Tag Info

Hot answers tagged

7

Concise answer The issue CRL is not yet valid for indicates that the time between the Puppet-agent and the Puppetmaster is out of sync. Remove the certificate from the Puppet-agent and Puppetmaster as well and run Puppet on the agent. Comprehensive answer CRL is not yet valid for resides in the following snippet. The following test code snippet ...


3

SSL vendors will not sell you a certificate for PayPal.com. The entire point of Certification Authorities is to have organizations in charge of validating that you control the domain in question. The linked question involves two different SSL certificates but both for example.com. Both certificates would require the person requesting them to demonstrate ...


3

1) certificate renewal will be triggered at the timespan specified in the certificate template prior to certificate expiration. If fails, autoenrollment client will attempt to renew certificate periodically. in a given example, autoenrollment will make first attempt to renew certificate 6 weeks prior to certificate expiration. 2) In order to renew ...


2

DA machines, by definition, are connected to the domain. They get their GPOs and all other things exactly as if they were on-site. As long as you have automatic renewal with a percentage period long enough that people won't get locked out (longer than a weekend or planned company downtime), you should be good. Here's a screenshot of the relevant GPO ...


1

One thing to understand: ADCS is forest-wide service. That is, once Enterprise CA is installed, it is registered in Active Direcotry, configuration naming context. As you may know (at least, should know) that configuration naming context is replicated between all domain controllers in the forest. Recently we had a similar discussion on TechNet forums, where ...


1

So there will be two offline roots, one dedicated to each child domain? Given the access restrictions you want, it seems like it'd make more sense to have the offline roots be in the child domains - since they're offline anyway, it's not like you're losing any security from it. Presumably with an offline root, they'll be standalone and not enterprise, so ...


1

Looks at first glance as a NAT issue with the FTP protocol helper failing because of the TLS encryption and I would expect that to become a firewall problem as well. Some background here in an older answer of mine. The solution is probably to fix the passive TCP port range that FTP over SSL can use, have the FTP server advertise the external IP-address ...


1

When Wildcard SSL certificate is issued for *.domain.com, you can secure your unlimited number of sub domains over the main domain. For example: sub1.domain.com sub2.domain.com sub3.domain.com sub*.domain.com If the Wildcard SSL certificate is issued on *.sub1.domain.com, in that case you can secure all second level subdomains which are listed under the ...



Only top voted, non community-wiki answers of a minimum length are eligible