Questions tagged [ad-certificate-services]

Active Directory Certificate Services is a role first made available in Windows Server 2008. Previously it was known as certificate services.

Filter by
Sorted by
Tagged with
0
votes
0answers
11 views

how to automate cert creation/renewal on ADCS using Powershell

We've have an internal CA implemented using ADCS. We use to create certificates using its web URL. Now we need to automate this process of creating certificates using powershell. I could generate the ...
0
votes
0answers
16 views

Find out where AD CS is used

We are currently in the process of migrating from Win 2008 SBS to Server 2016. Win 2008 SBS has the Active Director Certificate Service role installed. When we look at the issued certificates we see ...
0
votes
0answers
25 views

Windows Certificate Authority Change Certificate to Commercial with different Domain Name

What must be done to convert a self-signed Windows Enterprise Root Certificate Authority (CA) on a domain with private DNS name (abc.local) to using commercical Certificate with a publicly registered ...
0
votes
0answers
36 views

SMS Encryption Certificate and SMS signing certificate on Windows server

In the recent vulnerability reports, we have found two self-signed certificates. As those aren't trusted, can we replace them with other certificates? If so, do we need two different certs? Also, what ...
1
vote
1answer
107 views

If I install certificate services (enterprise root ca) on a domain controller is LDAPS automatically enabled?

reading this article: https://www.petri.com/enable-secure-ldap-windows-server-2008-2012-dc The first method is the easiest: LDAPS is automatically enabled when you install an Enterprise Root CA ...
1
vote
1answer
39 views

Certificate expiration does not match validity period in template (Windows CA)

I'm trying to request a new Bitlocker DRA certificate from my internal CA. The template is set to two years, as shown here Template I'm trying to request a new certificate via the Certificates MMC ...
0
votes
0answers
32 views

EAPTLS in UNIFI not working

I'm trying to do certificate-based authentication for android with Unifi. I've set up the CA server in Windows Server 2012, configured the template, added it to mmc, also configured UniFi (I guess so)....
0
votes
2answers
82 views

AD CS - OID for root and issuing CAs

I am willing to install a Root CA and an Issuing CA with AD CS for my private environment (test purpose). Do I need to obtain public OIDs (i.e. from IANA) or can I skip this requirement since my CAs ...
0
votes
0answers
27 views

Certificate Enrollment fails after working all morning

Good morning, everyone. I was working on SSL cert tasks all yesterday morning without issue, and then all of the sudden I get a failure when making a new request and it looks like this: What is even ...
0
votes
0answers
210 views

Active Directory Certificate Services ERROR_LOGON_FAILURE

I have found in event log following entries (event id 66): Active Directory Certificate Services could not publish a Base CRL for key 1 to the following location: file://\pki.my.lan/pki/Root CA(1)....
0
votes
0answers
50 views

CertSrv 401 Loop

Using domain admin credentials, I'm unable to authenticate into my PDC's CertSrv application: http://localhost/certsrv I'm caught in a 401 loop. I've tried this proposed solution: Open IIS Manager ...
0
votes
0answers
54 views

ADCS Network Device 802.1x EAP-TLS

I have a working solution but there's a number of things that I'm little uncertain about and I'm trying to ensure I'm following best practice. Specifically I'm setting up IP CCTV cameras to ...
0
votes
1answer
43 views

Add O and OU parts in DN of a standalone CA in Windows

I have a standalone CA managed in Windows Server 2012 R2. Its certificate has a DN that includes CN and DC, as in CN=CAName,DC=domain,DC=tld. This root certificate cannot be stored in firefox, ...
0
votes
0answers
210 views

New Windows Server 2016 PKI environment; PKIVIEW.MSC CDP location empty

I have installed a two tier PKI environment on server 2016 in parallel to our existing 2008 certificate servers following this https://timothygruber.com/pki/deploy-a-pki-on-windows-server-2016-part-1/...
0
votes
0answers
23 views

Seeing EFS certificates in Active Directory CA server but not using EFS or Bitlocker

We're planning an AD upgrade and reviewing what's doing what and where and why and on the server running the CA role, we see a number of basic EFS certificates handed out with current dates. We see ...
0
votes
0answers
25 views

Wifi authentication with NPS while I'm adding a new computer in domain

I would like to use Machine certificate for Wifi WPA-Enterprise authentication of my company. For new PCs I need another method, just for domain admins to add PCs to domain, with their username and ...
2
votes
1answer
161 views

Unable to issue certificates after enabling SAN?

I have a Microsoft CA running, which does not have the SAN field enabled by default, so I have enabled it by certutil -setreg policy\EditFlags +EDITF_ATTRIBUTESUBJECTALTNAME2 Before doing so, ...
0
votes
1answer
398 views

Error installing Active Directory Certificate Services

I'm trying to install Active Directory Certificate Services on a Windows Server 2016 Standard Core VM where I logged in with the Administrator account. I ran the following Powershell cmdlet: ps> ...
0
votes
1answer
34 views

Can You Remove DC Role Without Impacting Certificate Services?

I am working on a project where we need to upgrade the OS on all our servers from 2008r2 to either 2012r2 or 2016. We have an older Domain Controller that is also running certificate services on ...
1
vote
0answers
137 views

AD CS Auto Enrollment Multiple Templates

I've recently setup AD Certificate Services and it seems to be working okay although I can't say I'm familiar with every aspect of this. I can setup auto-enrollment and this works but I think I ...
0
votes
1answer
509 views

Submit unsigned pkcs10 to windows certificate authority

Is it possible to make a Windows Server Certificate Authority accept a PKCS10 certificate request that is unsigned? I get the following error Error Verifying Request Signature or Signing Certificate ...
0
votes
1answer
56 views

Configure how long requests are displayed in CertSrv web enrollment

I have a Win2008R2 enterprise CA in ADCS and the certificate template is set to ask CA administrator to issue or deny the request. By default, when the user submits the requests through web enrollment,...
0
votes
1answer
7k views

ERR_CERT_COMMON_NAME_INVALID with internal AD CA wildcard

I have created an internal ADCS CA using this guide, and then submitted a certificate request to create a wild card certificate for my domain eds89.com. Intention behind this being to apply to some of ...
6
votes
2answers
814 views

Is It OK to Use AD Issued Computer Certificates for IIS?

I'm using AD-Certificate Services to issue computer certificates to domain joined Windows computers(both servers and workstations). These certs are obtained via the auto-enroll process defined by ...
0
votes
0answers
1k views

Generate server/client certificates for openvpn with Windows CA

I need to setup a new OpenVPN channel but I already have a Windows CA, so I need to sign both server and client certs with this CA. I created a new server and client sign request: openssl req -...
2
votes
1answer
97 views

Only one SAN when issuing certificate using Windows

I'm trying to issue a SAN application using Certificate Enrollment in Windows. I have an AD CS I'm using. I'm trying to use the Computer certificate template and in Properties I've specified multiple ...
12
votes
1answer
5k views

What does a domain controller (DC) use a certificate for?

Everyone talks about domain controllers and that they should have a certificate installed, but at the end of the day it is optional. Once installed, what actually makes use of that certificate? My ...
0
votes
1answer
2k views

How to get and install a certificate (for Remote Desktop Server) from Active Directory Certificate Services after approval of request?

I installed a machine with Active Directory Certificate Services (Enterprise Internal Root Authority). The machine is installed as Server Core with minimal roles, so Web service for CA is not ...
2
votes
3answers
821 views

How to create cross certificates (or bridge CAs) in ADCS?

I'm trying to set up a trust between 2 untrusting forests, and I'd like to use either a cross-certificate or Bridge CA solution (not using AD trusts or CEP). I've found loads of advice saying that ...
9
votes
1answer
3k views

What happens to code sign certificates when when root CA expires?

So far clear for me: If the code sign certificate itself expires, signed code will be verified/accepted in case it was signed with a time stamp. If not, the signed code is expired too. But what ...
0
votes
1answer
4k views

Group security permissions for certificate template not working

I have a certificate template published on my domain-joined Server 2016 Enterprise CA - I'm trying to set up certificate autoenrollment for our internal webservers. When the template has read/enroll/...
0
votes
1answer
3k views

realm `! Cannot set computer password: Access denied`

I'm trying to connect my debian machine to a windows server, and can't make it work. As root, kinit -V myUserName@MYDOMAIN.COM returns Using default cache: /tmp/krb5cc_0 Using principal: myUserName@...
1
vote
0answers
2k views

Issue certificate to IP address in AD CS

We're trying to get a Sophos XG 210 to connect via LDAPS to an Active Directory Domain Services (AD DS) / Domain Controller (DC) server but doing so fails with the following two errors: Device - AD ...
0
votes
1answer
372 views

ADCS PKI - Cross-Certification or Bridge CA?

Our company is being acquired by another company and we are curious on the requirements needed to create a cross-certification / bridge CA solution. Cross-Certification is issuing a Cross ...
2
votes
0answers
384 views

Enroll on-behalf-of certificate using existing CSR file

Good day, I have a CSR (certificate signing request) file, which was generated on some remote non-domain station. I have created some AD user account. I have Enrollment Agent certificate signed for ...
0
votes
1answer
73 views

Generation of certificates when auto-enrolling to clients - AD CS

You can auto-enroll machine certificates in an Active Directory environment by using Microsoft Active Directory Certificate Services. But how is the generation of the certificates, meant for the ...
0
votes
1answer
599 views

Active Directory Certificate Services set up For Skype for business setup

I'm following this link to set up a skype for business server 2015. Matt Landis' Article On setting up S4B server is there a way i can bypass the Request Certificates step. Or if not How can I add ...
1
vote
1answer
236 views

Block Subject Alternative Names in ADCS

I am managing a Windows 2008 ADCS CA and have been aware of the security risks in issuing certificates with SANs. So I tested issuing a PKCS10 file with SANs in the request and it issued the ...
0
votes
1answer
1k views

Active Directory Certificate Services CEP/CES won't show templates added to CA

I am running this on Server 2016, domain is 2012r2, client computers are Win10 and Win7. I have a two-tier PKI infrastructure (offline root) that I recently set up, and I have had no issues with most ...
0
votes
1answer
5k views

How to remove the Certificate Enrollment Web Service role?

I misunderstood the purpose of the Certificate Enrollment Web Service role, and I installed it by mistake during my first configuration of my new Server Essentials 2016 instance. Now that I've ...
0
votes
1answer
851 views

Unable to install NDES

I have enterprice CA running on a Windows 2008 box. I am trying to configure NDES on a windows server 2012 R2. I followed all the instructions word by word from this blog: http://windowsitpro.com/...
0
votes
1answer
125 views

Microsoft Certification Authority: How to make certificates work on domain active directory

I have been struggling with Microsoft Certification Authority lately. Most resources only explain how SSL works and what certificates are, how they work, how they are issued and what they are used ...
4
votes
2answers
595 views

Can I restrict an intermediate CA to only sign client certificates?

I want to use SCEP to give out client certificates, probably using ADCS. We already have an internal offline root CA in place (securely in a safe, only used for signing and revoking intermediate ...
1
vote
1answer
254 views

Windows NDES / SCEP URL is using the CA's hostname, can I change this to the FQDN?

First off I need to describe the environment my team is using for Testing and development. A single class C address space. 4 AD using the this address space. A single Bind9 DNS server acting as a ...
0
votes
2answers
94 views

Windows Server 2008r2 Certificate services

I have a windows server 2008 r2 domain named ITTraining.local promoted to dc and another server which is added in ITTraining domain and on which i am installing Certificate services role, but while ...
0
votes
0answers
83 views

SHA1 Migration - Internal CAs Upgrade Requirement

SHA1 Migration - Internal CAs Upgrade Requirement A lot of internet blogs are stating that if a SHA1 certificate is not upgraded by Jan. 1st 2017, the SSL certificate will be rejected by most sites. ...
13
votes
1answer
633 views

How to find out where a Certificate Request came from

I have a CA setup on Server 2012 R2, the person who ran the server left the company and I have setup a new CA server. I am trying to figure out what systems / URL's the certs are for. In the List of ...
0
votes
1answer
568 views

Parallel PKI hierarchy Setup With ADCS

I am very new to ADCS, and have a challenge to migrate our old Tire-2 PKI to SHA-256. As we were suggested to setup a parallel SHA-2 CA, I am not greeting any idea, how to go ahead with it, I can ...
2
votes
0answers
9k views

Windows 2012 CA Web Interface “No certificate templates could be found”

I have an enterprise certificate authority running on a Windows Server 2012 R2 member server. The web interface for the CA has recently started popping up an error each time I go to request a ...
1
vote
0answers
113 views

Unable to generate and import user certificate from ADCS in Chrome

We are using Certificate Based Authentication using ADCS. So in order for user to access an internal website, they need their own signed certificate. With ADCS, the user gets their signed certificate ...