Questions tagged [pki]

Public Key Infrastructure is a cryptography system based on X.509 digital certificates, commonly used for encrypted communication and authentication.

61 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
4 votes
0 answers
6k views

Active Directory Certificate Services cannot publish revocation list after renewal with new private Key

In summary: I had a working offline root CA and an AD integrated CA working fine I renewed the certificate with the same private key and all was good I then renewed the certificate with a new ...
Ross's user avatar
  • 133
3 votes
0 answers
850 views

PKI Authentication in HTTPD using Active Directory (LDAP)

In my environment, an external entity provides a Root CA & Intermediate CA(s). They issue thousands of smartcards with PKI certificates for authentication. They provide the Client Authentication ...
ruckc's user avatar
  • 131
3 votes
0 answers
75 views

Creating a CA signing chain when there wasn't one before

Here is the problem... 3 years ago we created a multi-datacenter setup, with as little cross-DC resource dependencies as we could make. Different AD sites. Different puppetmasters. Different syslog ...
Blue Warrior NFB's user avatar
3 votes
0 answers
1k views

Windows Sub CA not issuing certificates

I set up a fresh 2-tier PKI to try and replace an old broken PKI with a CA that was no longer available. Everything seems to be working between the offline root and online issuing CAs, but now I'm ...
fwrawx's user avatar
  • 187
2 votes
1 answer
5k views

NGINX unable to get issuer certificate

I am using NGINX web server. Configured my site with a setting where user will be challenged to present his certificate when he makes first request to the site by using following setting: ...
SharpCoder's user avatar
2 votes
0 answers
1k views

Vault invalid certificate or no client certificate supplied - cert auth method

I have created a CA in Vault to handle my certificate creation. I've followed this guide here: https://learn.hashicorp.com/vault/secrets-management/sm-pki-engine I am trying to generate a client ...
Charles Wood's user avatar
2 votes
1 answer
7k views

Certbot: Issuing a certfiicate for internal IP address with my own PKI?

I am running my own ACME CA server that allows issuing of certificates to IP addresses. I have installed the root certificate into all the devices in my LAN. Let's say that I am running the server at ...
huanglx's user avatar
  • 213
2 votes
1 answer
3k views

Automatically renew certificate: Old cert gets archived, but no new one is issued

We are using Active Directory Certificate Services (AD CS) to issue certificates for internal web applications. We can manually request a certificate from the CA and it gets issued without problems. ...
powerzone3000's user avatar
2 votes
0 answers
983 views

Enroll on-behalf-of certificate using existing CSR file

Good day, I have a CSR (certificate signing request) file, which was generated on some remote non-domain station. I have created some AD user account. I have Enrollment Agent certificate signed for ...
Cat Mucius's user avatar
2 votes
0 answers
1k views

Why might a ssl certificate fail to validate after the root certificate was installed?

I am building an openssl Certificate Authority for an intranet. I have root.crt, intermediate.crt which is signed by the root, and server.crt which is signed by the intermediate. I can validate the ...
spraff's user avatar
  • 549
2 votes
0 answers
2k views

How does one create a certificate request for a managed service account in Windows?

I have a managed service account which needs a certificate in its personal store for decryption. I tried opening the Certificates snap-in and pointing to the service, but when I right-click on the "...
bshacklett's user avatar
  • 1,388
2 votes
0 answers
1k views

PKI user certificate credential roaming works on Windows 7, but not on XP SP3

We have implemented credential roaming for user certificates on our domain. Everything is set up per Technet in Certification Authority and Group Policy. User certificates are roaming correctly, but ...
newmanth's user avatar
  • 3,943
1 vote
1 answer
175 views

SubCA certificate of trust

I have deployed a PKI infrastructure with a Stand-Alone Root CA (which will be kept off) and 4 Enterprise SubCA's which depends on this Root CA. To make the computers trust the Root CA, I am going to ...
Santyuste's user avatar
1 vote
1 answer
111 views

Is it possible to specify Active Directory PKI key size throuth CSR

When I request certificate from Letsencrypt, put key and fullchain.cer in nginx config - everything works fine. The same for Active Directory is not working. -I generate key (tried rsa 2048 or 4096 ...
Oleg Gritsak's user avatar
1 vote
1 answer
173 views

High available PKI related questions with regards to CA/OCSP and NDES

I have some specific questions with regards a high available PKI based on ADCS. The questions are as follows. Please see the detailed info below to get more info on the casus. -------------------------...
MyPkiProblems's user avatar
1 vote
0 answers
258 views

Fedora Server 37 CA certificate store most equivalent to LocalMachine\root

Fedora Server 37 CA certificate store most equivalent to LocalMachine\root in a Windows environment? Background notes: I have plenty of experience in the Windows area for certificate management, but ...
jcolebrand's user avatar
1 vote
0 answers
2k views

Enabling SSL on Tomcat 9

There are a few questions I have regarding setting up SSL on Tomcat 9 as some of the things I've read have some inconsistencies and I'm also new to PKI. Ultimately, there are two things I'm trying to ...
stripies's user avatar
1 vote
0 answers
104 views

How to get the issuing certificate authority from an apple push notification certificate

I want to import the Apple push notification certificate into AWS ACM. So first, I had to convert it to pem. Using openssl pkcs12, I was able to get the Certificate and the Private Key. But when ...
Moadh's user avatar
  • 11
1 vote
1 answer
303 views

vsftp has a bug with Fedora 32 - how do I report it: 500 OOPS: SSL: cannot load RSA private key vsftpd

Just to be clear, this is as of Fedora 32, and vsftpd-3.0.3-36.fc32.x86_64 for vsftpd. This is NOT the same problem as previously was reported here, but it has the same outward appearance and, indeed, ...
Richard T's user avatar
  • 1,242
1 vote
1 answer
452 views

ADCS PKI - AIA Location when using OCSP

My question is wheter or not I still need to configure the following AIA location on my subordinate CA when I'm using OCSP: http://SERVERFQN/DIRECTORY/<Serverdnsname>_<Caname><...
kevin rennenberg's user avatar
1 vote
0 answers
963 views

Optional TPM Key Attestation in AD Certificate Services

We have a range of Windows 10 computers in our estate - some with no TPM chip, some with TPM 1.2, and some with TPM 2.0. I want to configure a certificate template to optionally perform TPM Key ...
aw9274's user avatar
  • 11
1 vote
0 answers
643 views

SSH Gateway Pass-through Authentication

We are looking to configure a 'transparent' SSH gateway that passes authentication on to an upstream SSH server based upon the username in the SSH request. All users will be using public key ...
hermetik's user avatar
1 vote
0 answers
6k views

Issue certificate to IP address in AD CS

We're trying to get a Sophos XG 210 to connect via LDAPS to an Active Directory Domain Services (AD DS) / Domain Controller (DC) server but doing so fails with the following two errors: Device - AD ...
mythofechelon's user avatar
1 vote
1 answer
1k views

DirectAccess and renewing SSL with new PKI?

We have deployed DirectAccess in our network for our Windows 7/10 clients which works great. The issue is, the DA server/client certificates are based on a internal PKI we are retiring; we have build ...
user avatar
1 vote
0 answers
224 views

Unable to generate and import user certificate from ADCS in Chrome

We are using Certificate Based Authentication using ADCS. So in order for user to access an internal website, they need their own signed certificate. With ADCS, the user gets their signed certificate ...
zealvora's user avatar
1 vote
0 answers
11k views

java.security.KeyStoreException: TrustedCertEntry not supported

I am trying to secure my private docker registry using SSL encryption. According to this, I need to copy a .crt and .key to a /certs directory and it will work. What I have now is a .csr, .keystore ...
saurg's user avatar
  • 113
1 vote
0 answers
619 views

Pulling Subject Alt Name - Apache Reverse Proxy PIV CAC Authentication

I have created an apache 2.2 reverse proxy running on red hat. This proxy will need to accept a client certificate, pull the needed information, and pass that along to an application running locally ...
Brett Salmiery's user avatar
1 vote
2 answers
884 views

PKI - What is the equivalency of a Registration Authority (RA) in AD Certificate Services?

What is the equivalency of a Registration Authority (RA) in AD Certificate Services? I was reading documentation on TechNet (the best ever, jk) and it had explained that NDES was technically the ...
Matt L.'s user avatar
  • 21
1 vote
0 answers
44 views

Apache: Intermediate CA on "dark network" (no internet access)

Background: Apache 2.4 (server) and Windows 7 Internet Explorer (client) using PKI; both machines are on a "dark network" (no internet access). Question: In the SSL handshake, how does the ...
mellow-yellow's user avatar
1 vote
1 answer
344 views

Configuring NGINX with a user list http header/user?

I've got an nginx config that does ssl-pki authentication - I'm happily able to authenticate my users. However, I want to take it a bit further - I want to allow/deny access to resources based on ...
Sobrique's user avatar
  • 3,767
1 vote
0 answers
784 views

The remote procedure call failed during applying Remote Access Setup Wizard Settings

I have a DirectAccess server with Windows Server 2012 R2 in the DMZ and other services such as Active Directory (located on a subdomain) and the PKI infrastructure in the internal area. And I get ...
Andrés Rivera's user avatar
1 vote
0 answers
162 views

iPlanet Authentication provider

Good day. I have stepped into project that requires a server migration that would change the means of authentication for our CAC/PKI SSL enabled website. We are using iPlanet 7 and Oracle Directory ...
Travis's user avatar
  • 111
1 vote
1 answer
477 views

Effect of native mode SCCM site server signing certificate RENEWAL on non-domain computers

We have a native mode SCCM installation on our network. For security reasons, we have two servers that are NOT domain joined, but have the native mode SCCM client installed (and functioning nominally)...
newmanth's user avatar
  • 3,943
0 votes
1 answer
76 views

Reissuing AD certificate breaks Always On VPN

Reissuing AD certificate breaks Always On VPN. We needed to update our AD CA to have a longer key length and an improved signing algorithm. This works fine and we are able to issue new certificates ...
The_hydorah's user avatar
0 votes
0 answers
86 views

Multiple certificate chains in a single file

My company has a Windows-based PKI with a single standalone root CA and several subordinate CAs for different audiences/purposes (e.g. two subordinate CAs for user/machine auto-enrollment, an ...
Paulo1205's user avatar
  • 101
0 votes
0 answers
164 views

NPS Certificate

I am changing a CA in the domain to a new one. The old CA will be deactivated. I have an NPS server configured with the certificate of the old CA in "Network Policies -> Policy1 -> ...
Santyuste's user avatar
0 votes
0 answers
30 views

CA template Windows

In a Windows CA, I have mistakenly removed permissions from a template and now I can't modify it. How do I modify or delete this template to create it again? Thanks
Santyuste's user avatar
0 votes
0 answers
44 views

Request Certificate CA

I have a Windows server configured as a Certificate Authority (CA). When requesting a certificate via https://server/certServ and choosing the template to request (Request Certificate->Advance ...
Santyuste's user avatar
0 votes
1 answer
4k views

How to force Domain Controller to get new certificate from PKI Server

I bluntly created a PKI Server (AD CS) that sits inside the Domain. My Domain Controllers got a DomainController Certificate from it. After that I thought that it would be better, to create a Root CA ...
SimonS's user avatar
  • 787
0 votes
1 answer
120 views

CA: Certificate User for VPN

From a subordinate Enterprise CA I want to generate a user certificate that serves as an authentication method for VPN connections. I want to install this certificate with autoenroll on the domain ...
Santyuste's user avatar
0 votes
0 answers
49 views

How to integrate .Net application to ADCS using API

We have to integrate own app to MS ADCS environment for autoenrollment digital certificates. Is there any guide to integrate our app to MS Certificate Authority using API?
Ivan Diniz's user avatar
0 votes
0 answers
58 views

CA root and CA subordinate administrator

I want to deploy a new PKI infrastructure on a domain that has several subdomains and trusted domains. I would like to be able to delegate the administration between several administrators ...
Santyuste's user avatar
0 votes
1 answer
585 views

Trouble setting up CES and CEP PKI in a trusted forest scenario

I have two AD domains with a two-way forest trust. I want computer accounts in DomainB to enroll for computer client auth certificates from the two-tier Windows CA in DomainA. I configured a ...
corndog's user avatar
0 votes
0 answers
31 views

2 Issuing CAs are Effected by Subnet Region

We are working to set up a 2-tier pki with 2 issuing CAs in different regions/subnets. We were able to get everything looking right on pkiview.msc. We are still having trouble though with the second ...
Woogi's user avatar
  • 1
0 votes
0 answers
158 views

1 ICA and CRL serving 2 different domain

I have 1 ICA and 1 CRL and I would like it to serve 2 different domain in my setup. Is that possible? I'm running Windows Server 2019. Note, I'm not able to set a trust relationship between the 2 ...
tosei's user avatar
  • 1
0 votes
1 answer
1k views

Ldap service not running on Windows Server 2019

I have 2 windows server 2019. e.g. server1 and server2. server1 is the domain controller. server1 has below roles installed: ADDS, ADCS, DNS, FILE STORAGE, IIS. server2 is connected to that domain ...
Ghansham's user avatar
  • 101
0 votes
0 answers
793 views

Cannot reach HTTPS page with self-signed server certificate and DoD CA certificates

I'm attempting to create a local web server using Flask, a Python microframework, that uses the PKIs on a DoD CAC. I've created the self-signed root CA and server certificate and key following this ...
pstatix's user avatar
  • 111
0 votes
0 answers
596 views

This computer can't connect to the remote computer. Unknown key usage (1.3.6.1.4.1.311.54.1.2)

I'm unable to RDP to a server on our child domain after adding a Remote desktop certificate that is signed by one of our Certificate authorities. We have intentionally removed the self-signed RDP ...
redhatsamurai's user avatar
0 votes
0 answers
821 views

ADCS Change AIA information from existing certificate

We have built a tier 2 PKI. Recently we decided to start hosting our CDP & AIA on a seperate webserver. However this was not originally in the design, so now we have problems with the certificate ...
kevin rennenberg's user avatar
0 votes
0 answers
937 views

Icinga PKI Agent-Satellite-Master

According to the documentation on https://icinga.com/docs/icinga2/latest/doc/06-distributed-monitoring/, all nodes in an Icinga Monitoring need to have one CA which is on the master node. But I think, ...
TRW's user avatar
  • 518