Questions tagged [ad-certificate-services]

Active Directory Certificate Services is a role first made available in Windows Server 2008. Previously it was known as certificate services.

Filter by
Sorted by
Tagged with
0 votes
1 answer
23 views

Can we add a subordinate enterprise certificate authority linked to an existing enterprise Root certificate authority

The Root CA is domain joined. The Sub CA will be domain joined. The Sub CA will deliver workstation Authentification (template) to PC clients via GPO. Is there any known issue with this configuration? ...
0 votes
1 answer
163 views

Having trouble issuing the 2nd enterprise CA on the same offline Root CA as the 1st. Windows Server 2016

I am running into an issue and hoping someone can help me. We were asked to set up a new Root CA and 2 subordinate (issuing) CAs under it (the request includes using Azure and placing each VM in a ...
  • 1
0 votes
1 answer
72 views

Must all services of ADCS run under the same service account on the same server?

While deploying ADCS, on the documentation Microsoft recommends using service accounts for the services making up ADCS. The problem is that it doesn't address if these should be individually managed, ...
  • 111
0 votes
2 answers
133 views

How can I set the ACL of a CA programmatically?

When launching the CA console (certsrv.msc), I can right-click on my CA, select Properties and then I can modify the ACL of my CA in the Security tab. When I modify it, the changes are applied to the ...
0 votes
1 answer
846 views

Domain Member Servers - Accessing Certificate Revocation List (CRL)

In my environment I have a Enterprise Root CA installed on a domain controller and a separate domain controller configured as a Subordinate CA - I know this isn't recommended for security reasons but ...
  • 648
0 votes
2 answers
1k views

Windows Certificate Authority - Adding Additional Attributes

In AD Certificate Templates the templates have an option to build from AD information and includes Email, DNS, UPN, etc. When creating a CSR using powershell, openssl and the certificate mmc snap-in ...
  • 648
0 votes
1 answer
78 views

How does OCSP handle deleted certificates?

We have a Microsoft Certificate Authority running on Windows Server 2019. We are issuing certificates to Android devices via a MDM. The Android device users browse to a web application (hosted by ...
0 votes
1 answer
590 views

What controls the timing of the Windows Certificate Services event "Close to expiration" ID 1003?

I have a Windows Server which started logging this warning event 36/37 days before a certificate's expiry date and I would like to understand what controls/sets this timing and how it can be ...
  • 3
2 votes
0 answers
145 views

How to set the lifetime of a CA certificate?

I'm trying to install a subordinate CA with Microsoft ADCS and when I do, it creates a .req file. Then I use that at the root CA to issue a certificate. The resulting certificate is always for 5 years....
  • 391
0 votes
0 answers
1k views

How to configure AD Certificate Services to get past this WS_E_ENDPOINT_ACCESS_DENIED error?

I have followed the Microsoft test lab instructions for setting up a two-tier CA hierarchy. I have the Certificate Enrollment Policy Web Service (CEP) installed on the same machine as the issuing ...
  • 391
0 votes
0 answers
218 views

Warnings when starting a remote desktop connection Windows server

When I start a remote desktop connection to the server I get the following warnings when launching double click on my shortcut: The advertiser of this remote connection can NOT be identified. editor: ...
  • 101
0 votes
1 answer
276 views

CDP container in Active Directory required if not part of AD?

We have a Microsoft Active Directory Certificate Services Enterprise CA. After installing the service, an AD container is created within CN=CDP,CN=Public Key Services,CN=Services,CN=Configuration,DC=...
  • 6,848
3 votes
1 answer
2k views

Domain Controller autoenrollment - changing issuing CA

We are cleaning up our Windows PKI/CA environment and replacing our root CA with a new server. The current root CA has been issuing the following certificate templates for years now (in addition to ...
  • 32.5k
0 votes
1 answer
156 views

Target specific Enterprise CA for auto-enrollment?

We have two intermediate Enterprise CAs (Windows AD CS) in our AD domain. Both CAs only have the Certification Authority role enabled. CA1 is responsible for issuing certificates to workstations and ...
  • 6,848
0 votes
2 answers
534 views

Auto-Enrollment with manager approval, but auto-approval for re-enrollment

I have a certificate template (auto-enrolled) that must require manager approval. To achieve this, I checked the CA certificate manager approval checkbox in the Issuance Requirements tab. The ...
  • 6,848
0 votes
1 answer
534 views

This site is missing a valid, trusted certificate || Apache2 webserver, Windows root CA

I'm learning about certificates, HTTPS together and after 4 days I'm out of idea how to set up to become trusted. In my lab env. I have a Windows server with a CA role. Previously I installed a VM-...
  • 13
0 votes
1 answer
143 views

PKI trust in Active Directory

Assuming that the certificate of the ADCS CAs joined to a given domain are signed by an offline root CA which is then trusted by all systems in the domain/forest. If that offline root was then used to ...
  • 51
0 votes
1 answer
107 views

AD Certificate Services - Add a new domain?

My AD domain name is domainname.local. I have Certificate Services set up to issue certs for this domain. I now want to add domainname.com as an AD integrated zone and have Certificate Services issue ...
0 votes
1 answer
689 views

RDP and GPO setting Server Authentication certificate template (Microsoft Windows Server 2016)

We want to force Remote Desktop to use a certificate based on a particular named template rather than using a self-signed certificate. This works in forests with a Certificate Authority server, but ...
2 votes
1 answer
5k views

No certificate templates in Certificate Services server on Windows 2019

There are a lot of discussions on here about this problem, and I have spent all day exploring every one of them. All the servers involved in this are Windows 2019. 2 domain controllers and a ...
0 votes
1 answer
64 views

Unused ADCS for Server 2008 R2 Standard. What are the risks associated with removing this service?

I have inherited this system and I am looking at decommissioning this server 2008 R2 Domain Controller/ADCS Server. This role (ADCS) was never actively used by anyone. I believe, just because it was ...
0 votes
1 answer
474 views

Autorenew not working when setting up key based renewal - Cep/CES

I am trying to configure Key Based renewal using WES to support autorenwal of certificates in workgroup computers and untrusted domains. I have configured CEP (Certificate Authenticatoin, Key Based ...
0 votes
1 answer
122 views

One-way forest trust deployment for Microsoft CA

I am looking to deploy a multi-forest Microsoft CA between 2 domains (one-way trust) Domain A will be the resource forest while B will be the account forest (A trusts B but B doesn't trust A) Will ...
1 vote
1 answer
388 views

NDES AD certificate services Configuration error

While configuring NDES for my Win server 2019, i encountered the following error. Failed to add the following certificate templates to the enterprise Active Directory Certificate Services or update ...
0 votes
1 answer
498 views

Upgrading certificate template schema

I need to update one of my Active Directory Certificate Services (ADCS) certificate templates from schema v2 to v3, to support KSP providers. It seems that I can only do this by cloning the template (...
0 votes
2 answers
264 views

Any issues that I should be prepared installing a Certificate in AD? [closed]

They are asking me to install a TLS Certificate in our Active Directory to make our Meraki routers work with AD. We currently have some services that use AD users, including a database. Will there be ...
  • 3
0 votes
2 answers
178 views

Windows Certificate Templates CSP certificate with Exportable Private Key

I recently created a certificate for a developer using a certificate template. The template was based from an existing one which I believe is based on CNG.I was able to export the private key, but the ...
0 votes
1 answer
637 views

Windows AD CA Code Signing Cert Request for Wrong User

I am having an odd problem with a Code Signing certificate request from my Windows 10 workstation. We have a Windows Server 2012R2 CA setup with the Code Signing template and everything works fine if ...
  • 432
0 votes
1 answer
568 views

MMC > Certificates > Other computers: Which firewall ports used for this?

I am having a windows firewall issue when trying to access the Certificate Store from another computer on the same domain using MMC or PowerShell. I am logged in as a domain admin. Both servers are ...
  • 101
2 votes
2 answers
510 views

Should Remote Desktop use a dedicated certificate template?

Practically all instructions on enabling certificates for Remote Desktop server authentication (and configuring auto-enrollment through Group Policy) say that you should create a new certificate ...
  • 8,892
1 vote
1 answer
437 views

install additional Enterprise Subordinate CA

I have already set up a working two tier Active Directory Certificate Services PKI hierarchy with an offline standalone Root CA (ROOT-CA) and one online Enterprise Subordinate CA (ISSUING-CA). For ...
  • 23
0 votes
1 answer
482 views

Publish certificate in Active Directory not working as intended

I have an AD forest and one CA server. In the certificate template I have "Publish certificate in Active Directory" checkbox checked. Also in the template, the Subject Name option is set to &...
  • 133
2 votes
1 answer
851 views

How do I request a new certificate from a Windows 2016 Issuing CA which has an expired certificate?

We have an offline RootCA which still has a valid certificate. Our subordinate issuing CA unfortunately expired before we renewed. How does one recover from this scenario? Windows Server 2016 ...
1 vote
0 answers
88 views

Migrating Root Certificate Authority

I got thrown into the middle of a CA migration project. My co-workers are migrating a Root Certificate Authority off a 2008 R2 server and onto a new 2019 server. They have both servers running at the ...
1 vote
1 answer
2k views

Active Directory - Difference between User-Cert and X509-Cert attributes

I came across two user object attributes User-Cert (ldap name: userCert) and X509-Cert (ldap name: userCertificate) in Active Directory that sound similar, but doesn't seem so. As per documentation (...
  • 133
2 votes
1 answer
187 views

Distribute Secrets via Active Directory [Group Policy]

I would like to simplify my life and distribute secrets (real secrets, like encryption private keys) to Active Directory domain member computers. Probably via Active Directory Group Policy, but will ...
  • 337
0 votes
1 answer
384 views

LDAPS 636 Works on Domain Controllers except Azure Domain Controller

I have a Domain Controller (Server 2016) in Azure. The Azure network this system is on is connected via a Virtual network gateway (VPN) to the on-prem network and the network engineers have configured ...
0 votes
0 answers
384 views

ADCS Change AIA information from existing certificate

We have built a tier 2 PKI. Recently we decided to start hosting our CDP & AIA on a seperate webserver. However this was not originally in the design, so now we have problems with the certificate ...
2 votes
1 answer
3k views

Active Directory Certificate Services autorenew

I have an LDAP application which needs to talk to Active Directory via LDAPS (LDAP over SSL). I installed Active Directory Certificate Services on a test Domain Controller (I know this is not best ...
  • 45.1k
1 vote
1 answer
3k views

How to tell domain controllers to not enroll a "Kerberos Authentication" certificate?

As per this question, I have an environment where certificates based on the "Kerberos Authentication" template cannot be issued (there are remote sites without direct connectivity to the CA, ...
  • 69.3k
5 votes
2 answers
10k views

Error enrolling "Kerberos Authentication" certificate in a sparse network

I'm currently working on implementing an Enterprise Certification Authority for a customer whose network is not fully connected; it spans several geographical sites, and some of them don't have ...
  • 69.3k
3 votes
4 answers
6k views

Deploying in-house ACME server for Microsoft ADCS?

I'm quite new to ACME, but already somewhat experienced with ADCS (Active Directory Certificate Services). We use ADCS for all our internal needs: client auth, VPN, EFS etc., also for issuing TLS ...
1 vote
2 answers
1k views

ldaps certificate for connections using domain.local instead of fqdn

We have multiple Windows Server 2016 AD Domain Controllers and we need to replace all LDAP connections with LDAPS connections. For High Availability we would like to connect all LDAPS sessions to "...
  • 23
0 votes
0 answers
156 views

Decommission Active Directory Certificate Services server: side effects

I have a private domain to which I later added AD CS, NPS, RRAS and setup SSTP VPN access. I used AD CS to create a certificate for the SSTP connection and DynDNS to get me in from outside. ...
  • 1
0 votes
0 answers
313 views

Unable to renew Certificate on Windows 10 in domain

I'm trying to renew my computer certificates on a in domain laptop but I get "RPC Server is unavailable", error code 1722. On other laptops the same procedure works. What can I do? I've opened mmc and ...
1 vote
1 answer
474 views

Unable to Backup or Restore Certificate Authority?

I migrated Certificate Authority Enterprise from windows server 2012 R2 to Windows Server 2019. Both Server are VMs Here are the steps I took: Baskup CA database, key and registry config of the ...
  • 111
2 votes
0 answers
2k views

Automatically renew certificate: Old cert gets archived, but no new one is issued

We are using Active Directory Certificate Services (AD CS) to issue certificates for internal web applications. We can manually request a certificate from the CA and it gets issued without problems. ...
1 vote
1 answer
2k views

If I install certificate services (enterprise root ca) on a domain controller is LDAPS automatically enabled?

reading this article: https://www.petri.com/enable-secure-ldap-windows-server-2008-2012-dc The first method is the easiest: LDAPS is automatically enabled when you install an Enterprise Root CA ...
  • 4,121
2 votes
2 answers
2k views

Certificate expiration does not match validity period in template (Windows CA)

I'm trying to request a new Bitlocker DRA certificate from my internal CA. The template is set to two years, as shown here Template I'm trying to request a new certificate via the Certificates MMC ...
0 votes
2 answers
1k views

AD CS - OID for root and issuing CAs

I am willing to install a Root CA and an Issuing CA with AD CS for my private environment (test purpose). Do I need to obtain public OIDs (i.e. from IANA) or can I skip this requirement since my CAs ...
  • 171

1
2 3 4 5