1

I am attempting to use an SSL certificate to secure LDAPS on our Active Directory, following the instructions found on Microsoft website at http://support.microsoft.com/kb/321051

I am logged on as Domain Admin on the machine where the certificate is to be storted. I create the request and submit to our CA. They then return the certificate. I then import the certifcate into the Active Directory Domain Services NTDS\Personal Store. The certificate imports and is visible. However it is not possible to connect to LDAPs over SSL. Investigations show that the private key has not been associated with the certificate at import.

The Domain Controller has been restarted and this caused the following error to appear in the System Log. Event 36869 Schannel The SSL server credential's certificate does not have a private key information property attached to it. This most often occurs when a certificate is backed up incorrectly and then later restored. This message can also indicate a certificate enrollment failure.

Clearly since this is a new key there is no backup problem.

Does anyone have any idea what I can do to get the Private Key to assoiciate with the certificate. I have been right through the process twice, revoking the original certificate. I am always logged on a domain admin.

Many thanks.

Improve this question
3
  • I believe I have seen something similar before. Can you find the cert in the cert manager and see if there is a repair option?
    – Jeremy
    Oct 7, 2011 at 14:53
  • How did you create the certificate request?
    – Coding Gorilla
    Oct 7, 2011 at 14:54
  • There is no obvious repair option in the Certificates Snap In. Certificate was created using certreq -new request.inf request.req
    – RichardP
    Oct 7, 2011 at 15:04

3 Answers 3

Reset to default
1

The certificate that's returned must be used to complete the certificate request, not just imported into the store.

See step 5 in that KB:

certreq -accept certnew.cer

This should automatically place the certificate in the store, it does not need a manual import.

Additionally, it should be in the computer's personal store, not the service's store.

Improve this answer
6
  • Should have mentioned this is Server 2008 so the suggested location for the certificate is in the NTDS store, this is in an amendment at the bottom of the article. The Personal store is still valid, that said I have tried both locations with the same result.
    – RichardP
    Oct 7, 2011 at 15:06
  • @RichardP Still, you need to be -accepting the certificate to complete the request instead of just importing the certificate that you get back into a store.
    – Shane Madden
    Oct 7, 2011 at 15:08
  • Yes I did follow all the steps including that one. I subsquently imported the certificate into the NTDS Store.
    – RichardP
    Oct 7, 2011 at 15:14
  • @RichardP So, to be clear, you've got a copy of the certificate in the personal computer store with the private key, and one in the personal NTDS service store without the private key? Remove the one without a private key.
    – Shane Madden
    Oct 7, 2011 at 15:16
  • 1
    @RichardP But there were no errors when you ran certutil -accept? Huh - the private key ought to be somewhere. Check you user's store, maybe. Otherwise, I'd say clear all copies of the cert out, issue a new request, and try again - if the private key isn't on the certificate that's automatically put in the store when certutil -accept is run, there's a problem.
    – Shane Madden
    Oct 7, 2011 at 15:29
0

The certutil will place this in the machine store. You may open up both stores within a MMC and copy the cert issued to the machine store, to the ADDS serivce store so that it then has the private key with it.

Improve this answer
0

Because I did not find a solution for the problem described by RichardP and although this thread is quite old I will add my own findings: The solution - or at least part of it - seems to be to follow this specific paragraph in the aforementioned MS-Knowledgebase article literally (except for the names of the files, these don't seem to matter), I quote:

Retrieve the certificate that is issued, and then save the certificate as Certnew.cer in the same folder as the request file. To do this, follow these steps:

  • Create a new file called Certnew.cer
  • Open the file in Notepad, paste the encoded certificate into the file, and then save the file.

In short, I succeeded in importing the certificate with a associated private key by pasting the content of the certificate signed on a Linux system into a newly created file on the DC.

I did not explore what the difference between the two files is - maybe just the CRLF line terminators.

Improve this answer
1
  • Hey and welcome to the site. I improved the formatting a bit, so that quote is clearly visible.
    – kubanczyk
    Dec 4, 2019 at 20:30

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .