Public Key Infrastructure is a cryptography system based on X.509 digital certificates, commonly used for encrypted communication and authentication.

learn more… | top users | synonyms

0
votes
0answers
27 views

Can't seem to get Apache SSL client certificate authentication working with an intermediate CA

I'm restructuring my personal CA system and trying to add an intermediate CA into the mix. I have a self-signed root CA whose certificate is imported into all appropriate browsers/OSes. I seem to be ...
1
vote
0answers
48 views

Windows Sub CA not issuing certificates

I set up a fresh 2-tier PKI to try and replace an old broken PKI with a CA that was no longer available. Everything seems to be working between the offline root and online issuing CAs, but now I'm ...
0
votes
0answers
16 views

AnyConnect certificate/CA restriction or pinning

I would like to configure the AnyConnect client to only accept server certificate if it is from a specific certificate authority and not anything in the Windows/Linux trusted root store . Ideally, I'd ...
0
votes
0answers
34 views

override specific DN fields when signing csr

When signing CSR on CA side, how can I override specific DN fields by custom value? I want to ignore what is written in CSR. For example in C= and O= fields and replace them by something static. Other ...
11
votes
1answer
219 views

Is there reserved OID space for internal enterprise CAs?

When provisioning a PKI for internal use, is there a private OID space that can be used without having to pay and/or register your own OID range? Think RFC1918 addresses for OID ranges.
0
votes
0answers
19 views

Can I use web proxy to add PKI cert to certain web requests?

I have a web application that authenticates users by their client PKI certificates. A large subset of my user-base sits behind a single internet access point IAP). Is it possible to have the proxy ...
0
votes
1answer
204 views

Convert PUB key to PKCS8 format on CentOS?

In Ubuntu, i can convert a Pub key from OpenSSH-format to PKCS8 format by command: ssh-keygen -e -f .ssh/id_rsa.pub -m PKCS8 But in CentOS 6.4, when i execute the same command, it notice: ...
0
votes
0answers
188 views

Windows RRAS cannot find IKEv2 certificate after restart

We have server running Windows Server 2012 for VPN connections with RRAS. After some initial difficulties with the PKI to get a certificate acceptable for IKEv2, we finally got it working. It worked ...
3
votes
0answers
39 views

Windows PKI: How can I import, sign/issue and export a large number of CSRs?

I have a lot of CRS that I need to have signed/issued and exported in windows. I was hoping I could batch process them somehow (certutil sounds like it can do some of the work) but I'm not quite sure ...
5
votes
1answer
94 views

How does this 2048bit SSL requirement affect existing internal PKIs?

We have our own CA which we've used for years to create hundreds of server certs and thousands of client certs. The CA cert itself is 1024bit and the certs it signed are 1024bit Symantec has been ...
-4
votes
1answer
58 views

PKI with openSSL and Windows 2008

Could anyone tell me about advantages and disadvantages of PKI with openSSL and Windows Certificate authorities ?
2
votes
2answers
200 views

Windows PKI with offline root (maybe with OpenSSL) - Possible?

I'm trying to setup a two-tier PKI and I have a ton of questions. Since there's the tombstone limit for the AD, I'm assuming that the root (which will be offline) shouldn't be part of the AD. Am I ...
0
votes
1answer
1k views

“The private key for the certificate that was configured could not be accessed.”

I'm trying (and failing) to replace the certificates for an ADFS 2.0 stand-alone installation. I've generated the certificates and placed them in the local machine store. But, no matter what I do, I ...
0
votes
0answers
112 views

PKI and Direct Access UAG

I have a two tier PKI infrastructure with an offline root CA and two Enterprise Intermediate Certification Authorities setup to auto enroll certificates. I have setup auto enrollment in default ...
2
votes
1answer
260 views

Multiple CA's on Windows Server 2012

Is it possible to create multiple Certficate Authorities in Windows Server 2012? Specifically: I'd like to create a standalone root CA which will have its private key in offline secure storage. The ...
8
votes
1answer
9k views

Can someone please explain easyrsa vars options for PKI generation

I am using OpenVPN and whilst I can generate certificates using easyrsa just fine I don't really understand the settings in the easyrsa vars file: export KEY_COUNTRY="" export KEY_PROVINCE="" export ...
1
vote
0answers
82 views

iPlanet Authentication provider

Good day. I have stepped into project that requires a server migration that would change the means of authentication for our CAC/PKI SSL enabled website. We are using iPlanet 7 and Oracle Directory ...
3
votes
1answer
153 views

Using an audio cable (or similar) to create unidirectional communication from a secure server

I'm interested in exploring how a semi-offline Root CA can be used to update CRLs to the sub CA's. This answer on Security.SE mentions using an audio cable for this purpose. Doe anyone have details ...
1
vote
1answer
3k views

Revocation status of DC can't be verified

A Domain Controller within my forest was working fine (as the story usually goes). Then, suddenly, I can't logon with my smart card. Instead, I'm greeted with the following message: The system ...
1
vote
1answer
55 views

What format should the .CER file have in the AIA record of a certificate?

I'm updating the .cer file referenced in my end entity's AIA record. What format should I save the file in? By default Windows allows me to save as DER encoded binary X.509 (.cer) Base-64 encoded ...
1
vote
1answer
691 views

How to autoenroll certificates from a Certification Authority in a trusted domain?

I have two Active Directory domains in two separate forests, all at Windows Server 2008 R2 functional levels. There is a two-way forest trust between the domains. Domain A contains a Windows Server ...
0
votes
0answers
291 views

WS 2008 R2 Online Responder not Responding to OCSP Requests

I'm trying to configure an Online Responder (OCSP Responder) for a Windows-based PKI (2008 R2) and I can't for the life of me get the OCSP service to validate when I check it in the Enterprise PKI ...
4
votes
1answer
525 views

Windows 2003 x32 CA to Windows 2008 x64 CA migration

In the following period I have to migrate the AD over to 2008 schema level. I currently have a x64 Windows 2008 R2 domain controller and one x32 Windows Server 2003 domain controller. The x32 server ...
1
vote
1answer
2k views

Child domain new cert request - certificate template permissions do not allow current user to enroll 0x80094012

I have the following AD configuration: rootca (standalone not domain connected) mydom.local dc1.mydom.local svr1.mydom.local subca.mydom.local(enterprise subordinate CA) other.mydom.local ...
0
votes
2answers
91 views

Using Direct Access to allow mobile users to have GPO and the Domain experience

I'm interested in using Direct Access mainly so I can apply GPO to mobile clients and control the "domain experience" these users have. Q: Does Direct Access allow end users to transparently work ...
1
vote
1answer
269 views

Decommissioning PKI - How do I set a CRL Next update to null?

I am planning on deploying two Windows 2008R2 PKIs: One for legacy devices that don't support SHA-2 / ECP and another one that does support it. When the time comes to decommission the SHA1 ...
0
votes
0answers
2k views

Certificate verification fails: Error retrieving URL: This network connection does not exist

I have a test environment where I test smart card logon using a third party CA. I have added the trusted third party root CA to NTAuth store for smart card authentication and set up a web server to ...
1
vote
1answer
1k views

Unable to submit certificate request to 2k8R2 CA

I have created a two-tier CA using Windows Server 2008 R2. The .inf files used to create this standalone root and an enterprise subCA are at the end of this post. The root is installed OK and issued ...
1
vote
1answer
3k views

How to publish a CRL for an internal Windows certification authority?

I have an Active Directory domain with an Enterprise Root Certification Authority in it; the domain uses a private domain name ("domain.local"), and we also have a public domain name ("domain.com"). ...
1
vote
1answer
45 views

Does a VPN certificate request need to be encrypted

We have a Cisco 3000 VPN concentrator and use the Cisco VPN client to generate certificate requests, which we then create/authenticate on our certificate server. When the help desk generates the ...
2
votes
1answer
1k views

Remove expired PXE certificates from SCCM

Our SCCM 2007 R2 environment, which runs in native mode, just had its PXE client certificates renewed. Now, the site server automatically blocks the old certificates, but it appears that there is no ...
1
vote
1answer
199 views

Effect of native mode SCCM site server signing certificate RENEWAL on non-domain computers

We have a native mode SCCM installation on our network. For security reasons, we have two servers that are NOT domain joined, but have the native mode SCCM client installed (and functioning ...
1
vote
2answers
3k views

How to debug missing enterprise root ca certificate?

We have a openssl offline root CA with a Windows 2008 R2 AD-integrated SubCA. The Openssl Root CA was published to ldap CN=ROOTCANAME,CN=Certification Authorities,CN=Public Key ...
0
votes
1answer
186 views

Free OCSP server

I can't have OCSP with my current OS licensing (2008 R2 Standard) but I need this option. I'm hoping to avoid shelling out an additional $2300. Are there any open source products that could act as ...
1
vote
2answers
535 views

Requesting certificates fails in different site

I'm not really sure where to start looking When requesting a certificate, a server always gets the error message "You cannot request a certificate at this time because no certificate types are ...
1
vote
1answer
1k views

RDP Certificate Distribution Points

I am receiving the message "Your computer can't connect to the remote computer because the Remote Desktop Gateway's server's certificate has expired or has been revoked" when trying to access a TS ...
2
votes
1answer
812 views

Why might Windows falsely claim a self-signed root CA certificate is revoked?

I created a self-signed root CA cert for internal test use, using openssl. This has been successfully installed and used as a trusted CA on a number of machines and platforms (Windows, Linux, various ...
1
vote
1answer
510 views

Implications of Root CA without CRL

I'm currently setting up a PKI for my company and while I have come up with a good layout and planned the overall policy of certificate issuance, I'm still puzzled by what role the CRL plays. By ...
2
votes
0answers
373 views

PKI user certificate credential roaming works on Windows 7, but not on XP SP3

We have implemented credential roaming for user certificates on our domain. Everything is set up per Technet in Certification Authority and Group Policy. User certificates are roaming correctly, but ...
0
votes
1answer
112 views

Can not find a specific group in MS Windows 2008

In a MS-Win 2008 SP2 I am trying to find the group CERTSVC_DCOM_ACCESS. I followed this link Error in MS-CA request instructions but I can not seem to find that group. Where it? Does it have a ...
2
votes
2answers
210 views

X509 PKI Managment Appliance

Can anybody recommend a X509 managment appliance? The needs are rather basic, it should provide secured storage of private keys and the certificates for users and hosts, offer an overview of ...
0
votes
1answer
546 views

How to create a proxy certificate?

I have created an ssl-based server that I need to now create a proxy certificate for. (the second part of the school project). I have found these lines on the OpenSSL Project: openssl req -new ...
0
votes
1answer
119 views

Use Certificate Autoenrolment with third-party Certificate Authority

Is it possible to setup Windows Domain to use Certificate Autoenrolment and third-party Certificate Authority? We think that it can be done in Windows Server 2008 only but don`t know exactly, please ...
5
votes
4answers
5k views

How does SSO using Active Directory works where user is transparently logged in. (intranet webapp)

I'm told that it's possible to make a web application not require a login. The user logs in to Windows, which authenticates via an Active Directory (LDAP) Lookup. Then, they should be able to go to ...
5
votes
3answers
286 views

how to prevent a user using private key after leaving organization?

In the enterprise environment, each user was issue a key pair for using to encrypting/signing. Since they have the private key, that mean they can decrypt any file that encrypt for them, even after ...
2
votes
2answers
595 views

How to set a passphrase for an AWS X.509 private key?

I was rotating my AWS X.509 certificate and private key (not to be confused with ssh private / public key pair) today and decided I wanted to set a pass-phrase on my private key to better protect it. ...
0
votes
1answer
164 views

Does IIS 6.0 Log CRL Checks?

I am adding a 3rd party OCSP responder(Tumbleweed) plugin to IIS 6.0/Windows. I have the 3rd party tool configured to check the revocation status and would like to assert that IIS is not making a ...
8
votes
2answers
1k views

Smart card authentication to a Cisco switch?

We have our Cisco network devices configured to authenticate network administrators using their domain accounts via RADIUS running on a Windows 2008R2 server with the network protection role. This ...
1
vote
1answer
124 views

Hierarchical certification authorities and CRLs

If I implement a PKI with multiple levels of CAs, do I need to have a CRL for each individual CA or can I just have one CRL for the entire hierarchy (i.e. point all certificates to a single CRL), or ...
0
votes
1answer
99 views

Who uses OpenXPKI?

I'm evaluating PKI solutions for my client, and among other more technical attributes I'd like to be able to report a few marquis users of each solution. Many projects list well-known users or link ...