Linux Certification Authority signing Windows 2003 Server certificate requests

Question

I've had some success using a Windows 2003 Server running as a Certification Authority signing certificates used in secure communications between Ubuntu Linux and Active Directory on Windows 2003 Server.

Now, I've set up a Linux CA using openssl and I have created a Windows 2003 request using certreq and signed the certificate and passed the CA public key and signed certificate back to Windows 2003. Everything looks OK in the certificates snap-in but I can't get secure communications to work now between Linux and Windows (using openssl s_client).

Can I use certreq to create requests for openssl? In my researchI've seen details on installing openssl on Windows to make the request (I may not be able to do this if this gets to production.)

Does anyone have a lab set-up and have the config file for the linux CA I could have a look a look at please?

Answer 1

Found my answer in the instructions for Fedora directory services and LDAP.

The important part was Server Certificate Settings MUST allow for the use of "Subject alternative name" (subjectAltName) of type IP Address. This is an AD requirement.

(To get this option, you may need to go to Preferences -> OpenSSLConfiguration, click on the Server Certificate Settings, and change Subject alternative name from Copy Email to ask). I also noticed on the Windows side I did not need a password importing the pkcs#12 certificate.