New answers tagged


TechNet lists the ports required for Active Directory Certificate Services as: From CA Web Services to Domain Controllers on 464 for Kerberos From CA Web Services to Domain Controllers on 389 and 636 for LDAP From all XP clients to Certificate Authority on random above 1023 for DCOM/RPC From all clients to Certificate Authority on 443 for HTTPS


I would not agree that it is common to disable this. A better way to phrase it would be to ask why someone would disable it. And a better solution for your problem would be for the installer to check for the root/intermediate CA certificates and install them if not present. The Trusted Root CA program is essential. A TON of applications would just not ...


In late 2012 / early 2013 there was an issue with automatic root certificate updates. The interim fix was to disable the automatic updates, so partly this issue is historical. The other cause is the Trusted Root Certificate program and Root Certificate Distribution, which (to paraphrase Microsoft)... Root certificates are updated on Windows ...


The Automatic Root Certificates Update component is designed to automatically check the list of trusted authorities on the Microsoft Windows Update Web site. Specifically, there is a list of trusted root certification authorities (CAs) stored on the local computer. When an application is presented with a certificate issued by a CA, it will check the local ...


I don't have a test system at the moment but a Google search produced this article. Windows PKI Blog - What is a strong key protection in Windows? Near the bottom it states: So how can you find out if a key associated with some certificate has strong key protection enabled? One way would be to use certutil.exe -store command that performs a key ...


Found this page after experiencing the same problem. For us the solution was to add port 3389 to loopback (aka Hairpin NAT) on our firewall. Some additional detail: Replacing the certificate was trickier than installing it the first time, but I think we did it correctly, and apps worked fine for a day or two. Users started getting errors on launch, and ...


Note: The mentioned link no longer appears to be there. OpenSSH, by default, uses passwords/passphrases, and public/private keys for authenticating clients, not the X.509 certificates that SSL/TLS uses. And OCSP is a protocol for checking the status of certificates, not keys. Thus the short answer is "No, there is no way to get ...


In the certificate template editor (certtmpl.msc), switch to Subject tab and select Full distinguished name in the Subject Name Format dropdown list: this will include full Active Directory DN for the specified client account.


I'd suggest leveraging python-hpilo. (for reals)

Top 50 recent answers are included