Public Key Infrastructure is a cryptography system based on X.509 digital certificates, commonly used for encrypted communication and authentication.

learn more… | top users | synonyms

0
votes
2answers
16 views

PKI - What is the equivalency of a Registration Authority (RA) in AD Certificate Services?

What is the equivalency of a Registration Authority (RA) in AD Certificate Services? I was reading documentation on TechNet (the best ever, jk) and it had explained that NDES was technically the ...
2
votes
1answer
63 views

Microsoft Certificate Authority Provider Compatibilty

So we are a mid-size enterprise refreshing our Microsoft PKI and looking to leverage it heavily across ther org for many things. ie Server to Server/Workstation encryption, Wireless TLS Encryption/...
1
vote
1answer
39 views

Configuring NGINX with a user list http header/user?

I've got an nginx config that does ssl-pki authentication - I'm happily able to authenticate my users. However, I want to take it a bit further - I want to allow/deny access to resources based on ...
1
vote
1answer
736 views

ADCS - How can I diagnose the exact reason a certificate request was denied by a policy module?

I need to develop operational procedures to audit and understand why a specific request was rejected by an Active Directory Certificate Services (ADCS) Policy Module. I've attempted turning on all ...
1
vote
1answer
296 views

Decom old CA and Basic EFS certificates

Getting very close to decommissioning our old CA. The new CA is in place and happily issuing certificates and the old CA has had all the templates removed so no certificates will be issued. My ...
1
vote
1answer
349 views

Effect of native mode SCCM site server signing certificate RENEWAL on non-domain computers

We have a native mode SCCM installation on our network. For security reasons, we have two servers that are NOT domain joined, but have the native mode SCCM client installed (and functioning nominally)...
0
votes
1answer
27 views

PKI SHA1 Upgrade - Thumbprint Algorithm Explanation

PKI SHA1 Upgrade - What is the difference between the Signature Algorithm and the Thumbprint Algorithm?
0
votes
1answer
290 views

CSR: Extract PKCS#10 contained in a PKCS#7

Hi eveyone: let's see if someone can help me ;) I'm quite noob at this field so please be gentle. At my job someone passed me a CSR. This CSR is a PKCS#10 request enveloped in a PKC#7 request. My task ...
0
votes
1answer
1k views

How to create a proxy certificate?

I have created an ssl-based server that I need to now create a proxy certificate for. (the second part of the school project). I have found these lines on the OpenSSL Project: openssl req -new -...
3
votes
0answers
387 views

Windows Sub CA not issuing certificates

I set up a fresh 2-tier PKI to try and replace an old broken PKI with a CA that was no longer available. Everything seems to be working between the offline root and online issuing CAs, but now I'm ...
2
votes
0answers
129 views

How does one create a certificate request for a managed service account in Windows?

I have a managed service account which needs a certificate in its personal store for decryption. I tried opening the Certificates snap-in and pointing to the service, but when I right-click on the "...
2
votes
0answers
45 views

Creating a CA signing chain when there wasn't one before

Here is the problem... 3 years ago we created a multi-datacenter setup, with as little cross-DC resource dependencies as we could make. Different AD sites. Different puppetmasters. Different syslog ...
2
votes
0answers
745 views

PKI user certificate credential roaming works on Windows 7, but not on XP SP3

We have implemented credential roaming for user certificates on our domain. Everything is set up per Technet in Certification Authority and Group Policy. User certificates are roaming correctly, but ...
1
vote
0answers
14 views

Apache: Intermediate CA on “dark network” (no internet access)

Background: Apache 2.4 (server) and Windows 7 Internet Explorer (client) using PKI; both machines are on a "dark network" (no internet access). Question: In the SSL handshake, how does the client ...
1
vote
0answers
83 views

pki linux auto enrollment

I have a Windows Offline Root CA. I'm looking for a tool which I can install on my secondary CA to import there a certificate from my ROOT CA and to enable certificates auto-enrollment for non Windows ...
1
vote
0answers
156 views

The remote procedure call failed during applying Remote Access Setup Wizard Settings

I have a DirectAccess server with Windows Server 2012 R2 in the DMZ and other services such as Active Directory (located on a subdomain) and the PKI infrastructure in the internal area. And I get ...
1
vote
0answers
597 views

Linux client for pki certificate auto enrollment from Windows CA

I just set up a Windows Server Certificate Authority. I would like to auto-enroll Ubuntu Linux computers for certificates. Can anyone share the available client options? I found this (old) technet ...
1
vote
0answers
135 views

iPlanet Authentication provider

Good day. I have stepped into project that requires a server migration that would change the means of authentication for our CAC/PKI SSL enabled website. We are using iPlanet 7 and Oracle Directory ...
0
votes
0answers
24 views

Capture and forward extended PKI cert attributes (e.g. UPN) using haproxy

I'm trying to pull an attribute from a client certificate in a mutual authentication scenario and set it as a HTTP header in the request to backend. See fig 1 below. fig1 [user with correct ...
0
votes
0answers
22 views

Invalid CRL distribution points in certs after CA migration

I have recently migrated an Enterprise CA from a Windows Server 2003 box to a Windows Server 2012 R2 box using the Active Directory Certificate Services Migration Guide. The CA was running entirely ...
0
votes
0answers
38 views

SHA1 Migration to SHA2 - ADCS Windows 2012 R2

I am a little new to AD CS and I was tasked with upgrading our entire PKI infrastructure from SHA1 to SHA256 for the SHA1 deprecation. I have read somewhere that SHA256 can read SHA1 hashes. This ...
0
votes
0answers
103 views

TLS 1.2 client hello triggers TCP Reset from 2012 R2

Struggling with a PKI implementation in my lab (ADCS 2012 R2) and cannot for the life of me figure out where I have gone wrong. Got all the way to the point of being able to generate SSL/TLS certs ...
0
votes
0answers
18 views

Installing Certificate Enrollment Web Service and Certificate Enrollment Policy Web Service on same computer

I am referencing this MS Technet document: Setting Up Certificate Enrollment Web Services The environment is Windows Server 2008 R2. I am planning for a Certificate Enrollment Web Service and the ...
0
votes
0answers
40 views

How to disable Microsoft CA version extension in a Standalone Root CA?

I was looking for a way to exclude CA version from the ca extensions, but found nothing. We use Windows Server 2012 and it is needed for a Standalone root ca. Is there any way?
0
votes
0answers
29 views

dogtag CRL profile

I am attempting to add a CRL Distribution Point to a Dogtag CA Certificate Profile. Using the caServerCert profile as a template, I copied it to a profile named serverCertTest and added the following ...
0
votes
0answers
82 views

URL retrieval tool AIA Certs “Wrong Issuer” after renewal

I performed a certificate renewal and for some reason this tool is indicating that it has wrong issuer. when I click on certs from AIA it says wrong issuer Any help will be grateful, i don't have any ...
0
votes
0answers
123 views

How to purge roaming credentials from AD user objects?

Background Due to low-budget constraints we are using roaming credentials instead of smart cards in our environment. Problem Now we have recognized that the relevant AD user attributes became ...
0
votes
0answers
28 views

“Manual User Signing & Encryption Certificates Enrollment” profile in Dogtag CA doesn't work with fresh installation

After Dogtag 10 installation (step by step by video tutorial) when I try to submit request "Manual User Signing & Encryption Certificates Enrollment"(3rd option) to CA by CA end-entity(end user ...
0
votes
0answers
172 views

IPA Server installation: Error with port number

When I am trying to install IPA server, I am getting the following error : IPA requires port 8443 for PKI but it is currently in use. Aborting installation I checked with netstat -tuplen | grep ...
0
votes
0answers
40 views

Apache2 + Mod_SSL user management

I'm currently playing around with PKI auth on my Apache2 server and I was just wondering if there is a quick/easy way to add/remove users from the SSLRequire line? Right now I have something like ...
0
votes
0answers
1k views

Can't seem to get Apache SSL client certificate authentication working with an intermediate CA

I'm restructuring my personal CA system and trying to add an intermediate CA into the mix. I have a self-signed root CA whose certificate is imported into all appropriate browsers/OSes. I seem to be ...
0
votes
0answers
255 views

PKI and Direct Access UAG

I have a two tier PKI infrastructure with an offline root CA and two Enterprise Intermediate Certification Authorities setup to auto enroll certificates. I have setup auto enrollment in default ...