, Server 2012 R2. The IIS serves as an access to our Citrix ...
0
votes
0answers
81 views

Get the latest CTL or list of trusted root certificates

I need to implement a service that does not start because the certificate cannot be validated. This certificate have a root ca that was recently created, so my windows 7 machines does not trust in ...
1
vote
2answers
38 views

TinyCA generated cert refused by Exchange 2013

I've created a CA using TinyCA2, and have created a certificate for my Exchange 2013 server. Although the certificate installed fine on exchange, Exchange always says "Revocation Check Failed". ...
5
votes
2answers
2k views

500 OOPS: SSL: cannot load RSA private key vsftpd

I'm configuring vsfptd on debian 7.3, I'm trying to use ssl. I generate the certficates using this command: openssl req -x509 -nodes -days 1925 -newkey rsa:2048 -keyout ...