Public Key Infrastructure is a cryptography system based on X.509 digital certificates, commonly used for encrypted communication and authentication.

learn more… | top users | synonyms

-1
votes
0answers
7 views

Authenticate on freeradius running the SQL module, via pki

I've see this done a lot of times (and I guess it has a lot in common on how smart card auth works here) but I can't find any information on how to setup a freeradius server that authenticates a ...
0
votes
1answer
27 views

Migrating PKI and CA of a Domain Controller that needs to be demoted

I have a Domain Controller that for some reason beyond me has ADCS installed on it. The domain controller is a 2008 R2 server and needs to be demoted, but first I need to do one of two things. This ...
0
votes
1answer
54 views

let's encrypt certificates vs squid transparent proxies

I have an issue with setting up a transparent Squid proxy on a pfsense firewall. I created a CA for HTTPS MITM, installed it in my browser and it works with most websites. However sites like ...
0
votes
0answers
17 views

Pulling Subject Alt Name - Apache Reverse Proxy PIV CAC Authentication

I have created an apache 2.2 reverse proxy running on red hat. This proxy will need to accept a client certificate, pull the needed information, and pass that along to an application running locally ...
6
votes
2answers
153 views

Why does OpenVPN give the error: “unsupported certificate purpose” for an intermediate certificate?

EDIT: I'm really sorry to have to say that the problem has magically fixed itself and I have no idea why. In response to one of the answers, I removed all EKU from the CA chain and it didn't work. ...
1
vote
0answers
36 views

Capture and forward extended PKI cert attributes (e.g. UPN) using haproxy

I'm trying to pull an attribute from a client certificate in a mutual authentication scenario and set it as a HTTP header in the request to backend. See fig 1 below. fig1 [user with correct ...
0
votes
0answers
28 views

Invalid CRL distribution points in certs after CA migration

I have recently migrated an Enterprise CA from a Windows Server 2003 box to a Windows Server 2012 R2 box using the Active Directory Certificate Services Migration Guide. The CA was running entirely ...
0
votes
1answer
30 views

Can I setup logstash with windows generated certs instead of openssl?

Going through this tutorial. They use openssl to generate certs to use with logstash ie this command: sudo openssl req -subj '/CN=ELK_server_fqdn/' -x509 -days 3650 -batch -nodes -newkey rsa:2048 -...
0
votes
2answers
23 views

PKI - What is the equivalency of a Registration Authority (RA) in AD Certificate Services?

What is the equivalency of a Registration Authority (RA) in AD Certificate Services? I was reading documentation on TechNet (the best ever, jk) and it had explained that NDES was technically the ...
0
votes
1answer
30 views

PKI SHA1 Upgrade - Thumbprint Algorithm Explanation

PKI SHA1 Upgrade - What is the difference between the Signature Algorithm and the Thumbprint Algorithm?
0
votes
0answers
63 views

SHA1 Migration to SHA2 - ADCS Windows 2012 R2

I am a little new to AD CS and I was tasked with upgrading our entire PKI infrastructure from SHA1 to SHA256 for the SHA1 deprecation. I have read somewhere that SHA256 can read SHA1 hashes. This ...
0
votes
1answer
184 views

TLS 1.2 client hello triggers TCP Reset from 2012 R2

Struggling with a PKI implementation in my lab (ADCS 2012 R2) and cannot for the life of me figure out where I have gone wrong. Got all the way to the point of being able to generate SSL/TLS certs ...
1
vote
2answers
75 views

Do web Servers send the certificate chain to the Web Client?

If my web server (latest Apache) has a valid (not expired or revoked) Verisign certificate chain (root -> intermediate -> leaf/my server), then does the server send the entire(?) chain to the client? ...
1
vote
0answers
15 views

Apache: Intermediate CA on “dark network” (no internet access)

Background: Apache 2.4 (server) and Windows 7 Internet Explorer (client) using PKI; both machines are on a "dark network" (no internet access). Question: In the SSL handshake, how does the client ...
1
vote
1answer
32 views

How EJBCA generate private key

I'm looking for the method used by EJBCA to generate the private keys in general (CA, Sub-Ca, certificates...). Let say for instance you want RSA 2048 key size. Is the generation process all done in ...
1
vote
1answer
73 views

PKI EJBCA : extract CA from EJBCA instance and just keep sub-CA

I'm looking for a solution to extract the CA from EJBCA instance, put it on an external drive, which is secured in a safe-deposit for instance. So I only keep the sub-ca for signing the end user ...
1
vote
0answers
30 views

OpenSource PKI Solution : user feedback and advices [closed]

I work on securing data exchange over the Internet. We plan to use a VPN together with certificates to authenticates users. To do so I've identified various PKI solutions. EJBCA : Installed and ...
0
votes
0answers
21 views

Installing Certificate Enrollment Web Service and Certificate Enrollment Policy Web Service on same computer

I am referencing this MS Technet document: Setting Up Certificate Enrollment Web Services The environment is Windows Server 2008 R2. I am planning for a Certificate Enrollment Web Service and the ...
0
votes
0answers
41 views

How to disable Microsoft CA version extension in a Standalone Root CA?

I was looking for a way to exclude CA version from the ca extensions, but found nothing. We use Windows Server 2012 and it is needed for a Standalone root ca. Is there any way?
0
votes
0answers
32 views

dogtag CRL profile

I am attempting to add a CRL Distribution Point to a Dogtag CA Certificate Profile. Using the caServerCert profile as a template, I copied it to a profile named serverCertTest and added the following ...
0
votes
0answers
93 views

URL retrieval tool AIA Certs “Wrong Issuer” after renewal

I performed a certificate renewal and for some reason this tool is indicating that it has wrong issuer. when I click on certs from AIA it says wrong issuer Any help will be grateful, i don't have any ...
1
vote
1answer
39 views

Configuring NGINX with a user list http header/user?

I've got an nginx config that does ssl-pki authentication - I'm happily able to authenticate my users. However, I want to take it a bit further - I want to allow/deny access to resources based on ...
2
votes
1answer
81 views

Microsoft Certificate Authority Provider Compatibilty

So we are a mid-size enterprise refreshing our Microsoft PKI and looking to leverage it heavily across ther org for many things. ie Server to Server/Workstation encryption, Wireless TLS Encryption/...
0
votes
1answer
324 views

CSR: Extract PKCS#10 contained in a PKCS#7

Hi eveyone: let's see if someone can help me ;) I'm quite noob at this field so please be gentle. At my job someone passed me a CSR. This CSR is a PKCS#10 request enveloped in a PKC#7 request. My task ...
0
votes
0answers
147 views

How to purge roaming credentials from AD user objects?

Background Due to low-budget constraints we are using roaming credentials instead of smart cards in our environment. Problem Now we have recognized that the relevant AD user attributes became ...
1
vote
0answers
87 views

pki linux auto enrollment

I have a Windows Offline Root CA. I'm looking for a tool which I can install on my secondary CA to import there a certificate from my ROOT CA and to enable certificates auto-enrollment for non Windows ...
1
vote
1answer
364 views

Verifying S/MIME signed message with OpenSSL without checking the certificate's purpose

The problem: When I sign a message with a certificate which is used for a HTTPS webserver, OpenSSL does not want to verify it back. Signing a message: echo "TestMessage" | openssl smime \ -...
3
votes
1answer
457 views

Removing LDAP from CDP & AIA in a Microsoft PKI

A default installation of a Microsoft PKI running Windows 2012 R2 includes LDAP URL's within CRL distribution points (CDP's) and Authority Information Access (AIA). I want to issue certificates ...
4
votes
2answers
113 views

How can I view/export/determine the configuration of a Windows ADCS CA?

I'm in the process of setting up a new root ADCS (Active Directory Certificate Server) certificate authority for a child domain in a multi-forest environment that already has a number of existing CAs. ...
0
votes
0answers
29 views

“Manual User Signing & Encryption Certificates Enrollment” profile in Dogtag CA doesn't work with fresh installation

After Dogtag 10 installation (step by step by video tutorial) when I try to submit request "Manual User Signing & Encryption Certificates Enrollment"(3rd option) to CA by CA end-entity(end user ...
0
votes
1answer
164 views

TLS-PSK vs TLS-PKI

I have read that once TLS-PSK encryption is about equally secure as TLS-PKI. The level of security by both depends on the data entered to configure the encryption. Could you please confirm this? ...
0
votes
0answers
183 views

IPA Server installation: Error with port number

When I am trying to install IPA server, I am getting the following error : IPA requires port 8443 for PKI but it is currently in use. Aborting installation I checked with netstat -tuplen | grep ...
-1
votes
1answer
14 views

-nodes function during CSR creation with OpenSSL

This is a typical command to create CSR and private key with OpenSSL. openssl req -nodes -newkey rsa:4096 -keyout myserver.key -out server.csr What is the function of -nodes in the command line? I ...
1
vote
0answers
163 views

The remote procedure call failed during applying Remote Access Setup Wizard Settings

I have a DirectAccess server with Windows Server 2012 R2 in the DMZ and other services such as Active Directory (located on a subdomain) and the PKI infrastructure in the internal area. And I get ...
2
votes
0answers
135 views

How does one create a certificate request for a managed service account in Windows?

I have a managed service account which needs a certificate in its personal store for decryption. I tried opening the Certificates snap-in and pointing to the service, but when I right-click on the "...
1
vote
0answers
631 views

Linux client for pki certificate auto enrollment from Windows CA

I just set up a Windows Server Certificate Authority. I would like to auto-enroll Ubuntu Linux computers for certificates. Can anyone share the available client options? I found this (old) technet ...
3
votes
1answer
555 views

Wildcard cert for local SSL Certificate Authority?

This seems like it should work, but PKI is complicated and I'd like to ask people who can give an authoritative answer. BACKGROUND: I am the network engineer for a company; for sake of argument we'...
2
votes
0answers
47 views

Creating a CA signing chain when there wasn't one before

Here is the problem... 3 years ago we created a multi-datacenter setup, with as little cross-DC resource dependencies as we could make. Different AD sites. Different puppetmasters. Different syslog ...
5
votes
2answers
352 views

Does the “Enterprise PKI” MMC allow for any automated testing of the PKI?

I'm using the Enterprise PKI snap in to diagnose and check the health of a MSFT PKI system. Is there any way to script/automate this tool to alert me to the pending expiration of a CRL or missing AIA?...
5
votes
1answer
1k views

What is the purpose of a custom Certificate Trust List?

You can create and deploy a certificate trust list as detailed here, but I'm trying to understand the advantages of this over just deploying root and intermediate certs with group policy the normal ...
1
vote
1answer
58 views

PKI - Shared accounts and Non-repudiation

I hope this doesn't come across as an idiotic question, but here is the scenario: We have a server 2008R2 domain, using PKI authentication managed through safenet. For a few systems within our domain,...
3
votes
1answer
412 views

Why does Windows CA Server issue multiple certificates for the same user?

I am currently implementing an EAP/TLS WIFI implementation to replace our EAP/MSCHAP2 wifi implementation. I am using Windows Server 2008 and I've installed a certificate authority. User certificates ...
1
vote
1answer
111 views

Add issuing CA to online root CA windows 2008 r2

we have an existing internal root CA standalone that issue certificate for our domain mycompany.com. We have multiple certificate installed all over the company from this CA. The problem we're facing ...
1
vote
1answer
419 views

PKI - Cert Template could not be loaded. This function is not supported on this system

I've built PKI's many times yet this organization's results have me puzzled. Offline Root 2008 R2 Standard 2xEnterprise Subordinate CA's 2008 R2 Enterprise Installed services, all is good. When I go ...
2
votes
2answers
112 views

Certificate distribution and management

I am planning to setup PKI for our organization as we're fed up with all of these security warnings when using self-signed certs. I want an offline root CA and two issuing CAs and I want to set that ...
1
vote
1answer
1k views

SSL chain verification problems - Barracuda load balancer

I've installed a new SSL certificate using SHA1 hashing. Im user a security certificate by GeoTrust SSL CA - G2 but With WebServices communications I'm getting a PKIX error. The follow page: https://...
9
votes
2answers
1k views

Powershell Remotely Delete PKI Certificates

I recently rebuilt my PKI and I would like to delete the certificates that were issued to all client machines across my network. Sounds like a job for Powershell! So I wrote this script to be ...
2
votes
1answer
309 views

Using virtual smart card for server-side keys?

Does anybody know if it's possible to store private keys, belonging to service account or computer account, on Windows 8 VSC (virtual smart card)? As far as I understand, requirement for 8-symbols (...
1
vote
1answer
765 views

ADCS - How can I diagnose the exact reason a certificate request was denied by a policy module?

I need to develop operational procedures to audit and understand why a specific request was rejected by an Active Directory Certificate Services (ADCS) Policy Module. I've attempted turning on all ...
5
votes
2answers
124 views

How to tell if an (offline) SSL Certificate been revoked

I would like to know whether an SSL certificate was revoked. The website no longer serves up that certificate, I only have the domain name and the serial number. The SSL certificate was replaced 5 ...