Questions tagged [ad-certificate-services]

Active Directory Certificate Services is a role first made available in Windows Server 2008. Previously it was known as certificate services.

Filter by
Sorted by
Tagged with
0
votes
1answer
16 views

Target specific Enterprise CA for auto-enrollment?

We have two intermediate Enterprise CAs (Windows AD CS) in our AD domain. Both CAs only have the Certification Authority role enabled. CA1 is responsible for issuing certificates to workstations and ...
0
votes
0answers
20 views

Auto-Enrollment with manager approval, but auto-approval for re-enrollment

I have a certificate template (auto-enrolled) that must require manager approval. To achieve this, I checked the CA certificate manager approval checkbox in the Issuance Requirements tab. The ...
0
votes
1answer
110 views

This site is missing a valid, trusted certificate || Apache2 webserver, Windows root CA

I'm learning about certificates, HTTPS together and after 4 days I'm out of idea how to set up to become trusted. In my lab env. I have a Windows server with a CA role. Previously I installed a VM-...
0
votes
1answer
44 views

PKI trust in Active Directory

Assuming that the certificate of the ADCS CAs joined to a given domain are signed by an offline root CA which is then trusted by all systems in the domain/forest. If that offline root was then used to ...
0
votes
1answer
28 views

AD Certificate Services - Add a new domain?

My AD domain name is domainname.local. I have Certificate Services set up to issue certs for this domain. I now want to add domainname.com as an AD integrated zone and have Certificate Services issue ...
0
votes
0answers
25 views

Strange hex-code in Windows root certificate prevents trust in Thunderbird

We are using Windows CA for S/MIME certificates and in order for this to work with external recipients, we routinely exchange signed mails in order to establish trust or sometimes transmit our root CA ...
0
votes
0answers
62 views

Submit SPKAC with subject to standalone ADCS

Microsoft's documentation suggests that it's possible to include a subject with a SPKAC CSR - https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-wcce/f88ecd9a-26bb-4b74-a471-4c46e773f75b. ...
0
votes
1answer
320 views

RDP and GPO setting Server Authentication certificate template (Microsoft Windows Server 2016)

We want to force Remote Desktop to use a certificate based on a particular named template rather than using a self-signed certificate. This works in forests with a Certificate Authority server, but ...
1
vote
1answer
794 views

No certificate templates in Certificate Services server on Windows 2019

There are a lot of discussions on here about this problem, and I have spent all day exploring every one of them. All the servers involved in this are Windows 2019. 2 domain controllers and a ...
0
votes
1answer
45 views

Unused ADCS for Server 2008 R2 Standard. What are the risks associated with removing this service?

I have inherited this system and I am looking at decommissioning this server 2008 R2 Domain Controller/ADCS Server. This role (ADCS) was never actively used by anyone. I believe, just because it was ...
0
votes
1answer
155 views

Autorenew not working when setting up key based renewal - Cep/CES

I am trying to configure Key Based renewal using WES to support autorenwal of certificates in workgroup computers and untrusted domains. I have configured CEP (Certificate Authenticatoin, Key Based ...
0
votes
0answers
259 views

Microsoft CA Web Enrollment authentication issues

Currently i have a separate server configured for web enrollment with open trust delegation from the enterprise CA. (using kerberos only) However, when i require windows authentication for the web ...
0
votes
1answer
23 views

One-way forest trust deployment for Microsoft CA

I am looking to deploy a multi-forest Microsoft CA between 2 domains (one-way trust) Domain A will be the resource forest while B will be the account forest (A trusts B but B doesn't trust A) Will ...
1
vote
1answer
171 views

NDES AD certificate services Configuration error

While configuring NDES for my Win server 2019, i encountered the following error. Failed to add the following certificate templates to the enterprise Active Directory Certificate Services or update ...
0
votes
1answer
79 views

Upgrading certificate template schema

I need to update one of my Active Directory Certificate Services (ADCS) certificate templates from schema v2 to v3, to support KSP providers. It seems that I can only do this by cloning the template (...
0
votes
2answers
83 views

Any issues that I should be prepared installing a Certificate in AD? [closed]

They are asking me to install a TLS Certificate in our Active Directory to make our Meraki routers work with AD. We currently have some services that use AD users, including a database. Will there be ...
0
votes
2answers
99 views

Windows Certificate Templates CSP certificate with Exportable Private Key

I recently created a certificate for a developer using a certificate template. The template was based from an existing one which I believe is based on CNG.I was able to export the private key, but the ...
0
votes
1answer
243 views

Windows AD CA Code Signing Cert Request for Wrong User

I am having an odd problem with a Code Signing certificate request from my Windows 10 workstation. We have a Windows Server 2012R2 CA setup with the Code Signing template and everything works fine if ...
0
votes
1answer
276 views

MMC > Certificates > Other computers: Which firewall ports used for this?

I am having a windows firewall issue when trying to access the Certificate Store from another computer on the same domain using MMC or PowerShell. I am logged in as a domain admin. Both servers are ...
2
votes
2answers
195 views

Should Remote Desktop use a dedicated certificate template?

Practically all instructions on enabling certificates for Remote Desktop server authentication (and configuring auto-enrollment through Group Policy) say that you should create a new certificate ...
1
vote
1answer
249 views

install additional Enterprise Subordinate CA

I have already set up a working two tier Active Directory Certificate Services PKI hierarchy with an offline standalone Root CA (ROOT-CA) and one online Enterprise Subordinate CA (ISSUING-CA). For ...
0
votes
1answer
227 views

Publish certificate in Active Directory not working as intended

I have an AD forest and one CA server. In the certificate template I have "Publish certificate in Active Directory" checkbox checked. Also in the template, the Subject Name option is set to &...
1
vote
1answer
368 views

How do I request a new certificate from a Windows 2016 Issuing CA which has an expired certificate?

We have an offline RootCA which still has a valid certificate. Our subordinate issuing CA unfortunately expired before we renewed. How does one recover from this scenario? Windows Server 2016 ...
1
vote
0answers
57 views

Migrating Root Certificate Authority

I got thrown into the middle of a CA migration project. My co-workers are migrating a Root Certificate Authority off a 2008 R2 server and onto a new 2019 server. They have both servers running at the ...
0
votes
1answer
984 views

Active Directory - Difference between User-Cert and X509-Cert attributes

I came across two user object attributes User-Cert (ldap name: userCert) and X509-Cert (ldap name: userCertificate) in Active Directory that sound similar, but doesn't seem so. As per documentation (...
0
votes
1answer
109 views

Distribute Secrets via Active Directory [Group Policy]

I would like to simplify my life and distribute secrets (real secrets, like encryption private keys) to Active Directory domain member computers. Probably via Active Directory Group Policy, but will ...
0
votes
1answer
349 views

(SOLVED) Enterprise PKI and AD CS cannot download/get revocation list for offline Root CA

SOLVED: https://www.reddit.com/r/sysadmin/comments/g2js6c/enterprise_pki_and_ad_cs_cannot_downloadget/ I have two instances running Windows Server 2019: one as an offline Standalone Root CA and the ...
0
votes
1answer
160 views

LDAPS 636 Works on Domain Controllers except Azure Domain Controller

I have a Domain Controller (Server 2016) in Azure. The Azure network this system is on is connected via a Virtual network gateway (VPN) to the on-prem network and the network engineers have configured ...
0
votes
0answers
165 views

ADCS Change AIA information from existing certificate

We have built a tier 2 PKI. Recently we decided to start hosting our CDP & AIA on a seperate webserver. However this was not originally in the design, so now we have problems with the certificate ...
2
votes
1answer
2k views

Active Directory Certificate Services autorenew

I have an LDAP application which needs to talk to Active Directory via LDAPS (LDAP over SSL). I installed Active Directory Certificate Services on a test Domain Controller (I know this is not best ...
1
vote
1answer
2k views

How to tell domain controllers to not enroll a "Kerberos Authentication" certificate?

As per this question, I have an environment where certificates based on the "Kerberos Authentication" template cannot be issued (there are remote sites without direct connectivity to the CA, ...
5
votes
2answers
4k views

Error enrolling "Kerberos Authentication" certificate in a sparse network

I'm currently working on implementing an Enterprise Certification Authority for a customer whose network is not fully connected; it spans several geographical sites, and some of them don't have ...
1
vote
4answers
3k views

Deploying in-house ACME server for Microsoft ADCS?

I'm quite new to ACME, but already somewhat experienced with ADCS (Active Directory Certificate Services). We use ADCS for all our internal needs: client auth, VPN, EFS etc., also for issuing TLS ...
1
vote
2answers
643 views

ldaps certificate for connections using domain.local instead of fqdn

We have multiple Windows Server 2016 AD Domain Controllers and we need to replace all LDAP connections with LDAPS connections. For High Availability we would like to connect all LDAPS sessions to "...
0
votes
0answers
104 views

Decommission Active Directory Certificate Services server: side effects

I have a private domain to which I later added AD CS, NPS, RRAS and setup SSTP VPN access. I used AD CS to create a certificate for the SSTP connection and DynDNS to get me in from outside. ...
0
votes
0answers
56 views

Unable to renew Certificate on Windows 10 in domain

I'm trying to renew my computer certificates on a in domain laptop but I get "RPC Server is unavailable", error code 1722. On other laptops the same procedure works. What can I do? I've opened mmc and ...
1
vote
0answers
168 views

Unable to Backup or Restore Certificate Authority?

I migrated Certificate Authority Enterprise from windows server 2012 R2 to Windows Server 2019. Both Server are VMs Here are the steps I took: Baskup CA database, key and registry config of the ...
2
votes
0answers
2k views

Automatically renew certificate: Old cert gets archived, but no new one is issued

We are using Active Directory Certificate Services (AD CS) to issue certificates for internal web applications. We can manually request a certificate from the CA and it gets issued without problems. ...
1
vote
1answer
2k views

If I install certificate services (enterprise root ca) on a domain controller is LDAPS automatically enabled?

reading this article: https://www.petri.com/enable-secure-ldap-windows-server-2008-2012-dc The first method is the easiest: LDAPS is automatically enabled when you install an Enterprise Root CA ...
2
votes
2answers
804 views

Certificate expiration does not match validity period in template (Windows CA)

I'm trying to request a new Bitlocker DRA certificate from my internal CA. The template is set to two years, as shown here Template I'm trying to request a new certificate via the Certificates MMC ...
0
votes
2answers
757 views

AD CS - OID for root and issuing CAs

I am willing to install a Root CA and an Issuing CA with AD CS for my private environment (test purpose). Do I need to obtain public OIDs (i.e. from IANA) or can I skip this requirement since my CAs ...
0
votes
0answers
36 views

Certificate Enrollment fails after working all morning

Good morning, everyone. I was working on SSL cert tasks all yesterday morning without issue, and then all of the sudden I get a failure when making a new request and it looks like this: What is even ...
0
votes
1answer
127 views

Add O and OU parts in DN of a standalone CA in Windows

I have a standalone CA managed in Windows Server 2012 R2. Its certificate has a DN that includes CN and DC, as in CN=CAName,DC=domain,DC=tld. This root certificate cannot be stored in firefox, ...
2
votes
1answer
2k views

Unable to issue certificates after enabling SAN?

I have a Microsoft CA running, which does not have the SAN field enabled by default, so I have enabled it by certutil -setreg policy\EditFlags +EDITF_ATTRIBUTESUBJECTALTNAME2 Before doing so, ...
1
vote
1answer
2k views

Error installing Active Directory Certificate Services

I'm trying to install Active Directory Certificate Services on a Windows Server 2016 Standard Core VM where I logged in with the Administrator account. I ran the following Powershell cmdlet: ps> ...
0
votes
1answer
62 views

Can You Remove DC Role Without Impacting Certificate Services?

I am working on a project where we need to upgrade the OS on all our servers from 2008r2 to either 2012r2 or 2016. We have an older Domain Controller that is also running certificate services on ...
1
vote
0answers
215 views

AD CS Auto Enrollment Multiple Templates

I've recently setup AD Certificate Services and it seems to be working okay although I can't say I'm familiar with every aspect of this. I can setup auto-enrollment and this works but I think I ...
0
votes
1answer
1k views

Submit unsigned pkcs10 to windows certificate authority

Is it possible to make a Windows Server Certificate Authority accept a PKCS10 certificate request that is unsigned? I get the following error Error Verifying Request Signature or Signing Certificate ...
0
votes
1answer
122 views

Configure how long requests are displayed in CertSrv web enrollment

I have a Win2008R2 enterprise CA in ADCS and the certificate template is set to ask CA administrator to issue or deny the request. By default, when the user submits the requests through web enrollment,...
1
vote
1answer
12k views

ERR_CERT_COMMON_NAME_INVALID with internal AD CA wildcard

I have created an internal ADCS CA using this guide, and then submitted a certificate request to create a wild card certificate for my domain eds89.com. Intention behind this being to apply to some of ...

1
2 3 4 5