So we are a mid-size enterprise refreshing our Microsoft PKI and looking to leverage it heavily across ther org for many things. ie Server to Server/Workstation encryption, Wireless TLS Encryption/Authentication ( Aruba ), Internal SSL Web Services, Domain Controller SLDAP from Server and Client Apps, etc...
We are 50/50 MAC-Windows on the client side and 70/30 CentOS/Windows server side.
Deploying a 3 tier MS PKI with an Offline Root using the MS RSA Software Provider:Signature Algorithm: RSASSA-PSS -Signature hash Algorithm: sha256
Well MAC OS X Mavericks and up won't play nice with the SSL certs issued, Oracle JDK 8 SSL Lib won't support and we need to provide an alternate library, Aruba Clearpass looks to possible have issues. New versions of firefox are balking.
Anyway, Has anyone gone through this recently and have any advice to offer. Getting on call with MS to get some advisory info and we have a ticket open with Apple.
Open for recommendations.