0
votes
0answers
24 views

Can't seem to get Apache SSL client certificate authentication working with an intermediate CA

I'm restructuring my personal CA system and trying to add an intermediate CA into the mix. I have a self-signed root CA whose certificate is imported into all appropriate browsers/OSes. I seem to be ...
0
votes
0answers
34 views

override specific DN fields when signing csr

When signing CSR on CA side, how can I override specific DN fields by custom value? I want to ignore what is written in CSR. For example in C= and O= fields and replace them by something static. Other ...
3
votes
0answers
39 views

Windows PKI: How can I import, sign/issue and export a large number of CSRs?

I have a lot of CRS that I need to have signed/issued and exported in windows. I was hoping I could batch process them somehow (certutil sounds like it can do some of the work) but I'm not quite sure ...
5
votes
1answer
93 views

How does this 2048bit SSL requirement affect existing internal PKIs?

We have our own CA which we've used for years to create hundreds of server certs and thousands of client certs. The CA cert itself is 1024bit and the certs it signed are 1024bit Symantec has been ...
2
votes
2answers
200 views

Windows PKI with offline root (maybe with OpenSSL) - Possible?

I'm trying to setup a two-tier PKI and I have a ton of questions. Since there's the tombstone limit for the AD, I'm assuming that the root (which will be offline) shouldn't be part of the AD. Am I ...
2
votes
1answer
258 views

Multiple CA's on Windows Server 2012

Is it possible to create multiple Certficate Authorities in Windows Server 2012? Specifically: I'd like to create a standalone root CA which will have its private key in offline secure storage. The ...
3
votes
1answer
152 views

Using an audio cable (or similar) to create unidirectional communication from a secure server

I'm interested in exploring how a semi-offline Root CA can be used to update CRLs to the sub CA's. This answer on Security.SE mentions using an audio cable for this purpose. Doe anyone have details ...
4
votes
1answer
524 views

Windows 2003 x32 CA to Windows 2008 x64 CA migration

In the following period I have to migrate the AD over to 2008 schema level. I currently have a x64 Windows 2008 R2 domain controller and one x32 Windows Server 2003 domain controller. The x32 server ...
1
vote
1answer
269 views

Decommissioning PKI - How do I set a CRL Next update to null?

I am planning on deploying two Windows 2008R2 PKIs: One for legacy devices that don't support SHA-2 / ECP and another one that does support it. When the time comes to decommission the SHA1 ...
0
votes
1answer
186 views

Free OCSP server

I can't have OCSP with my current OS licensing (2008 R2 Standard) but I need this option. I'm hoping to avoid shelling out an additional $2300. Are there any open source products that could act as ...
1
vote
1answer
1k views

RDP Certificate Distribution Points

I am receiving the message "Your computer can't connect to the remote computer because the Remote Desktop Gateway's server's certificate has expired or has been revoked" when trying to access a TS ...
2
votes
1answer
812 views

Why might Windows falsely claim a self-signed root CA certificate is revoked?

I created a self-signed root CA cert for internal test use, using openssl. This has been successfully installed and used as a trusted CA on a number of machines and platforms (Windows, Linux, various ...
1
vote
1answer
510 views

Implications of Root CA without CRL

I'm currently setting up a PKI for my company and while I have come up with a good layout and planned the overall policy of certificate issuance, I'm still puzzled by what role the CRL plays. By ...
0
votes
1answer
119 views

Use Certificate Autoenrolment with third-party Certificate Authority

Is it possible to setup Windows Domain to use Certificate Autoenrolment and third-party Certificate Authority? We think that it can be done in Windows Server 2008 only but don`t know exactly, please ...
1
vote
1answer
124 views

Hierarchical certification authorities and CRLs

If I implement a PKI with multiple levels of CAs, do I need to have a CRL for each individual CA or can I just have one CRL for the entire hierarchy (i.e. point all certificates to a single CRL), or ...