Public Key Infrastructure is a cryptography system based on X.509 digital certificates, commonly used for encrypted communication and authentication.

learn more… | top users | synonyms

2
votes
1answer
684 views

Implications of Root CA without CRL

I'm currently setting up a PKI for my company and while I have come up with a good layout and planned the overall policy of certificate issuance, I'm still puzzled by what role the CRL plays. By ...
2
votes
0answers
511 views

PKI user certificate credential roaming works on Windows 7, but not on XP SP3

We have implemented credential roaming for user certificates on our domain. Everything is set up per Technet in Certification Authority and Group Policy. User certificates are roaming correctly, but ...
0
votes
1answer
219 views

Can not find a specific group in MS Windows 2008

In a MS-Win 2008 SP2 I am trying to find the group CERTSVC_DCOM_ACCESS. I followed this link Error in MS-CA request instructions but I can not seem to find that group. Where it? Does it have a ...
2
votes
2answers
245 views

X509 PKI Managment Appliance

Can anybody recommend a X509 managment appliance? The needs are rather basic, it should provide secured storage of private keys and the certificates for users and hosts, offer an overview of ...
0
votes
1answer
715 views

How to create a proxy certificate?

I have created an ssl-based server that I need to now create a proxy certificate for. (the second part of the school project). I have found these lines on the OpenSSL Project: openssl req -new ...
0
votes
1answer
137 views

Use Certificate Autoenrolment with third-party Certificate Authority

Is it possible to setup Windows Domain to use Certificate Autoenrolment and third-party Certificate Authority? We think that it can be done in Windows Server 2008 only but don`t know exactly, please ...
7
votes
4answers
9k views

How does SSO using Active Directory works where user is transparently logged in. (intranet webapp)

I'm told that it's possible to make a web application not require a login. The user logs in to Windows, which authenticates via an Active Directory (LDAP) Lookup. Then, they should be able to go to ...
5
votes
3answers
293 views

how to prevent a user using private key after leaving organization?

In the enterprise environment, each user was issue a key pair for using to encrypting/signing. Since they have the private key, that mean they can decrypt any file that encrypt for them, even after ...
2
votes
2answers
709 views

How to set a passphrase for an AWS X.509 private key?

I was rotating my AWS X.509 certificate and private key (not to be confused with ssh private / public key pair) today and decided I wanted to set a pass-phrase on my private key to better protect it. ...
0
votes
1answer
190 views

Does IIS 6.0 Log CRL Checks?

I am adding a 3rd party OCSP responder(Tumbleweed) plugin to IIS 6.0/Windows. I have the 3rd party tool configured to check the revocation status and would like to assert that IIS is not making a ...
8
votes
2answers
2k views

Smart card authentication to a Cisco switch?

We have our Cisco network devices configured to authenticate network administrators using their domain accounts via RADIUS running on a Windows 2008R2 server with the network protection role. This ...
1
vote
1answer
142 views

Hierarchical certification authorities and CRLs

If I implement a PKI with multiple levels of CAs, do I need to have a CRL for each individual CA or can I just have one CRL for the entire hierarchy (i.e. point all certificates to a single CRL), or ...
0
votes
1answer
117 views

Who uses OpenXPKI?

I'm evaluating PKI solutions for my client, and among other more technical attributes I'd like to be able to report a few marquis users of each solution. Many projects list well-known users or link ...
1
vote
1answer
276 views

What should be the CRL publishing period for corporate environments?

I am trying to suggest a CRL publishing period for a Microsoft CA, the user certificates are going to be used for digital signature.There can be cases that a user certificate may be revoked. ...
2
votes
1answer
365 views

PKI Issuing CA on Domain Controllers

I am setting up a PKI which will initially be used internally. As we may grow our use of this I have opted for a three tier hierarchy - Offline Root and Policy CAs (one Policy CA at the moment for ...
0
votes
1answer
166 views

Shorten CA Certificate lifetime with Certificate Services?

I recently setup Windows 2003 Certificate Services and installed a five year certificate. I'm now working with a vendor that requires our public CA key so that they can trust all certificates ...
2
votes
3answers
1k views

What books will help me learn everything I can about SSL/PKI?

Since SSL is the backbone of the internet, (now technically called TLS), what are some good books I should read up on to understand all aspects of it. I suppose I'll need to learn some math, some PKI ...
1
vote
1answer
948 views

Import Root CA into Trusted Root Certificate Store from a script

We're looking into the possibility of deploying our enterprise CA to users at their homes, and we're looking for a method to programmatically install a root CA. I noticed certutil isn't included on ...
2
votes
2answers
300 views

PKI infrastructure and usage question

I work in a small software solutions company (50 employees) and I was recently tasked with experimenting with web services. Since we mainly offer solutions for Windows, I started toying around with ...
2
votes
2answers
2k views

OpenVPN with a Windows Certificate Services PKI

has anyone tried using OpenVPN with certificates generated by Windows Certificate Services? In theory this should work. The provided easy-rsa PKI is not very comfortable to manage for many users. I ...
2
votes
2answers
12k views

How secure is SFTP? Is there any benefit in encrypting traffic with PKI as well?

I am working with a client that requires the use of secureFTP for file transfer and is also advocating the use of sLift EZ Classic (command-line file encryption using PKI) on top of SFTP. Is this ...
5
votes
3answers
297 views

PKI keys per service or per server?

We all have a lot of internal services that need encryption and authentication to be provided by some sort of PKI. Do the security gains of using a different private/public key pair for each service ...
306
votes
3answers
290k views

What is a Pem file and how does it differ from other OpenSSL Generated Key File Formats?

I am responsible for maintaining two Debian servers. Every time I have to do anything with security certificates, I Google for tutorials and beat away until it finally works. However, in my searches ...