New answers tagged

0

Another easy way to generate a self signed certificate is to use Jexus Manager, Choose a server node in the Connections panel. In the middle panel, click Server Certificates icon to open the management page. Under Actions panel, click “Generate Self-Signed Certificate...” menu item. https://jexus.lextudio.com/en/latest/tutorials/self-signed.html


0

SBS wants to use remote.example.com for everything - and I would suggest that is what you use. If you have configured the server to use mail.example.com then you have two options. Run the configuration wizards in the SBS console to change the name to mail.example.com and get the SSL certificate reissued. Run the configuration wizards in the SBS console ...


2

Here is a one liner that should do what you want without requiring the creation of a public key file locally. $ ssh-keygen -lf /dev/stdin <<< $( ssh-keygen -f ~/.ssh/keyname.pem -y ) 2048 14:df:c7:b7:f1:26:7f:87:d5:e7:10:6c:ac:af:a2:03 /dev/stdin (RSA) This uses the bash here string <<< in order to have stdin available as a regular file ...


0

Each certificate has been issued for one or more general purposes, you can see this in the Enchanced Key Usage field, something like: Server Authentication,Client Authentication or Secure Email. There is no way to determine what the specific purpose of a certificate on a server is unless your installation process included proper documentation. There is no ...


-1

They will also likely need the public key of your token signing certificate. Instructions for exporting that can be found here: https://technet.microsoft.com/en-us/library/cc737522(v=ws.10).aspx


0

So, you have your settings correct. But by what trigger is your client verifying that the certificate is within it's renewal period (less than 6 weeks from expiry as shown above)? This is scheduled task that runs after logon and every eight hours after that. See task scheduler, Microsoft\Windows\CertificateServicesClient\UserTask. Under Action you will see ...


0

As the neither the CA nor the sever know the DNS names your clients are using to access the server there is not way you can do this automatically. You need to specify the DNS names you'll like to to use. To do so you you need to create a custom request for the servers. Create a file called requestSAN.inf with the content below [Version] ...


3

Having the root CA offline is a sound security policy, so that's a very good start. But if you want it to be entirely separate, you shouldn't first build the root CA and sub CA in the same server and then remove the root CA - instead, you should set them up separately from the start, so that you don't need to go through any extra effort to separate them. ...


0

Issuing 30K certificates a year is very low, less than an average of 5 every hour. Any CA will support this. If you are worried about work load you need to consider your revocation strategy. Questions you need to answer include: 1) Are you going to support certificate revocation? 2) Are the clients going to check it or only the servers? 3) Are you ...


1

Start with a Client authentication certificate which probably is good enough. You have two options: 1) Buy an email certificate. These are also client certificates and allow signing and are cheap. 2) Get a free server certificate from Letsencrypt. These come with the extensions below that might be good enough for your use case: X509v3 extensions: ...


0

You can use a VBS script like: Dim store Set store = CreateObject("CAPICOM.Store") WScript.Echo "Dumping local Root CAs:" store.Open , "Root", 0 ' or "My" or "CA" For Each cert In store.CERTIFICATES WScript.Echo cert.SubjectName 'WScript.Echo cert.SerialNumber WScript.Echo cert.Thumbprint WScript.Echo ...


2

You have a few issues here: Your Root CA Certificate has a pathlen in its basicConstraints - not needed and not used, but it shouldn't cause problems. You have a certificate policy on your Root CA Certificate - this would be better applied by your Root CA to the subordinate CAs. If you wanted to change policy at a latter date, or add another policy, you'd ...


5

You can open a Powershell console and use the dir command on the Cert: provider to list the information you want. For example, the commands below would list thumbprints and subjects (friendly names) for the current user certs and the machine certs respectively: dir Cert:\CurrentUser\My ls Cert:\LocalMachine\My\ You can run the command below to get more ...



Top 50 recent answers are included