Questions tagged [ad-certificate-services]
Active Directory Certificate Services is a role first made available in Windows Server 2008. Previously it was known as certificate services.
246
questions
0
votes
1
answer
26
views
Active Directory Certificate Services (ADCS) Template 3DES?
I am seeking clarification from anyone who is familiar with ADCS.
In reviewing the AD Object details, I am trying to understand why I am seeing 3DES in the application policy section of the ...
0
votes
0
answers
21
views
Windows Certification Authority Autoenrollment when Issuance Requirements is set
I have domain computers CA template which autoenrolls to machines without issues
I activated Issuance Requirements
I can automatically renew existing certificates, but cannot automatically/manyally ...
- 115
1
vote
0
answers
51
views
Windows CA Publishing Expired Certs in CRL When not configured to do so
I have a Windows ADDS CA that for some reason is publishing revoked but expired certificates in the CRL and I can't for the life of me figure out why. Here is my configuration:
Server 2012 R2
...
- 13
0
votes
1
answer
50
views
Microsoft Certificate Authority Machine Template - add single label host name to SAN
I would like to create a machine certificate template on a Microsoft Certificate Authority that includes the single label Active Directory (AD) Computer Names in the SAN.
I have tens of thousands of ...
- 1
0
votes
1
answer
82
views
Implementing PKI on an Active Directory domain
I would like to implement a two-tier PKI in a relatively small Windows environment: about 35 users and five virtual servers. Although I have little experience with Linux, I am trying to use XCA on a ...
0
votes
0
answers
38
views
Export pfx certificate after approving pending request
In Active Directory Certificate Authority I have template with CA certificate manager approval.
CA picture
When I approve a request I can not export issued certificates to pfx format. How can I export ...
- 1
0
votes
1
answer
58
views
CA: Certificate User for VPN
From a subordinate Enterprise CA I want to generate a user certificate that serves as an authentication method for VPN connections.
I want to install this certificate with autoenroll on the domain ...
- 29
0
votes
0
answers
150
views
Migrating a CA to a new server - CA services won't start
We have an Enterprise Root CA running on Server 2012 R2. I built a replacement server running Server 2019 and followed the steps in the below article, I backed up the CA and relevant registry keys, ...
- 1
0
votes
1
answer
493
views
LDAPS certificate isn't working on new server for third parties
About 5-6 years ago I setup LDAPS on my Primary Domain controller. I setup Active Directory Certificate Services (all on the same server), forwarded the port 636 on my firewall, and was able to ...
- 634
1
vote
1
answer
104
views
SubCA certificate of trust
I have deployed a PKI infrastructure with a Stand-Alone Root CA (which will be kept off) and 4 Enterprise SubCA's which depends on this Root CA.
To make the computers trust the Root CA, I am going to ...
- 29
0
votes
1
answer
899
views
Creating a new root certificate with new key length on windows ad certificate services
Due to new corporate guidelines I need to update the root certificate of my CA so the key length is 4096bits (Currently 2048bits).
My CA is AD integrated and currently running on our DC.
So now I am ...
0
votes
0
answers
101
views
How to submit certificate request from Red Hat machine to Windows CA?
I’m looking for solution, which helps me send certificate request from domain-joined RedHat Enterprise Linux machine to Certification Authority on Windows Sever 2022. Is there any solution to do this? ...
- 9
0
votes
2
answers
122
views
Change certificate issuer
Is it possible to change the "issuer" value in a CA so that when a new certificate is issued, the new "issuer" value appears?
In the case of having several SubCa, is it possible to ...
- 29
0
votes
1
answer
164
views
Windows Server 2019 ADCS. CA subordinate
I have a "CA1" server with Windows 2019 that has the CA root Enterprise service. Additionally I have another server "CA-Subordinate" with Windows 2019 with the CA subordinate ...
- 29
0
votes
2
answers
159
views
With multiple RDP certificates, do all get checked?
If a Windows host has multiple RDP certificates. Do all get checked while connecting or only the first found?
I have a RDP certificates deployed from an Root CA with now invalid OCSP location in the ...
- 83
0
votes
1
answer
446
views
Trouble setting up CES and CEP PKI in a trusted forest scenario
I have two AD domains with a two-way forest trust. I want computer accounts in DomainB to enroll for computer client auth certificates from the two-tier Windows CA in DomainA. I configured a ...
- 1
0
votes
1
answer
246
views
Can we add a subordinate enterprise certificate authority linked to an existing enterprise Root certificate authority
The Root CA is domain joined.
The Sub CA will be domain joined.
The Sub CA will deliver workstation Authentification (template) to PC clients via GPO.
Is there any known issue with this configuration?
...
- 3
0
votes
1
answer
952
views
Having trouble issuing the 2nd enterprise CA on the same offline Root CA as the 1st. Windows Server 2016
I am running into an issue and hoping someone can help me. We were asked to set up a new Root CA and 2 subordinate (issuing) CAs under it (the request includes using Azure and placing each VM in a ...
- 1
0
votes
1
answer
246
views
Must all services of ADCS run under the same service account on the same server?
While deploying ADCS, on the documentation Microsoft recommends using service accounts for the services making up ADCS. The problem is that it doesn't address if these should be individually managed, ...
- 133
0
votes
2
answers
336
views
How can I set the ACL of a CA programmatically?
When launching the CA console (certsrv.msc), I can right-click on my CA, select Properties and then I can modify the ACL of my CA in the Security tab. When I modify it, the changes are applied to the ...
- 636
0
votes
1
answer
3k
views
Domain Member Servers - Accessing Certificate Revocation List (CRL)
In my environment I have a Enterprise Root CA installed on a domain controller and a separate domain controller configured as a Subordinate CA - I know this isn't recommended for security reasons but ...
- 688
0
votes
2
answers
3k
views
Windows Certificate Authority - Adding Additional Attributes
In AD Certificate Templates the templates have an option to build from AD information and includes Email, DNS, UPN, etc.
When creating a CSR using powershell, openssl and the certificate mmc snap-in ...
- 688
0
votes
1
answer
187
views
How does OCSP handle deleted certificates?
We have a Microsoft Certificate Authority running on Windows Server 2019. We are issuing certificates to Android devices via a MDM. The Android device users browse to a web application (hosted by ...
0
votes
1
answer
1k
views
What controls the timing of the Windows Certificate Services event "Close to expiration" ID 1003?
I have a Windows Server which started logging this warning event 36/37 days before a certificate's expiry date and I would like to understand what controls/sets this timing and how it can be ...
- 3
2
votes
1
answer
364
views
How to set the lifetime of a CA certificate?
I'm trying to install a subordinate CA with Microsoft ADCS and when I do, it creates a .req file. Then I use that at the root CA to issue a certificate. The resulting certificate is always for 5 years....
- 405
0
votes
0
answers
3k
views
How to configure AD Certificate Services to get past this WS_E_ENDPOINT_ACCESS_DENIED error?
I have followed the Microsoft test lab instructions for setting up a two-tier CA hierarchy. I have the Certificate Enrollment Policy Web Service (CEP) installed on the same machine as the issuing ...
- 405
0
votes
1
answer
574
views
CDP container in Active Directory required if not part of AD?
We have a Microsoft Active Directory Certificate Services Enterprise CA.
After installing the service, an AD container is created within CN=CDP,CN=Public Key Services,CN=Services,CN=Configuration,DC=...
- 6,990
3
votes
1
answer
4k
views
Domain Controller autoenrollment - changing issuing CA
We are cleaning up our Windows PKI/CA environment and replacing our root CA with a new server. The current root CA has been issuing the following certificate templates for years now (in addition to ...
- 32.7k
0
votes
1
answer
536
views
Target specific Enterprise CA for auto-enrollment?
We have two intermediate Enterprise CAs (Windows AD CS) in our AD domain. Both CAs only have the Certification Authority role enabled.
CA1 is responsible for issuing certificates to workstations and ...
- 6,990
0
votes
2
answers
1k
views
Auto-Enrollment with manager approval, but auto-approval for re-enrollment
I have a certificate template (auto-enrolled) that must require manager approval.
To achieve this, I checked the CA certificate manager approval checkbox in the Issuance Requirements tab.
The ...
- 6,990
0
votes
1
answer
1k
views
This site is missing a valid, trusted certificate || Apache2 webserver, Windows root CA
I'm learning about certificates, HTTPS together and after 4 days I'm out of idea how to set up to become trusted. In my lab env. I have a Windows server with a CA role.
Previously I installed a VM-...
- 23
0
votes
1
answer
414
views
PKI trust in Active Directory
Assuming that the certificate of the ADCS CAs joined to a given domain are signed by an offline root CA which is then trusted by all systems in the domain/forest. If that offline root was then used to ...
- 51
0
votes
1
answer
340
views
AD Certificate Services - Add a new domain?
My AD domain name is domainname.local. I have Certificate Services set up to issue certs for this domain.
I now want to add domainname.com as an AD integrated zone and have Certificate Services issue ...
0
votes
1
answer
1k
views
RDP and GPO setting Server Authentication certificate template (Microsoft Windows Server 2016)
We want to force Remote Desktop to use a certificate based on a particular named template rather than using a self-signed certificate. This works in forests with a Certificate Authority server, but ...
3
votes
2
answers
13k
views
No certificate templates in Certificate Services server on Windows 2019
There are a lot of discussions on here about this problem, and I have spent all day exploring every one of them. All the servers involved in this are Windows 2019. 2 domain controllers and a ...
- 133
0
votes
1
answer
77
views
Unused ADCS for Server 2008 R2 Standard. What are the risks associated with removing this service?
I have inherited this system and I am looking at decommissioning this server 2008 R2 Domain Controller/ADCS Server. This role (ADCS) was never actively used by anyone. I believe, just because it was ...
- 5
0
votes
1
answer
770
views
Autorenew not working when setting up key based renewal - Cep/CES
I am trying to configure Key Based renewal using WES to support autorenwal of certificates in workgroup computers and untrusted domains.
I have configured CEP (Certificate Authenticatoin, Key Based ...
- 85
0
votes
1
answer
241
views
One-way forest trust deployment for Microsoft CA
I am looking to deploy a multi-forest Microsoft CA between 2 domains (one-way trust)
Domain A will be the resource forest while B will be the account forest (A trusts B but B doesn't trust A)
Will ...
- 15
1
vote
1
answer
688
views
NDES AD certificate services Configuration error
While configuring NDES for my Win server 2019, i encountered the following error.
Failed to add the following certificate templates to the enterprise Active Directory Certificate Services or update ...
- 15
0
votes
1
answer
1k
views
Upgrading certificate template schema
I need to update one of my Active Directory Certificate Services (ADCS) certificate templates from schema v2 to v3, to support KSP providers. It seems that I can only do this by cloning the template (...
- 890
0
votes
2
answers
580
views
Any issues that I should be prepared installing a Certificate in AD? [closed]
They are asking me to install a TLS Certificate in our Active Directory to make our Meraki routers work with AD. We currently have some services that use AD users, including a database. Will there be ...
- 3
0
votes
2
answers
362
views
Windows Certificate Templates CSP certificate with Exportable Private Key
I recently created a certificate for a developer using a certificate template. The template was based from an existing one which I believe is based on CNG.I was able to export the private key, but the ...
- 605
0
votes
1
answer
1k
views
Windows AD CA Code Signing Cert Request for Wrong User
I am having an odd problem with a Code Signing certificate request from my Windows 10 workstation. We have a Windows Server 2012R2 CA setup with the Code Signing template and everything works fine if ...
- 444
0
votes
1
answer
852
views
MMC > Certificates > Other computers: Which firewall ports used for this?
I am having a windows firewall issue when trying to access the Certificate Store from another computer on the same domain using MMC or PowerShell. I am logged in as a domain admin. Both servers are ...
- 101
2
votes
2
answers
834
views
Should Remote Desktop use a dedicated certificate template?
Practically all instructions on enabling certificates for Remote Desktop server authentication (and configuring auto-enrollment through Group Policy) say that you should create a new certificate ...
- 10.6k
1
vote
1
answer
721
views
install additional Enterprise Subordinate CA
I have already set up a working two tier Active Directory Certificate Services PKI hierarchy with an offline standalone Root CA (ROOT-CA) and one online Enterprise Subordinate CA (ISSUING-CA). For ...
- 23
0
votes
1
answer
940
views
Publish certificate in Active Directory not working as intended
I have an AD forest and one CA server. In the certificate template I have "Publish certificate in Active Directory" checkbox checked.
Also in the template, the Subject Name option is set to &...
- 133
2
votes
1
answer
1k
views
How do I request a new certificate from a Windows 2016 Issuing CA which has an expired certificate?
We have an offline RootCA which still has a valid certificate. Our subordinate issuing CA unfortunately expired before we renewed. How does one recover from this scenario? Windows Server 2016 ...
- 141
1
vote
0
answers
106
views
Migrating Root Certificate Authority
I got thrown into the middle of a CA migration project. My co-workers are migrating a Root Certificate Authority off a 2008 R2 server and onto a new 2019 server. They have both servers running at the ...
- 11
1
vote
1
answer
2k
views
Active Directory - Difference between User-Cert and X509-Cert attributes
I came across two user object attributes User-Cert (ldap name: userCert) and X509-Cert (ldap name: userCertificate) in Active Directory that sound similar, but doesn't seem so.
As per documentation (...
- 133