Windows Server 2008 | Windows Server 2003

I want to leverage LDAPS on a linux appliance. The vendor requires the server certificate for my Windows 2008 | Windows 2003 global catalog servers so it can initiate secure calls to TCP/3269 (and perhaps TCP/636). For security purposes, they don't implicitly trust self-signed certs so I need to retrieve it from the server and pre-load the public key on the appliance.

Can someone point me to instructions for how to retrieve these server certs in Windows?

  • Are you running your own Certificate Authority? – jscott Aug 24 '12 at 0:56
  • ..and if you aren't, are you able to load multiple keys to trust? Each domain controller has a different one. – Shane Madden Aug 24 '12 at 1:34
  • @ShaneMadden I am able to load multiple keys to trust – Mike B Aug 24 '12 at 4:45

First of all, I highly recommend installing an Enterprise root CA, as alluded to in the comments, because it makes certificate management loads easier. You can even script or configure automatic certificate requests and issuance policies, in addition to having a central source for certificates.

Having said that, the procedure for retrieving a machine certificate is fairly straightforward.

Log onto the machine in question. Open the Microsoft Management Console (MMC.exe). Go to Add/Remove Snap-in.... Select Certificates, Add ->. At the pop-up dialogue, select the Computer account radio button, hit Next > and select the Local Computer radio button and hit Finish (should be selected by default).

Click OK, and expand Certificates. the one you're looking for should be under a subfolder of Personal called Certificates, and if multiple are present, should be the one with the machine name in it, of Template type Computer, assuming a default certificate deployment configuration. See the screenshot below.


| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.