Questions tagged [ad-certificate-services]

Active Directory Certificate Services is a role first made available in Windows Server 2008. Previously it was known as certificate services.

Filter by
Sorted by
Tagged with
0
votes
1answer
22 views

Windows Certificate Templates CSP certificate with Exportable Private Key

I recently created a certificate for a developer using a certificate template. The template was based from an existing one which I believe is based on CNG.I was able to export the private key, but the ...
0
votes
1answer
22 views

Windows AD CA Code Signing Cert Request for Wrong User

I am having an odd problem with a Code Signing certificate request from my Windows 10 workstation. We have a Windows Server 2012R2 CA setup with the Code Signing template and everything works fine if ...
0
votes
1answer
164 views

MMC > Certificates > Other computers: Which firewall ports used for this?

I am having a windows firewall issue when trying to access the Certificate Store from another computer on the same domain using MMC or PowerShell. I am logged in as a domain admin. Both servers are ...
1
vote
2answers
56 views

Should Remote Desktop use a dedicated certificate template?

Practically all instructions on enabling certificates for Remote Desktop server authentication (and configuring auto-enrollment through Group Policy) say that you should create a new certificate ...
1
vote
1answer
40 views

install additional Enterprise Subordinate CA

I have already set up a working two tier Active Directory Certificate Services PKI hierarchy with an offline standalone Root CA (ROOT-CA) and one online Enterprise Subordinate CA (ISSUING-CA). For ...
0
votes
1answer
76 views

Publish certificate in Active Directory not working as intended

I have an AD forest and one CA server. In the certificate template I have "Publish certificate in Active Directory" checkbox checked. Also in the template, the Subject Name option is set to &...
0
votes
0answers
41 views

Enterprise Issuing CA denied bind by domain controller

I am setting up a test environment and have a standalone Root CA and an Enterprise Intermediate CA as my issuing. On a third server, I set up an OCSP responder. The OCSP server and the Issuing CA are ...
0
votes
0answers
36 views

Do not add “next crl publish” to CRL files

Im building a microsoft CA infrastructure that will be used by non micorosfot devices. I would like to remove OID 1.3.6.1.4.1.311.21.4 (Next CRL publish) from the CRL because it servers only windows ...
1
vote
1answer
110 views

How do I request a new certificate from a Windows 2016 Issuing CA which has an expired certificate?

We have an offline RootCA which still has a valid certificate. Our subordinate issuing CA unfortunately expired before we renewed. How does one recover from this scenario? Windows Server 2016 ...
1
vote
0answers
38 views

Migrating Root Certificate Authority

I got thrown into the middle of a CA migration project. My co-workers are migrating a Root Certificate Authority off a 2008 R2 server and onto a new 2019 server. They have both servers running at the ...
0
votes
1answer
309 views

Active Directory - Difference between User-Cert and X509-Cert attributes

I came across two user object attributes User-Cert (ldap name: userCert) and X509-Cert (ldap name: userCertificate) in Active Directory that sound similar, but doesn't seem so. As per documentation (...
0
votes
1answer
51 views

Distribute Secrets via Active Directory [Group Policy]

I would like to simplify my life and distribute secrets (real secrets, like encryption private keys) to Active Directory domain member computers. Probably via Active Directory Group Policy, but will ...
0
votes
1answer
37 views

(SOLVED) Enterprise PKI and AD CS cannot download/get revocation list for offline Root CA

SOLVED: https://www.reddit.com/r/sysadmin/comments/g2js6c/enterprise_pki_and_ad_cs_cannot_downloadget/ I have two instances running Windows Server 2019: one as an offline Standalone Root CA and the ...
0
votes
0answers
21 views

Key attestation and Standalone Root CA

We are about to build a new PKI infrastructure and We are examinig different options for HSMs. One option is based on HSM partitioning, where one partition will be used for the standalone root ca, ...
0
votes
1answer
109 views

LDAPS 636 Works on Domain Controllers except Azure Domain Controller

I have a Domain Controller (Server 2016) in Azure. The Azure network this system is on is connected via a Virtual network gateway (VPN) to the on-prem network and the network engineers have configured ...
0
votes
0answers
68 views

ADCS Change AIA information from existing certificate

We have built a tier 2 PKI. Recently we decided to start hosting our CDP & AIA on a seperate webserver. However this was not originally in the design, so now we have problems with the certificate ...
0
votes
0answers
331 views

The imported certificate does not match the chosen ca type and will not be used

I am migrating from Windows Server 2012 to Windows Server 2019. This is a subordinate CA and I encounter the following error when trying to import the certificate. The imported certificate does not ...
1
vote
1answer
374 views

Active Directory Certificate Services autorenew

I have an LDAP application which needs to talk to Active Directory via LDAPS (LDAP over SSL). I installed Active Directory Certificate Services on a test Domain Controller (I know this is not best ...
1
vote
1answer
1k views

How to tell domain controllers to not enroll a “Kerberos Authentication” certificate?

As per this question, I have an environment where certificates based on the "Kerberos Authentication" template cannot be issued (there are remote sites without direct connectivity to the CA, ...
5
votes
2answers
1k views

Error enrolling “Kerberos Authentication” certificate in a sparse network

I'm currently working on implementing an Enterprise Certification Authority for a customer whose network is not fully connected; it spans several geographical sites, and some of them don't have ...
1
vote
2answers
1k views

Deploying in-house ACME server for Microsoft ADCS?

I'm quite new to ACME, but already somewhat experienced with ADCS (Active Directory Certificate Services). We use ADCS for all our internal needs: client auth, VPN, EFS etc., also for issuing TLS ...
1
vote
2answers
267 views

ldaps certificate for connections using domain.local instead of fqdn

We have multiple Windows Server 2016 AD Domain Controllers and we need to replace all LDAP connections with LDAPS connections. For High Availability we would like to connect all LDAPS sessions to "...
0
votes
0answers
49 views

Decommission Active Directory Certificate Services server: side effects

I have a private domain to which I later added AD CS, NPS, RRAS and setup SSTP VPN access. I used AD CS to create a certificate for the SSTP connection and DynDNS to get me in from outside. ...
0
votes
0answers
42 views

Unable to renew Certificate on Windows 10 in domain

I'm trying to renew my computer certificates on a in domain laptop but I get "RPC Server is unavailable", error code 1722. On other laptops the same procedure works. What can I do? I've opened mmc and ...
1
vote
0answers
134 views

Unable to Backup or Restore Certificate Authority?

I migrated Certificate Authority Enterprise from windows server 2012 R2 to Windows Server 2019. Both Server are VMs Here are the steps I took: Baskup CA database, key and registry config of the ...
2
votes
0answers
904 views

Automatically renew certificate: Old cert gets archived, but no new one is issued

We are using Active Directory Certificate Services (AD CS) to issue certificates for internal web applications. We can manually request a certificate from the CA and it gets issued without problems. ...
1
vote
1answer
1k views

If I install certificate services (enterprise root ca) on a domain controller is LDAPS automatically enabled?

reading this article: https://www.petri.com/enable-secure-ldap-windows-server-2008-2012-dc The first method is the easiest: LDAPS is automatically enabled when you install an Enterprise Root CA ...
2
votes
1answer
446 views

Certificate expiration does not match validity period in template (Windows CA)

I'm trying to request a new Bitlocker DRA certificate from my internal CA. The template is set to two years, as shown here Template I'm trying to request a new certificate via the Certificates MMC ...
0
votes
2answers
471 views

AD CS - OID for root and issuing CAs

I am willing to install a Root CA and an Issuing CA with AD CS for my private environment (test purpose). Do I need to obtain public OIDs (i.e. from IANA) or can I skip this requirement since my CAs ...
0
votes
0answers
35 views

Certificate Enrollment fails after working all morning

Good morning, everyone. I was working on SSL cert tasks all yesterday morning without issue, and then all of the sudden I get a failure when making a new request and it looks like this: What is even ...
0
votes
1answer
85 views

Add O and OU parts in DN of a standalone CA in Windows

I have a standalone CA managed in Windows Server 2012 R2. Its certificate has a DN that includes CN and DC, as in CN=CAName,DC=domain,DC=tld. This root certificate cannot be stored in firefox, ...
2
votes
1answer
1k views

Unable to issue certificates after enabling SAN?

I have a Microsoft CA running, which does not have the SAN field enabled by default, so I have enabled it by certutil -setreg policy\EditFlags +EDITF_ATTRIBUTESUBJECTALTNAME2 Before doing so, ...
1
vote
1answer
1k views

Error installing Active Directory Certificate Services

I'm trying to install Active Directory Certificate Services on a Windows Server 2016 Standard Core VM where I logged in with the Administrator account. I ran the following Powershell cmdlet: ps> ...
0
votes
1answer
39 views

Can You Remove DC Role Without Impacting Certificate Services?

I am working on a project where we need to upgrade the OS on all our servers from 2008r2 to either 2012r2 or 2016. We have an older Domain Controller that is also running certificate services on ...
1
vote
0answers
194 views

AD CS Auto Enrollment Multiple Templates

I've recently setup AD Certificate Services and it seems to be working okay although I can't say I'm familiar with every aspect of this. I can setup auto-enrollment and this works but I think I ...
0
votes
1answer
1k views

Submit unsigned pkcs10 to windows certificate authority

Is it possible to make a Windows Server Certificate Authority accept a PKCS10 certificate request that is unsigned? I get the following error Error Verifying Request Signature or Signing Certificate ...
0
votes
1answer
78 views

Configure how long requests are displayed in CertSrv web enrollment

I have a Win2008R2 enterprise CA in ADCS and the certificate template is set to ask CA administrator to issue or deny the request. By default, when the user submits the requests through web enrollment,...
1
vote
1answer
10k views

ERR_CERT_COMMON_NAME_INVALID with internal AD CA wildcard

I have created an internal ADCS CA using this guide, and then submitted a certificate request to create a wild card certificate for my domain eds89.com. Intention behind this being to apply to some of ...
7
votes
2answers
983 views

Is It OK to Use AD Issued Computer Certificates for IIS?

I'm using AD-Certificate Services to issue computer certificates to domain joined Windows computers(both servers and workstations). These certs are obtained via the auto-enroll process defined by ...
0
votes
0answers
2k views

Generate server/client certificates for openvpn with Windows CA

I need to setup a new OpenVPN channel but I already have a Windows CA, so I need to sign both server and client certs with this CA. I created a new server and client sign request: openssl req -...
2
votes
1answer
101 views

Only one SAN when issuing certificate using Windows

I'm trying to issue a SAN application using Certificate Enrollment in Windows. I have an AD CS I'm using. I'm trying to use the Computer certificate template and in Properties I've specified multiple ...
13
votes
1answer
9k views

What does a domain controller (DC) use a certificate for?

Everyone talks about domain controllers and that they should have a certificate installed, but at the end of the day it is optional. Once installed, what actually makes use of that certificate? My ...
0
votes
1answer
3k views

How to get and install a certificate (for Remote Desktop Server) from Active Directory Certificate Services after approval of request?

I installed a machine with Active Directory Certificate Services (Enterprise Internal Root Authority). The machine is installed as Server Core with minimal roles, so Web service for CA is not ...
2
votes
3answers
2k views

How to create cross certificates (or bridge CAs) in ADCS?

I'm trying to set up a trust between 2 untrusting forests, and I'd like to use either a cross-certificate or Bridge CA solution (not using AD trusts or CEP). I've found loads of advice saying that ...
12
votes
1answer
8k views

What happens to code sign certificates when when root CA expires?

So far clear for me: If the code sign certificate itself expires, signed code will be verified/accepted in case it was signed with a time stamp. If not, the signed code is expired too. But what ...
0
votes
1answer
9k views

Group security permissions for certificate template not working

I have a certificate template published on my domain-joined Server 2016 Enterprise CA - I'm trying to set up certificate autoenrollment for our internal webservers. When the template has read/enroll/...
0
votes
1answer
5k views

realm `! Cannot set computer password: Access denied`

I'm trying to connect my debian machine to a windows server, and can't make it work. As root, kinit -V myUserName@MYDOMAIN.COM returns Using default cache: /tmp/krb5cc_0 Using principal: myUserName@...
1
vote
0answers
3k views

Issue certificate to IP address in AD CS

We're trying to get a Sophos XG 210 to connect via LDAPS to an Active Directory Domain Services (AD DS) / Domain Controller (DC) server but doing so fails with the following two errors: Device - AD ...
0
votes
1answer
515 views

ADCS PKI - Cross-Certification or Bridge CA?

Our company is being acquired by another company and we are curious on the requirements needed to create a cross-certification / bridge CA solution. Cross-Certification is issuing a Cross ...
2
votes
0answers
529 views

Enroll on-behalf-of certificate using existing CSR file

Good day, I have a CSR (certificate signing request) file, which was generated on some remote non-domain station. I have created some AD user account. I have Enrollment Agent certificate signed for ...

1
2 3 4 5