Public Key Infrastructure is a cryptography system based on X.509 digital certificates, commonly used for encrypted communication and authentication.

learn more… | top users | synonyms

7
votes
2answers
48 views

Powershell Remotely Delete PKI Certificates

I recently rebuilt my PKI and I would like to delete the certificates that were issued to all client machines across my network. Sounds like a job for Powershell! So I wrote this script to be ...
0
votes
0answers
22 views

Unable to sign iLO certificate signing request

Im trying to sign a csr generated from iLO with our local OpenSSL Certificate Authority, however, I receive the following error: [root@ca CA]# openssl ca -in ilo6.csr -out ilo-esx01.crt Using ...
2
votes
1answer
44 views

Using virtual smart card for server-side keys?

Does anybody know if it's possible to store private keys, belonging to service account or computer account, on Windows 8 VSC (virtual smart card)? As far as I understand, requirement for 8-symbols ...
1
vote
1answer
15 views

ADCS - How can I diagnose the exact reason a certificate request was denied by a policy module?

I need to develop operational procedures to audit and understand why a specific request was rejected by an Active Directory Certificate Services (ADCS) Policy Module. I've attempted turning on all ...
4
votes
2answers
38 views

How to tell if an (offline) SSL Certificate been revoked

I would like to know whether an SSL certificate was revoked. The website no longer serves up that certificate, I only have the domain name and the serial number. The SSL certificate was replaced 5 ...
1
vote
1answer
46 views

Decom old CA and Basic EFS certificates

Getting very close to decommissioning our old CA. The new CA is in place and happily issuing certificates and the old CA has had all the templates removed so no certificates will be issued. My ...
0
votes
0answers
24 views

Apache2 + Mod_SSL user management

I'm currently playing around with PKI auth on my Apache2 server and I was just wondering if there is a quick/easy way to add/remove users from the SSLRequire line? Right now I have something like ...
0
votes
2answers
45 views

Subject Alternative Name when internal and external hostnames differ

I have two servers in an Active Directory domain. Both servers have apps that run in Tomcat. I'm ordering PKI certificates for these two servers. The servers are members of the AD domain ...
3
votes
1answer
239 views

802.1x certificates, EAP-TLS, RADIUS and Windows machines

When using 802.1x certificate-based authentication on Windows machines, should I use different certificate for each machine? There is RADIUS server running in the network, the machines use EAP-TLS to ...
0
votes
0answers
145 views

Can't seem to get Apache SSL client certificate authentication working with an intermediate CA

I'm restructuring my personal CA system and trying to add an intermediate CA into the mix. I have a self-signed root CA whose certificate is imported into all appropriate browsers/OSes. I seem to be ...
2
votes
0answers
89 views

Windows Sub CA not issuing certificates

I set up a fresh 2-tier PKI to try and replace an old broken PKI with a CA that was no longer available. Everything seems to be working between the offline root and online issuing CAs, but now I'm ...
0
votes
0answers
24 views

AnyConnect certificate/CA restriction or pinning

I would like to configure the AnyConnect client to only accept server certificate if it is from a specific certificate authority and not anything in the Windows/Linux trusted root store . Ideally, I'd ...
0
votes
0answers
58 views

override specific DN fields when signing csr

When signing CSR on CA side, how can I override specific DN fields by custom value? I want to ignore what is written in CSR. For example in C= and O= fields and replace them by something static. Other ...
11
votes
1answer
271 views

Is there reserved OID space for internal enterprise CAs?

When provisioning a PKI for internal use, is there a private OID space that can be used without having to pay and/or register your own OID range? Think RFC1918 addresses for OID ranges.
0
votes
0answers
21 views

Can I use web proxy to add PKI cert to certain web requests?

I have a web application that authenticates users by their client PKI certificates. A large subset of my user-base sits behind a single internet access point IAP). Is it possible to have the proxy ...
0
votes
1answer
265 views

Convert PUB key to PKCS8 format on CentOS?

In Ubuntu, i can convert a Pub key from OpenSSH-format to PKCS8 format by command: ssh-keygen -e -f .ssh/id_rsa.pub -m PKCS8 But in CentOS 6.4, when i execute the same command, it notice: ...
0
votes
0answers
302 views

Windows RRAS cannot find IKEv2 certificate after restart

We have server running Windows Server 2012 for VPN connections with RRAS. After some initial difficulties with the PKI to get a certificate acceptable for IKEv2, we finally got it working. It worked ...
3
votes
0answers
49 views

Windows PKI: How can I import, sign/issue and export a large number of CSRs?

I have a lot of CRS that I need to have signed/issued and exported in windows. I was hoping I could batch process them somehow (certutil sounds like it can do some of the work) but I'm not quite sure ...
5
votes
1answer
99 views

How does this 2048bit SSL requirement affect existing internal PKIs?

We have our own CA which we've used for years to create hundreds of server certs and thousands of client certs. The CA cert itself is 1024bit and the certs it signed are 1024bit Symantec has been ...
-4
votes
1answer
76 views

PKI with openSSL and Windows 2008

Could anyone tell me about advantages and disadvantages of PKI with openSSL and Windows Certificate authorities ?
3
votes
2answers
240 views

Windows PKI with offline root (maybe with OpenSSL) - Possible?

I'm trying to setup a two-tier PKI and I have a ton of questions. Since there's the tombstone limit for the AD, I'm assuming that the root (which will be offline) shouldn't be part of the AD. Am I ...
0
votes
1answer
2k views

“The private key for the certificate that was configured could not be accessed.”

I'm trying (and failing) to replace the certificates for an ADFS 2.0 stand-alone installation. I've generated the certificates and placed them in the local machine store. But, no matter what I do, I ...
0
votes
0answers
122 views

PKI and Direct Access UAG

I have a two tier PKI infrastructure with an offline root CA and two Enterprise Intermediate Certification Authorities setup to auto enroll certificates. I have setup auto enrollment in default ...
2
votes
1answer
312 views

Multiple CA's on Windows Server 2012

Is it possible to create multiple Certficate Authorities in Windows Server 2012? Specifically: I'd like to create a standalone root CA which will have its private key in offline secure storage. The ...
10
votes
1answer
10k views

Can someone please explain easyrsa vars options for PKI generation

I am using OpenVPN and whilst I can generate certificates using easyrsa just fine I don't really understand the settings in the easyrsa vars file: export KEY_COUNTRY="" export KEY_PROVINCE="" export ...
1
vote
0answers
88 views

iPlanet Authentication provider

Good day. I have stepped into project that requires a server migration that would change the means of authentication for our CAC/PKI SSL enabled website. We are using iPlanet 7 and Oracle Directory ...
3
votes
1answer
163 views

Using an audio cable (or similar) to create unidirectional communication from a secure server

I'm interested in exploring how a semi-offline Root CA can be used to update CRLs to the sub CA's. This answer on Security.SE mentions using an audio cable for this purpose. Doe anyone have details ...
1
vote
1answer
4k views

Revocation status of DC can't be verified

A Domain Controller within my forest was working fine (as the story usually goes). Then, suddenly, I can't logon with my smart card. Instead, I'm greeted with the following message: The system ...
1
vote
1answer
63 views

What format should the .CER file have in the AIA record of a certificate?

I'm updating the .cer file referenced in my end entity's AIA record. What format should I save the file in? By default Windows allows me to save as DER encoded binary X.509 (.cer) Base-64 encoded ...
1
vote
1answer
847 views

How to autoenroll certificates from a Certification Authority in a trusted domain?

I have two Active Directory domains in two separate forests, all at Windows Server 2008 R2 functional levels. There is a two-way forest trust between the domains. Domain A contains a Windows Server ...
0
votes
0answers
339 views

WS 2008 R2 Online Responder not Responding to OCSP Requests

I'm trying to configure an Online Responder (OCSP Responder) for a Windows-based PKI (2008 R2) and I can't for the life of me get the OCSP service to validate when I check it in the Enterprise PKI ...
4
votes
1answer
590 views

Windows 2003 x32 CA to Windows 2008 x64 CA migration

In the following period I have to migrate the AD over to 2008 schema level. I currently have a x64 Windows 2008 R2 domain controller and one x32 Windows Server 2003 domain controller. The x32 server ...
1
vote
1answer
3k views

Child domain new cert request - certificate template permissions do not allow current user to enroll 0x80094012

I have the following AD configuration: rootca (standalone not domain connected) mydom.local dc1.mydom.local svr1.mydom.local subca.mydom.local(enterprise subordinate CA) other.mydom.local ...
0
votes
2answers
94 views

Using Direct Access to allow mobile users to have GPO and the Domain experience

I'm interested in using Direct Access mainly so I can apply GPO to mobile clients and control the "domain experience" these users have. Q: Does Direct Access allow end users to transparently work ...
1
vote
1answer
288 views

Decommissioning PKI - How do I set a CRL Next update to null?

I am planning on deploying two Windows 2008R2 PKIs: One for legacy devices that don't support SHA-2 / ECP and another one that does support it. When the time comes to decommission the SHA1 ...
0
votes
0answers
2k views

Certificate verification fails: Error retrieving URL: This network connection does not exist

I have a test environment where I test smart card logon using a third party CA. I have added the trusted third party root CA to NTAuth store for smart card authentication and set up a web server to ...
1
vote
1answer
2k views

Unable to submit certificate request to 2k8R2 CA

I have created a two-tier CA using Windows Server 2008 R2. The .inf files used to create this standalone root and an enterprise subCA are at the end of this post. The root is installed OK and issued ...
1
vote
1answer
4k views

How to publish a CRL for an internal Windows certification authority?

I have an Active Directory domain with an Enterprise Root Certification Authority in it; the domain uses a private domain name ("domain.local"), and we also have a public domain name ("domain.com"). ...
1
vote
1answer
45 views

Does a VPN certificate request need to be encrypted

We have a Cisco 3000 VPN concentrator and use the Cisco VPN client to generate certificate requests, which we then create/authenticate on our certificate server. When the help desk generates the ...
2
votes
1answer
1k views

Remove expired PXE certificates from SCCM

Our SCCM 2007 R2 environment, which runs in native mode, just had its PXE client certificates renewed. Now, the site server automatically blocks the old certificates, but it appears that there is no ...
1
vote
1answer
212 views

Effect of native mode SCCM site server signing certificate RENEWAL on non-domain computers

We have a native mode SCCM installation on our network. For security reasons, we have two servers that are NOT domain joined, but have the native mode SCCM client installed (and functioning ...
1
vote
2answers
4k views

How to debug missing enterprise root ca certificate?

We have a openssl offline root CA with a Windows 2008 R2 AD-integrated SubCA. The Openssl Root CA was published to ldap CN=ROOTCANAME,CN=Certification Authorities,CN=Public Key ...
0
votes
1answer
195 views

Free OCSP server

I can't have OCSP with my current OS licensing (2008 R2 Standard) but I need this option. I'm hoping to avoid shelling out an additional $2300. Are there any open source products that could act as ...
1
vote
2answers
596 views

Requesting certificates fails in different site

I'm not really sure where to start looking When requesting a certificate, a server always gets the error message "You cannot request a certificate at this time because no certificate types are ...
1
vote
1answer
1k views

RDP Certificate Distribution Points

I am receiving the message "Your computer can't connect to the remote computer because the Remote Desktop Gateway's server's certificate has expired or has been revoked" when trying to access a TS ...
2
votes
1answer
872 views

Why might Windows falsely claim a self-signed root CA certificate is revoked?

I created a self-signed root CA cert for internal test use, using openssl. This has been successfully installed and used as a trusted CA on a number of machines and platforms (Windows, Linux, various ...
2
votes
1answer
565 views

Implications of Root CA without CRL

I'm currently setting up a PKI for my company and while I have come up with a good layout and planned the overall policy of certificate issuance, I'm still puzzled by what role the CRL plays. By ...
2
votes
0answers
414 views

PKI user certificate credential roaming works on Windows 7, but not on XP SP3

We have implemented credential roaming for user certificates on our domain. Everything is set up per Technet in Certification Authority and Group Policy. User certificates are roaming correctly, but ...
0
votes
1answer
127 views

Can not find a specific group in MS Windows 2008

In a MS-Win 2008 SP2 I am trying to find the group CERTSVC_DCOM_ACCESS. I followed this link Error in MS-CA request instructions but I can not seem to find that group. Where it? Does it have a ...
2
votes
2answers
222 views

X509 PKI Managment Appliance

Can anybody recommend a X509 managment appliance? The needs are rather basic, it should provide secured storage of private keys and the certificates for users and hosts, offer an overview of ...