Public Key Infrastructure is a cryptography system based on X.509 digital certificates, commonly used for encrypted communication and authentication.
2
votes
2answers
59 views
Windows PKI with offline root (maybe with OpenSSL) - Possible?
I'm trying to setup a two-tier PKI and I have a ton of questions.
Since there's the tombstone limit for the AD, I'm assuming that the root (which will be offline) shouldn't be part of the AD. Am I ...
2
votes
0answers
28 views
Building PKI with openssl
I'm working on building PKI. I created RootCA, subCA with openssl. I know to know a steps to sign and using certificate's chain using openssl in Unix/Linux.
0
votes
0answers
75 views
Short Lifing CRLs for NPS EAP-TLS Authentication?
I got a question which i'm unable to find an answer for on any official MS ressource.
Image a CA with realy short lifing CRLs (like 1 day). The CA is used only for two purposes: creating NPS ...
0
votes
1answer
287 views
“The private key for the certificate that was configured could not be accessed.”
I'm trying (and failing) to replace the certificates for an ADFS 2.0 stand-alone installation. I've generated the certificates and placed them in the local machine store. But, no matter what I do, I ...
0
votes
0answers
60 views
PKI and Direct Access UAG
I have a two tier PKI infrastructure with an offline root CA and two Enterprise Intermediate Certification Authorities setup to auto enroll certificates. I have setup auto enrollment in default ...
2
votes
1answer
150 views
Multiple CA's on Windows Server 2012
Is it possible to create multiple Certficate Authorities in Windows Server 2012?
Specifically: I'd like to create a standalone root CA which will have its private key in offline secure storage. The ...
1
vote
1answer
916 views
Can someone please explain easyrsa vars options for PKI generation
I am using OpenVPN and whilst I can generate certificates using easyrsa just fine I don't really understand the settings in the easyrsa vars file:
export KEY_COUNTRY=""
export KEY_PROVINCE=""
export ...
1
vote
0answers
67 views
iPlanet Authentication provider
Good day. I have stepped into project that requires a server migration that would change the means of authentication for our CAC/PKI SSL enabled website. We are using iPlanet 7 and Oracle Directory ...
3
votes
1answer
106 views
Using an audio cable (or similar) to create unidirectional communication from a secure server
I'm interested in exploring how a semi-offline Root CA can be used to update CRLs to the sub CA's. This answer on Security.SE mentions using an audio cable for this purpose.
Doe anyone have details ...
1
vote
1answer
966 views
Revocation status of DC can't be verified
A Domain Controller within my forest was working fine (as the story usually goes).
Then, suddenly, I can't logon with my smart card. Instead, I'm greeted with the following message:
The system ...
1
vote
1answer
34 views
What format should the .CER file have in the AIA record of a certificate?
I'm updating the .cer file referenced in my end entity's AIA record. What format should I save the file in?
By default Windows allows me to save as
DER encoded binary X.509 (.cer)
Base-64 encoded ...
1
vote
1answer
426 views
How to autoenroll certificates from a Certification Authority in a trusted domain?
I have two Active Directory domains in two separate forests, all at Windows Server 2008 R2 functional levels. There is a two-way forest trust between the domains.
Domain A contains a Windows Server ...
0
votes
0answers
188 views
WS 2008 R2 Online Responder not Responding to OCSP Requests
I'm trying to configure an Online Responder (OCSP Responder) for a Windows-based PKI (2008 R2) and I can't for the life of me get the OCSP service to validate when I check it in the Enterprise PKI ...
4
votes
1answer
258 views
Windows 2003 x32 CA to Windows 2008 x64 CA migration
In the following period I have to migrate the AD over to 2008 schema level.
I currently have a x64 Windows 2008 R2 domain controller and one x32 Windows Server 2003 domain controller. The x32 server ...
1
vote
1answer
1k views
Child domain new cert request - certificate template permissions do not allow current user to enroll 0x80094012
I have the following AD configuration:
rootca (standalone not domain connected)
mydom.local
dc1.mydom.local
svr1.mydom.local
subca.mydom.local(enterprise subordinate CA)
other.mydom.local
...
0
votes
0answers
53 views
Certificate in My Store and LDAP
Hi all,
When issue a Certificate (cert), 2 cert are created on Client: - 1 cert is created in My Store (Personal) and this cert includes private key. - 1 cert is created in LDAP (Active Directory ...
0
votes
2answers
77 views
Using Direct Access to allow mobile users to have GPO and the Domain experience
I'm interested in using Direct Access mainly so I can apply GPO to mobile clients and control the "domain experience" these users have.
Q: Does Direct Access allow end users to transparently work ...
1
vote
1answer
169 views
Decommissioning PKI - How do I set a CRL Next update to null?
I am planning on deploying two Windows 2008R2 PKIs: One for legacy devices that don't support SHA-2 / ECP and another one that does support it.
When the time comes to decommission the SHA1 ...
0
votes
0answers
654 views
Certificate verification fails: Error retrieving URL: This network connection does not exist
I have a test environment where I test smart card logon using a third party CA.
I have added the trusted third party root CA to NTAuth store for smart card authentication and set up a web server to ...
1
vote
1answer
1k views
Unable to submit certificate request to 2k8R2 CA
I have created a two-tier CA using Windows Server 2008 R2. The .inf files used to create this standalone root and an enterprise subCA are at the end of this post.
The root is installed OK and issued ...
0
votes
1answer
2k views
How to publish a CRL for an internal Windows certification authority?
I have an Active Directory domain with an Enterprise Root Certification Authority in it; the domain uses a private domain name ("domain.local"), and we also have a public domain name ("domain.com"). ...
1
vote
1answer
42 views
Does a VPN certificate request need to be encrypted
We have a Cisco 3000 VPN concentrator and use the Cisco VPN client to generate certificate requests, which we then create/authenticate on our certificate server.
When the help desk generates the ...
2
votes
1answer
733 views
Remove expired PXE certificates from SCCM
Our SCCM 2007 R2 environment, which runs in native mode, just had its PXE client certificates renewed. Now, the site server automatically blocks the old certificates, but it appears that there is no ...
1
vote
1answer
161 views
Effect of native mode SCCM site server signing certificate RENEWAL on non-domain computers
We have a native mode SCCM installation on our network. For security reasons, we have two servers that are NOT domain joined, but have the native mode SCCM client installed (and functioning ...
1
vote
2answers
2k views
How to debug missing enterprise root ca certificate?
We have a openssl offline root CA with a Windows 2008 R2 AD-integrated SubCA.
The Openssl Root CA was published to ldap CN=ROOTCANAME,CN=Certification Authorities,CN=Public Key ...
0
votes
1answer
153 views
Free OCSP server
I can't have OCSP with my current OS licensing (2008 R2 Standard) but I need this option. I'm hoping to avoid shelling out an additional $2300.
Are there any open source products that could act as ...
1
vote
2answers
380 views
Requesting certificates fails in different site
I'm not really sure where to start looking
When requesting a certificate, a server always gets the error message "You cannot request a certificate at this time because no certificate types are ...
1
vote
1answer
736 views
RDP Certificate Distribution Points
I am receiving the message "Your computer can't connect to the remote computer because the Remote Desktop Gateway's server's certificate has expired or has been revoked" when trying to access a TS ...
2
votes
1answer
600 views
Why might Windows falsely claim a self-signed root CA certificate is revoked?
I created a self-signed root CA cert for internal test use, using openssl. This has been successfully installed and used as a trusted CA on a number of machines and platforms (Windows, Linux, various ...
1
vote
1answer
355 views
Implications of Root CA without CRL
I'm currently setting up a PKI for my company and while I have come up with a good layout and planned the overall policy of certificate issuance, I'm still puzzled by what role the CRL plays.
By ...
2
votes
0answers
252 views
PKI user certificate credential roaming works on Windows 7, but not on XP SP3
We have implemented credential roaming for user certificates on our domain. Everything is set up per Technet in Certification Authority and Group Policy. User certificates are roaming correctly, but ...
0
votes
1answer
88 views
Can not find a specific group in MS Windows 2008
In a MS-Win 2008 SP2 I am trying to find the group CERTSVC_DCOM_ACCESS.
I followed this link Error in MS-CA request instructions but I can not seem to find that group.
Where it? Does it have a ...
2
votes
2answers
158 views
X509 PKI Managment Appliance
Can anybody recommend a X509 managment appliance? The needs are rather basic, it should provide secured storage of private keys and the certificates for users and hosts, offer an overview of ...
0
votes
1answer
397 views
How to create a proxy certificate?
I have created an ssl-based server that I need to now create a proxy certificate for. (the second part of the school project).
I have found these lines on the OpenSSL Project:
openssl req -new ...
0
votes
1answer
98 views
Use Certificate Autoenrolment with third-party Certificate Authority
Is it possible to setup Windows Domain to use Certificate Autoenrolment and third-party Certificate Authority?
We think that it can be done in Windows Server 2008 only but don`t know exactly, please ...
3
votes
3answers
2k views
How does SSO using Active Directory works where user is transparently logged in. (intranet webapp)
I'm told that it's possible to make a web application not require a login. The user logs in to Windows, which authenticates via an Active Directory (LDAP) Lookup. Then, they should be able to go to ...
5
votes
3answers
272 views
how to prevent a user using private key after leaving organization?
In the enterprise environment, each user was issue a key pair for using to encrypting/signing. Since they have the private key, that mean they can decrypt any file that encrypt for them, even after ...
1
vote
2answers
421 views
How to set a passphrase for an AWS X.509 private key?
I was rotating my AWS X.509 certificate and private key (not to be confused with ssh private / public key pair) today and decided I wanted to set a pass-phrase on my private key to better protect it. ...
0
votes
1answer
128 views
Does IIS 6.0 Log CRL Checks?
I am adding a 3rd party OCSP responder(Tumbleweed) plugin to IIS 6.0/Windows. I have the 3rd party tool configured to check the revocation status and would like to assert that IIS is not making a ...
6
votes
1answer
923 views
Smart card authentication to a Cisco switch?
We have our Cisco network devices configured to authenticate network administrators using their domain accounts via RADIUS running on a Windows 2008R2 server with the network protection role. This ...
1
vote
1answer
107 views
Hierarchical certification authorities and CRLs
If I implement a PKI with multiple levels of CAs, do I need to have a CRL for each individual CA or can I just have one CRL for the entire hierarchy (i.e. point all certificates to a single CRL), or ...
0
votes
1answer
89 views
Who uses OpenXPKI?
I'm evaluating PKI solutions for my client, and among other more technical attributes I'd like to be able to report a few marquis users of each solution.
Many projects list well-known users or link ...
0
votes
1answer
152 views
What should be the CRL publishing period for corporate environments?
I am trying to suggest a CRL publishing period for a Microsoft CA, the user certificates are going to be used for digital signature.There can be cases that a user certificate may be revoked.
...
1
vote
1answer
253 views
PKI Issuing CA on Domain Controllers
I am setting up a PKI which will initially be used internally. As we may grow our use of this I have opted for a three tier hierarchy - Offline Root and Policy CAs (one Policy CA at the moment for ...
0
votes
1answer
153 views
Shorten CA Certificate lifetime with Certificate Services?
I recently setup Windows 2003 Certificate Services and installed a five year certificate. I'm now working with a vendor that requires our public CA key so that they can trust all certificates ...
2
votes
3answers
689 views
What books will help me learn everything I can about SSL/PKI?
Since SSL is the backbone of the internet, (now technically called TLS), what are some good books I should read up on to understand all aspects of it.
I suppose I'll need to learn some math, some PKI ...
1
vote
1answer
824 views
Import Root CA into Trusted Root Certificate Store from a script
We're looking into the possibility of deploying our enterprise CA to users at their homes, and we're looking for a method to programmatically install a root CA.
I noticed certutil isn't included on ...
2
votes
2answers
246 views
PKI infrastructure and usage question
I work in a small software solutions company (50 employees) and I was recently tasked with experimenting with web services. Since we mainly offer solutions for Windows, I started toying around with ...
2
votes
2answers
2k views
OpenVPN with a Windows Certificate Services PKI
has anyone tried using OpenVPN with certificates generated by Windows Certificate Services?
In theory this should work.
The provided easy-rsa PKI is not very comfortable to manage for many users. I ...
2
votes
2answers
7k views
How secure is SFTP? Is there any benefit in encrypting traffic with PKI as well?
I am working with a client that requires the use of secureFTP for file transfer and is also advocating the use of sLift EZ Classic (command-line file encryption using PKI) on top of SFTP.
Is this ...
