Questions tagged [pki]
Public Key Infrastructure is a cryptography system based on X.509 digital certificates, commonly used for encrypted communication and authentication.
61
questions with no upvoted or accepted answers
4
votes
0
answers
6k
views
Active Directory Certificate Services cannot publish revocation list after renewal with new private Key
In summary:
I had a working offline root CA and an AD integrated CA working fine
I renewed the certificate with the same private key and all was good
I then renewed the certificate with a new ...
3
votes
0
answers
850
views
PKI Authentication in HTTPD using Active Directory (LDAP)
In my environment, an external entity provides a Root CA & Intermediate CA(s). They issue thousands of smartcards with PKI certificates for authentication. They provide the Client Authentication ...
3
votes
0
answers
75
views
Creating a CA signing chain when there wasn't one before
Here is the problem...
3 years ago we created a multi-datacenter setup, with as little cross-DC resource dependencies as we could make. Different AD sites. Different puppetmasters. Different syslog ...
3
votes
0
answers
1k
views
Windows Sub CA not issuing certificates
I set up a fresh 2-tier PKI to try and replace an old broken PKI with a CA that was no longer available. Everything seems to be working between the offline root and online issuing CAs, but now I'm ...
2
votes
1
answer
5k
views
NGINX unable to get issuer certificate
I am using NGINX web server. Configured my site with a setting where user will be challenged to present his certificate when he makes first request to the site by using following setting:
...
2
votes
0
answers
1k
views
Vault invalid certificate or no client certificate supplied - cert auth method
I have created a CA in Vault to handle my certificate creation. I've followed this guide here: https://learn.hashicorp.com/vault/secrets-management/sm-pki-engine
I am trying to generate a client ...
2
votes
1
answer
7k
views
Certbot: Issuing a certfiicate for internal IP address with my own PKI?
I am running my own ACME CA server that allows issuing of certificates to IP addresses. I have installed the root certificate into all the devices in my LAN. Let's say that I am running the server at ...
2
votes
1
answer
3k
views
Automatically renew certificate: Old cert gets archived, but no new one is issued
We are using Active Directory Certificate Services (AD CS) to issue certificates for internal web applications. We can manually request a certificate from the CA and it gets issued without problems. ...
2
votes
0
answers
983
views
Enroll on-behalf-of certificate using existing CSR file
Good day,
I have a CSR (certificate signing request) file, which was generated
on some remote non-domain station.
I have created some AD user
account.
I have Enrollment Agent certificate signed for ...
2
votes
0
answers
1k
views
Why might a ssl certificate fail to validate after the root certificate was installed?
I am building an openssl Certificate Authority for an intranet.
I have root.crt, intermediate.crt which is signed by the root, and server.crt which is signed by the intermediate.
I can validate the ...
2
votes
0
answers
2k
views
How does one create a certificate request for a managed service account in Windows?
I have a managed service account which needs a certificate in its personal store for decryption. I tried opening the Certificates snap-in and pointing to the service, but when I right-click on the "...
2
votes
0
answers
1k
views
PKI user certificate credential roaming works on Windows 7, but not on XP SP3
We have implemented credential roaming for user certificates on our domain. Everything is set up per Technet in Certification Authority and Group Policy. User certificates are roaming correctly, but ...
1
vote
1
answer
175
views
SubCA certificate of trust
I have deployed a PKI infrastructure with a Stand-Alone Root CA (which will be kept off) and 4 Enterprise SubCA's which depends on this Root CA.
To make the computers trust the Root CA, I am going to ...
1
vote
1
answer
111
views
Is it possible to specify Active Directory PKI key size throuth CSR
When I request certificate from Letsencrypt, put key and fullchain.cer in nginx config - everything works fine.
The same for Active Directory is not working.
-I generate key (tried rsa 2048 or 4096 ...
1
vote
1
answer
173
views
High available PKI related questions with regards to CA/OCSP and NDES
I have some specific questions with regards a high available PKI based on ADCS.
The questions are as follows. Please see the detailed info below to get more info on the casus.
-------------------------...
1
vote
0
answers
258
views
Fedora Server 37 CA certificate store most equivalent to LocalMachine\root
Fedora Server 37 CA certificate store most equivalent to LocalMachine\root in a Windows environment?
Background notes: I have plenty of experience in the Windows area for certificate management, but ...
1
vote
0
answers
2k
views
Enabling SSL on Tomcat 9
There are a few questions I have regarding setting up SSL on Tomcat 9 as some of the things I've read have some inconsistencies and I'm also new to PKI. Ultimately, there are two things I'm trying to ...
1
vote
0
answers
104
views
How to get the issuing certificate authority from an apple push notification certificate
I want to import the Apple push notification certificate into AWS ACM. So first, I had to convert it to pem. Using openssl pkcs12, I was able to get the Certificate and the Private Key. But when ...
1
vote
1
answer
303
views
vsftp has a bug with Fedora 32 - how do I report it: 500 OOPS: SSL: cannot load RSA private key vsftpd
Just to be clear, this is as of Fedora 32, and vsftpd-3.0.3-36.fc32.x86_64 for vsftpd.
This is NOT the same problem as previously was reported here, but it has the same outward appearance and, indeed, ...
1
vote
1
answer
452
views
ADCS PKI - AIA Location when using OCSP
My question is wheter or not I still need to configure the following AIA location on my subordinate CA when I'm using OCSP:
http://SERVERFQN/DIRECTORY/<Serverdnsname>_<Caname><...
1
vote
0
answers
963
views
Optional TPM Key Attestation in AD Certificate Services
We have a range of Windows 10 computers in our estate - some with no TPM chip, some with TPM 1.2, and some with TPM 2.0.
I want to configure a certificate template to optionally perform TPM Key ...
1
vote
0
answers
643
views
SSH Gateway Pass-through Authentication
We are looking to configure a 'transparent' SSH gateway that passes authentication on to an upstream SSH server based upon the username in the SSH request. All users will be using public key ...
1
vote
0
answers
6k
views
Issue certificate to IP address in AD CS
We're trying to get a Sophos XG 210 to connect via LDAPS to an Active Directory Domain Services (AD DS) / Domain Controller (DC) server but doing so fails with the following two errors:
Device - AD ...
1
vote
1
answer
1k
views
DirectAccess and renewing SSL with new PKI?
We have deployed DirectAccess in our network for our Windows 7/10 clients which works great. The issue is, the DA server/client certificates are based on a internal PKI we are retiring; we have build ...
1
vote
0
answers
224
views
Unable to generate and import user certificate from ADCS in Chrome
We are using Certificate Based Authentication using ADCS. So in order for user to access an internal website, they need their own signed certificate.
With ADCS, the user gets their signed certificate ...
1
vote
0
answers
11k
views
java.security.KeyStoreException: TrustedCertEntry not supported
I am trying to secure my private docker registry using SSL encryption. According to this, I need to copy a .crt and .key to a /certs directory and it will work.
What I have now is a .csr, .keystore ...
1
vote
0
answers
619
views
Pulling Subject Alt Name - Apache Reverse Proxy PIV CAC Authentication
I have created an apache 2.2 reverse proxy running on red hat.
This proxy will need to accept a client certificate, pull the needed information, and pass that along to an application running locally ...
1
vote
2
answers
884
views
PKI - What is the equivalency of a Registration Authority (RA) in AD Certificate Services?
What is the equivalency of a Registration Authority (RA) in AD Certificate Services? I was reading documentation on TechNet (the best ever, jk) and it had explained that NDES was technically the ...
1
vote
0
answers
44
views
Apache: Intermediate CA on "dark network" (no internet access)
Background: Apache 2.4 (server) and Windows 7 Internet Explorer (client) using PKI; both machines are on a "dark network" (no internet access).
Question: In the SSL handshake, how does the ...
1
vote
1
answer
344
views
Configuring NGINX with a user list http header/user?
I've got an nginx config that does ssl-pki authentication - I'm happily able to authenticate my users.
However, I want to take it a bit further - I want to allow/deny access to resources based on ...
1
vote
0
answers
784
views
The remote procedure call failed during applying Remote Access Setup Wizard Settings
I have a DirectAccess server with Windows Server 2012 R2 in the DMZ and other services such as Active Directory (located on a subdomain) and the PKI infrastructure in the internal area.
And I get ...
1
vote
0
answers
162
views
iPlanet Authentication provider
Good day. I have stepped into project that requires a server migration that would change the means of authentication for our CAC/PKI SSL enabled website. We are using iPlanet 7 and Oracle Directory ...
1
vote
1
answer
477
views
Effect of native mode SCCM site server signing certificate RENEWAL on non-domain computers
We have a native mode SCCM installation on our network. For security reasons, we have two servers that are NOT domain joined, but have the native mode SCCM client installed (and functioning nominally)...
0
votes
1
answer
76
views
Reissuing AD certificate breaks Always On VPN
Reissuing AD certificate breaks Always On VPN.
We needed to update our AD CA to have a longer key length and an improved signing algorithm.
This works fine and we are able to issue new certificates ...
0
votes
0
answers
86
views
Multiple certificate chains in a single file
My company has a Windows-based PKI with a single standalone root CA and several subordinate CAs for different audiences/purposes (e.g. two subordinate CAs for user/machine auto-enrollment, an ...
0
votes
0
answers
164
views
NPS Certificate
I am changing a CA in the domain to a new one. The old CA will be deactivated.
I have an NPS server configured with the certificate of the old CA in "Network Policies -> Policy1 -> ...
0
votes
0
answers
30
views
CA template Windows
In a Windows CA, I have mistakenly removed permissions from a template and now I can't modify it.
How do I modify or delete this template to create it again?
Thanks
0
votes
0
answers
44
views
Request Certificate CA
I have a Windows server configured as a Certificate Authority (CA).
When requesting a certificate via https://server/certServ and choosing the template to request (Request Certificate->Advance ...
0
votes
1
answer
4k
views
How to force Domain Controller to get new certificate from PKI Server
I bluntly created a PKI Server (AD CS) that sits inside the Domain.
My Domain Controllers got a DomainController Certificate from it.
After that I thought that it would be better, to create a Root CA ...
0
votes
1
answer
120
views
CA: Certificate User for VPN
From a subordinate Enterprise CA I want to generate a user certificate that serves as an authentication method for VPN connections.
I want to install this certificate with autoenroll on the domain ...
0
votes
0
answers
49
views
How to integrate .Net application to ADCS using API
We have to integrate own app to MS ADCS environment for autoenrollment digital certificates. Is there any guide to integrate our app to MS Certificate Authority using API?
0
votes
0
answers
58
views
CA root and CA subordinate administrator
I want to deploy a new PKI infrastructure on a domain that has several subdomains and trusted domains.
I would like to be able to delegate the administration between several administrators ...
0
votes
1
answer
585
views
Trouble setting up CES and CEP PKI in a trusted forest scenario
I have two AD domains with a two-way forest trust. I want computer accounts in DomainB to enroll for computer client auth certificates from the two-tier Windows CA in DomainA. I configured a ...
0
votes
0
answers
31
views
2 Issuing CAs are Effected by Subnet Region
We are working to set up a 2-tier pki with 2 issuing CAs in different regions/subnets. We were able to get everything looking right on pkiview.msc. We are still having trouble though with the second ...
0
votes
0
answers
158
views
1 ICA and CRL serving 2 different domain
I have 1 ICA and 1 CRL and I would like it to serve 2 different domain in my setup. Is that possible? I'm running Windows Server 2019.
Note, I'm not able to set a trust relationship between the 2 ...
0
votes
1
answer
1k
views
Ldap service not running on Windows Server 2019
I have 2 windows server 2019. e.g. server1 and server2.
server1 is the domain controller.
server1 has below roles installed: ADDS, ADCS, DNS, FILE STORAGE, IIS.
server2 is connected to that domain ...
0
votes
0
answers
793
views
Cannot reach HTTPS page with self-signed server certificate and DoD CA certificates
I'm attempting to create a local web server using Flask, a Python microframework, that uses the PKIs on a DoD CAC.
I've created the self-signed root CA and server certificate and key following this ...
0
votes
0
answers
596
views
This computer can't connect to the remote computer. Unknown key usage (1.3.6.1.4.1.311.54.1.2)
I'm unable to RDP to a server on our child domain after adding a Remote desktop certificate that is signed by one of our Certificate authorities. We have intentionally removed the self-signed RDP ...
0
votes
0
answers
821
views
ADCS Change AIA information from existing certificate
We have built a tier 2 PKI. Recently we decided to start hosting our CDP & AIA on a seperate webserver. However this was not originally in the design, so now we have problems with the certificate ...
0
votes
0
answers
937
views
Icinga PKI Agent-Satellite-Master
According to the documentation on https://icinga.com/docs/icinga2/latest/doc/06-distributed-monitoring/, all nodes in an Icinga Monitoring need to have one CA which is on the master node. But I think, ...