Public Key Infrastructure is a cryptography system based on X.509 digital certificates, commonly used for encrypted communication and authentication.

learn more… | top users | synonyms

0
votes
0answers
12 views

URL retrieval tool AIA Certs “Wrong Issuer” after renewal

I performed a certificate renewal and for some reason this tool is indicating that it has wrong issuer. when I click on certs from AIA it says wrong issuer Any help will be grateful, i don't have any ...
1
vote
1answer
21 views

Configuring NGINX with a user list http header/user?

I've got an nginx config that does ssl-pki authentication - I'm happily able to authenticate my users. However, I want to take it a bit further - I want to allow/deny access to resources based on ...
2
votes
1answer
18 views

Microsoft Certificate Authority Provider Compatibilty

So we are a mid-size enterprise refreshing our Microsoft PKI and looking to leverage it heavily across ther org for many things. ie Server to Server/Workstation encryption, Wireless TLS ...
0
votes
1answer
67 views

CSR: Extract PKCS#10 contained in a PKCS#7

Hi eveyone: let's see if someone can help me ;) I'm quite noob at this field so please be gentle. At my job someone passed me a CSR. This CSR is a PKCS#10 request enveloped in a PKC#7 request. My task ...
0
votes
0answers
37 views

How to purge roaming credentials from AD user objects?

Background Due to low-budget constraints we are using roaming credentials instead of smart cards in our environment. Problem Now we have recognized that the relevant AD user attributes became ...
1
vote
0answers
41 views

pki linux auto enrollment

I have a Windows Offline Root CA. I'm looking for a tool which I can install on my secondary CA to import there a certificate from my ROOT CA and to enable certificates auto-enrollment for non Windows ...
1
vote
1answer
103 views

Verifying S/MIME signed message with OpenSSL without checking the certificate's purpose

The problem: When I sign a message with a certificate which is used for a HTTPS webserver, OpenSSL does not want to verify it back. Signing a message: echo "TestMessage" | openssl smime \ ...
3
votes
1answer
154 views

Removing LDAP from CDP & AIA in a Microsoft PKI

A default installation of a Microsoft PKI running Windows 2012 R2 includes LDAP URL's within CRL distribution points (CDP's) and Authority Information Access (AIA). I want to issue certificates ...
4
votes
2answers
107 views

How can I view/export/determine the configuration of a Windows ADCS CA?

I'm in the process of setting up a new root ADCS (Active Directory Certificate Server) certificate authority for a child domain in a multi-forest environment that already has a number of existing CAs. ...
0
votes
0answers
23 views

“Manual User Signing & Encryption Certificates Enrollment” profile in Dogtag CA doesn't work with fresh installation

After Dogtag 10 installation (step by step by video tutorial) when I try to submit request "Manual User Signing & Encryption Certificates Enrollment"(3rd option) to CA by CA end-entity(end user ...
0
votes
1answer
78 views

TLS-PSK vs TLS-PKI

I have read that once TLS-PSK encryption is about equally secure as TLS-PKI. The level of security by both depends on the data entered to configure the encryption. Could you please confirm this? ...
0
votes
0answers
85 views

IPA Server installation: Error with port number

When I am trying to install IPA server, I am getting the following error : IPA requires port 8443 for PKI but it is currently in use. Aborting installation I checked with netstat -tuplen | grep ...
-1
votes
1answer
10 views

-nodes function during CSR creation with OpenSSL

This is a typical command to create CSR and private key with OpenSSL. openssl req -nodes -newkey rsa:4096 -keyout myserver.key -out server.csr What is the function of -nodes in the command line? I ...
1
vote
0answers
98 views

The remote procedure call failed during applying Remote Access Setup Wizard Settings

I have a DirectAccess server with Windows Server 2012 R2 in the DMZ and other services such as Active Directory (located on a subdomain) and the PKI infrastructure in the internal area. And I get ...
2
votes
0answers
83 views

How does one create a certificate request for a managed service account in Windows?

I have a managed service account which needs a certificate in its personal store for decryption. I tried opening the Certificates snap-in and pointing to the service, but when I right-click on the ...
1
vote
0answers
406 views

Linux client for pki certificate auto enrollment from Windows CA

I just set up a Windows Server Certificate Authority. I would like to auto-enroll Ubuntu Linux computers for certificates. Can anyone share the available client options? I found this (old) technet ...
3
votes
1answer
454 views

Wildcard cert for local SSL Certificate Authority?

This seems like it should work, but PKI is complicated and I'd like to ask people who can give an authoritative answer. BACKGROUND: I am the network engineer for a company; for sake of argument ...
2
votes
0answers
43 views

Creating a CA signing chain when there wasn't one before

Here is the problem... 3 years ago we created a multi-datacenter setup, with as little cross-DC resource dependencies as we could make. Different AD sites. Different puppetmasters. Different syslog ...
5
votes
2answers
257 views

Does the “Enterprise PKI” MMC allow for any automated testing of the PKI?

I'm using the Enterprise PKI snap in to diagnose and check the health of a MSFT PKI system. Is there any way to script/automate this tool to alert me to the pending expiration of a CRL or missing ...
5
votes
1answer
884 views

What is the purpose of a custom Certificate Trust List?

You can create and deploy a certificate trust list as detailed here, but I'm trying to understand the advantages of this over just deploying root and intermediate certs with group policy the normal ...
1
vote
1answer
48 views

PKI - Shared accounts and Non-repudiation

I hope this doesn't come across as an idiotic question, but here is the scenario: We have a server 2008R2 domain, using PKI authentication managed through safenet. For a few systems within our ...
3
votes
1answer
276 views

Why does Windows CA Server issue multiple certificates for the same user?

I am currently implementing an EAP/TLS WIFI implementation to replace our EAP/MSCHAP2 wifi implementation. I am using Windows Server 2008 and I've installed a certificate authority. User certificates ...
1
vote
1answer
100 views

Add issuing CA to online root CA windows 2008 r2

we have an existing internal root CA standalone that issue certificate for our domain mycompany.com. We have multiple certificate installed all over the company from this CA. The problem we're facing ...
1
vote
1answer
310 views

PKI - Cert Template could not be loaded. This function is not supported on this system

I've built PKI's many times yet this organization's results have me puzzled. Offline Root 2008 R2 Standard 2xEnterprise Subordinate CA's 2008 R2 Enterprise Installed services, all is good. When I go ...
2
votes
2answers
108 views

Certificate distribution and management

I am planning to setup PKI for our organization as we're fed up with all of these security warnings when using self-signed certs. I want an offline root CA and two issuing CAs and I want to set that ...
1
vote
1answer
1k views

SSL chain verification problems - Barracuda load balancer

I've installed a new SSL certificate using SHA1 hashing. Im user a security certificate by GeoTrust SSL CA - G2 but With WebServices communications I'm getting a PKIX error. The follow page: ...
8
votes
2answers
1k views

Powershell Remotely Delete PKI Certificates

I recently rebuilt my PKI and I would like to delete the certificates that were issued to all client machines across my network. Sounds like a job for Powershell! So I wrote this script to be ...
2
votes
1answer
252 views

Using virtual smart card for server-side keys?

Does anybody know if it's possible to store private keys, belonging to service account or computer account, on Windows 8 VSC (virtual smart card)? As far as I understand, requirement for 8-symbols ...
1
vote
1answer
582 views

ADCS - How can I diagnose the exact reason a certificate request was denied by a policy module?

I need to develop operational procedures to audit and understand why a specific request was rejected by an Active Directory Certificate Services (ADCS) Policy Module. I've attempted turning on all ...
5
votes
2answers
106 views

How to tell if an (offline) SSL Certificate been revoked

I would like to know whether an SSL certificate was revoked. The website no longer serves up that certificate, I only have the domain name and the serial number. The SSL certificate was replaced 5 ...
1
vote
1answer
239 views

Decom old CA and Basic EFS certificates

Getting very close to decommissioning our old CA. The new CA is in place and happily issuing certificates and the old CA has had all the templates removed so no certificates will be issued. My ...
0
votes
0answers
39 views

Apache2 + Mod_SSL user management

I'm currently playing around with PKI auth on my Apache2 server and I was just wondering if there is a quick/easy way to add/remove users from the SSLRequire line? Right now I have something like ...
0
votes
2answers
201 views

Subject Alternative Name when internal and external hostnames differ

I have two servers in an Active Directory domain. Both servers have apps that run in Tomcat. I'm ordering PKI certificates for these two servers. The servers are members of the AD domain ...
3
votes
1answer
2k views

802.1x certificates, EAP-TLS, RADIUS and Windows machines

When using 802.1x certificate-based authentication on Windows machines, should I use different certificate for each machine? There is RADIUS server running in the network, the machines use EAP-TLS to ...
0
votes
0answers
1k views

Can't seem to get Apache SSL client certificate authentication working with an intermediate CA

I'm restructuring my personal CA system and trying to add an intermediate CA into the mix. I have a self-signed root CA whose certificate is imported into all appropriate browsers/OSes. I seem to be ...
2
votes
0answers
342 views

Windows Sub CA not issuing certificates

I set up a fresh 2-tier PKI to try and replace an old broken PKI with a CA that was no longer available. Everything seems to be working between the offline root and online issuing CAs, but now I'm ...
1
vote
1answer
430 views

override specific DN fields when signing csr

When signing CSR on CA side, how can I override specific DN fields by custom value? I want to ignore what is written in CSR. For example in C= and O= fields and replace them by something static. Other ...
11
votes
1answer
904 views

Is there reserved OID space for internal enterprise CAs?

When provisioning a PKI for internal use, is there a private OID space that can be used without having to pay and/or register your own OID range? Think RFC1918 addresses for OID ranges.
0
votes
1answer
979 views

Convert PUB key to PKCS8 format on CentOS?

In Ubuntu, i can convert a Pub key from OpenSSH-format to PKCS8 format by command: ssh-keygen -e -f .ssh/id_rsa.pub -m PKCS8 But in CentOS 6.4, when i execute the same command, it notice: ...
8
votes
2answers
267 views

Windows PKI: How can I import, sign/issue and export a large number of CSRs?

I have a lot of CSRs that I need to have signed/issued and exported in windows. I was hoping I could batch process them somehow (certutil sounds like it can do some of the work) but I'm not quite sure ...
5
votes
1answer
151 views

How does this 2048bit SSL requirement affect existing internal PKIs?

We have our own CA which we've used for years to create hundreds of server certs and thousands of client certs. The CA cert itself is 1024bit and the certs it signed are 1024bit Symantec has been ...
-5
votes
1answer
175 views

PKI with openSSL and Windows 2008

Could anyone tell me about advantages and disadvantages of PKI with openSSL and Windows Certificate authorities ?
4
votes
2answers
596 views

Windows PKI with offline root (maybe with OpenSSL) - Possible?

I'm trying to setup a two-tier PKI and I have a ton of questions. Since there's the tombstone limit for the AD, I'm assuming that the root (which will be offline) shouldn't be part of the AD. Am I ...
0
votes
1answer
5k views

“The private key for the certificate that was configured could not be accessed.”

I'm trying (and failing) to replace the certificates for an ADFS 2.0 stand-alone installation. I've generated the certificates and placed them in the local machine store. But, no matter what I do, I ...
0
votes
0answers
223 views

PKI and Direct Access UAG

I have a two tier PKI infrastructure with an offline root CA and two Enterprise Intermediate Certification Authorities setup to auto enroll certificates. I have setup auto enrollment in default ...
0
votes
1answer
267 views

What's the difference between managing certificates for a user account and for a computer account?

We have some domain-joined computers that were unable to import a third party root cert as a trusted cert provider. In trying to fix this, I noticed that when we go to use the certificate management ...
2
votes
1answer
932 views

Multiple CA's on Windows Server 2012

Is it possible to create multiple Certficate Authorities in Windows Server 2012? Specifically: I'd like to create a standalone root CA which will have its private key in offline secure storage. The ...
12
votes
1answer
24k views

Can someone please explain easyrsa vars options for PKI generation

I am using OpenVPN and whilst I can generate certificates using easyrsa just fine I don't really understand the settings in the easyrsa vars file: export KEY_COUNTRY="" export KEY_PROVINCE="" export ...
1
vote
0answers
134 views

iPlanet Authentication provider

Good day. I have stepped into project that requires a server migration that would change the means of authentication for our CAC/PKI SSL enabled website. We are using iPlanet 7 and Oracle Directory ...
4
votes
1answer
260 views

Using an audio cable (or similar) to create unidirectional communication from a secure server

I'm interested in exploring how a semi-offline Root CA can be used to update CRLs to the sub CA's. This answer on Security.SE mentions using an audio cable for this purpose. Doe anyone have details ...