Questions tagged [ad-certificate-services]

Active Directory Certificate Services is a role first made available in Windows Server 2008. Previously it was known as certificate services.

Filter by
Sorted by
Tagged with
0 votes
2 answers
223 views

Should a subordinate CA appear under the Trusted Root CA?

Recently I needed to setup PKI for VDI solution as smart card functionality was needed to handle SSO with Azure. I configured an offline Root CA and a domain joined subordinate CA per MS instructions ...
omgosh's user avatar
  • 1
0 votes
0 answers
215 views

Issuing Certificate For Child Domain After Issuing One From Parent From Same CA

I am trying it issue a certificate as part of my Enrollment ability for a 2FA device for our child domain from our parent domain. I was able to do this months ago but now it won't let me do the child ...
JukEboX's user avatar
  • 835
0 votes
1 answer
130 views

Active Directory Certificate Services (ADCS) Template 3DES?

I am seeking clarification from anyone who is familiar with ADCS. In reviewing the AD Object details, I am trying to understand why I am seeing 3DES in the application policy section of the ...
Cory Candia's user avatar
0 votes
0 answers
70 views

Windows Certification Authority Autoenrollment when Issuance Requirements is set

I have domain computers CA template which autoenrolls to machines without issues I activated Issuance Requirements I can automatically renew existing certificates, but cannot automatically/manyally ...
overflowed's user avatar
1 vote
0 answers
196 views

Windows CA Publishing Expired Certs in CRL When not configured to do so

I have a Windows ADDS CA that for some reason is publishing revoked but expired certificates in the CRL and I can't for the life of me figure out why. Here is my configuration: Server 2012 R2 ...
Helstrom's user avatar
0 votes
1 answer
123 views

Microsoft Certificate Authority Machine Template - add single label host name to SAN

I would like to create a machine certificate template on a Microsoft Certificate Authority that includes the single label Active Directory (AD) Computer Names in the SAN. I have tens of thousands of ...
Walter's user avatar
  • 1
1 vote
1 answer
320 views

Implementing PKI on an Active Directory domain

I would like to implement a two-tier PKI in a relatively small Windows environment: about 35 users and five virtual servers. Although I have little experience with Linux, I am trying to use XCA on a ...
coprolaliant's user avatar
0 votes
0 answers
64 views

Export pfx certificate after approving pending request

In Active Directory Certificate Authority I have template with CA certificate manager approval. CA picture When I approve a request I can not export issued certificates to pfx format. How can I export ...
DarioS's user avatar
  • 1
0 votes
1 answer
115 views

CA: Certificate User for VPN

From a subordinate Enterprise CA I want to generate a user certificate that serves as an authentication method for VPN connections. I want to install this certificate with autoenroll on the domain ...
Santyuste's user avatar
0 votes
0 answers
282 views

Migrating a CA to a new server - CA services won't start

We have an Enterprise Root CA running on Server 2012 R2. I built a replacement server running Server 2019 and followed the steps in the below article, I backed up the CA and relevant registry keys, ...
LeeCS's user avatar
  • 1
0 votes
1 answer
1k views

LDAPS certificate isn't working on new server for third parties

About 5-6 years ago I setup LDAPS on my Primary Domain controller. I setup Active Directory Certificate Services (all on the same server), forwarded the port 636 on my firewall, and was able to ...
ItsPronounced's user avatar
1 vote
1 answer
168 views

SubCA certificate of trust

I have deployed a PKI infrastructure with a Stand-Alone Root CA (which will be kept off) and 4 Enterprise SubCA's which depends on this Root CA. To make the computers trust the Root CA, I am going to ...
Santyuste's user avatar
0 votes
1 answer
2k views

Creating a new root certificate with new key length on windows ad certificate services

Due to new corporate guidelines I need to update the root certificate of my CA so the key length is 4096bits (Currently 2048bits). My CA is AD integrated and currently running on our DC. So now I am ...
Bad Santa's user avatar
0 votes
0 answers
209 views

How to submit certificate request from Red Hat machine to Windows CA?

I’m looking for solution, which helps me send certificate request from domain-joined RedHat Enterprise Linux machine to Certification Authority on Windows Sever 2022. Is there any solution to do this? ...
amperek's user avatar
0 votes
2 answers
236 views

Change certificate issuer

Is it possible to change the "issuer" value in a CA so that when a new certificate is issued, the new "issuer" value appears? In the case of having several SubCa, is it possible to ...
Santyuste's user avatar
0 votes
1 answer
262 views

Windows Server 2019 ADCS. CA subordinate

I have a "CA1" server with Windows 2019 that has the CA root Enterprise service. Additionally I have another server "CA-Subordinate" with Windows 2019 with the CA subordinate ...
Santyuste's user avatar
0 votes
2 answers
237 views

With multiple RDP certificates, do all get checked?

If a Windows host has multiple RDP certificates. Do all get checked while connecting or only the first found? I have a RDP certificates deployed from an Root CA with now invalid OCSP location in the ...
Synertry's user avatar
0 votes
1 answer
562 views

Trouble setting up CES and CEP PKI in a trusted forest scenario

I have two AD domains with a two-way forest trust. I want computer accounts in DomainB to enroll for computer client auth certificates from the two-tier Windows CA in DomainA. I configured a ...
corndog's user avatar
0 votes
1 answer
354 views

Can we add a subordinate enterprise certificate authority linked to an existing enterprise Root certificate authority

The Root CA is domain joined. The Sub CA will be domain joined. The Sub CA will deliver workstation Authentification (template) to PC clients via GPO. Is there any known issue with this configuration? ...
dr23trik's user avatar
0 votes
1 answer
1k views

Having trouble issuing the 2nd enterprise CA on the same offline Root CA as the 1st. Windows Server 2016

I am running into an issue and hoping someone can help me. We were asked to set up a new Root CA and 2 subordinate (issuing) CAs under it (the request includes using Azure and placing each VM in a ...
Woogi's user avatar
  • 1
0 votes
1 answer
311 views

Must all services of ADCS run under the same service account on the same server?

While deploying ADCS, on the documentation Microsoft recommends using service accounts for the services making up ADCS. The problem is that it doesn't address if these should be individually managed, ...
Vita's user avatar
  • 133
0 votes
2 answers
426 views

How can I set the ACL of a CA programmatically?

When launching the CA console (certsrv.msc), I can right-click on my CA, select Properties and then I can modify the ACL of my CA in the Security tab. When I modify it, the changes are applied to the ...
stackprotector's user avatar
0 votes
1 answer
3k views

Domain Member Servers - Accessing Certificate Revocation List (CRL)

In my environment I have a Enterprise Root CA installed on a domain controller and a separate domain controller configured as a Subordinate CA - I know this isn't recommended for security reasons but ...
jrd1989's user avatar
  • 688
0 votes
2 answers
4k views

Windows Certificate Authority - Adding Additional Attributes

In AD Certificate Templates the templates have an option to build from AD information and includes Email, DNS, UPN, etc. When creating a CSR using powershell, openssl and the certificate mmc snap-in ...
jrd1989's user avatar
  • 688
0 votes
1 answer
235 views

How does OCSP handle deleted certificates?

We have a Microsoft Certificate Authority running on Windows Server 2019. We are issuing certificates to Android devices via a MDM. The Android device users browse to a web application (hosted by ...
user2140583's user avatar
0 votes
1 answer
2k views

What controls the timing of the Windows Certificate Services event "Close to expiration" ID 1003?

I have a Windows Server which started logging this warning event 36/37 days before a certificate's expiry date and I would like to understand what controls/sets this timing and how it can be ...
bchen's user avatar
  • 3
2 votes
1 answer
439 views

How to set the lifetime of a CA certificate?

I'm trying to install a subordinate CA with Microsoft ADCS and when I do, it creates a .req file. Then I use that at the root CA to issue a certificate. The resulting certificate is always for 5 years....
Roman's user avatar
  • 425
0 votes
0 answers
3k views

How to configure AD Certificate Services to get past this WS_E_ENDPOINT_ACCESS_DENIED error?

I have followed the Microsoft test lab instructions for setting up a two-tier CA hierarchy. I have the Certificate Enrollment Policy Web Service (CEP) installed on the same machine as the issuing ...
Roman's user avatar
  • 425
0 votes
1 answer
666 views

CDP container in Active Directory required if not part of AD?

We have a Microsoft Active Directory Certificate Services Enterprise CA. After installing the service, an AD container is created within CN=CDP,CN=Public Key Services,CN=Services,CN=Configuration,DC=...
Daniel's user avatar
  • 7,049
3 votes
1 answer
5k views

Domain Controller autoenrollment - changing issuing CA

We are cleaning up our Windows PKI/CA environment and replacing our root CA with a new server. The current root CA has been issuing the following certificate templates for years now (in addition to ...
TheCleaner's user avatar
  • 32.8k
0 votes
1 answer
736 views

Target specific Enterprise CA for auto-enrollment?

We have two intermediate Enterprise CAs (Windows AD CS) in our AD domain. Both CAs only have the Certification Authority role enabled. CA1 is responsible for issuing certificates to workstations and ...
Daniel's user avatar
  • 7,049
0 votes
2 answers
2k views

Auto-Enrollment with manager approval, but auto-approval for re-enrollment

I have a certificate template (auto-enrolled) that must require manager approval. To achieve this, I checked the CA certificate manager approval checkbox in the Issuance Requirements tab. The ...
Daniel's user avatar
  • 7,049
0 votes
1 answer
1k views

This site is missing a valid, trusted certificate || Apache2 webserver, Windows root CA

I'm learning about certificates, HTTPS together and after 4 days I'm out of idea how to set up to become trusted. In my lab env. I have a Windows server with a CA role. Previously I installed a VM-...
Finaria's user avatar
  • 23
0 votes
1 answer
550 views

PKI trust in Active Directory

Assuming that the certificate of the ADCS CAs joined to a given domain are signed by an offline root CA which is then trusted by all systems in the domain/forest. If that offline root was then used to ...
5y5tem5's user avatar
  • 51
0 votes
1 answer
470 views

AD Certificate Services - Add a new domain?

My AD domain name is domainname.local. I have Certificate Services set up to issue certs for this domain. I now want to add domainname.com as an AD integrated zone and have Certificate Services issue ...
Romual Piecyk's user avatar
0 votes
1 answer
1k views

RDP and GPO setting Server Authentication certificate template (Microsoft Windows Server 2016)

We want to force Remote Desktop to use a certificate based on a particular named template rather than using a self-signed certificate. This works in forests with a Certificate Authority server, but ...
Jon Pennycook's user avatar
3 votes
2 answers
16k views

No certificate templates in Certificate Services server on Windows 2019

There are a lot of discussions on here about this problem, and I have spent all day exploring every one of them. All the servers involved in this are Windows 2019. 2 domain controllers and a ...
Geoff Sweet's user avatar
0 votes
1 answer
88 views

Unused ADCS for Server 2008 R2 Standard. What are the risks associated with removing this service?

I have inherited this system and I am looking at decommissioning this server 2008 R2 Domain Controller/ADCS Server. This role (ADCS) was never actively used by anyone. I believe, just because it was ...
darraisa's user avatar
0 votes
1 answer
876 views

Autorenew not working when setting up key based renewal - Cep/CES

I am trying to configure Key Based renewal using WES to support autorenwal of certificates in workgroup computers and untrusted domains. I have configured CEP (Certificate Authenticatoin, Key Based ...
CryptoDan's user avatar
0 votes
1 answer
284 views

One-way forest trust deployment for Microsoft CA

I am looking to deploy a multi-forest Microsoft CA between 2 domains (one-way trust) Domain A will be the resource forest while B will be the account forest (A trusts B but B doesn't trust A) Will ...
ba zhang's user avatar
1 vote
1 answer
810 views

NDES AD certificate services Configuration error

While configuring NDES for my Win server 2019, i encountered the following error. Failed to add the following certificate templates to the enterprise Active Directory Certificate Services or update ...
ba zhang's user avatar
0 votes
1 answer
2k views

Upgrading certificate template schema

I need to update one of my Active Directory Certificate Services (ADCS) certificate templates from schema v2 to v3, to support KSP providers. It seems that I can only do this by cloning the template (...
StanTastic's user avatar
0 votes
2 answers
771 views

Any issues that I should be prepared installing a Certificate in AD? [closed]

They are asking me to install a TLS Certificate in our Active Directory to make our Meraki routers work with AD. We currently have some services that use AD users, including a database. Will there be ...
Tirux's user avatar
  • 3
0 votes
2 answers
445 views

Windows Certificate Templates CSP certificate with Exportable Private Key

I recently created a certificate for a developer using a certificate template. The template was based from an existing one which I believe is based on CNG.I was able to export the private key, but the ...
RLBChrisBriant's user avatar
0 votes
1 answer
2k views

Windows AD CA Code Signing Cert Request for Wrong User

I am having an odd problem with a Code Signing certificate request from my Windows 10 workstation. We have a Windows Server 2012R2 CA setup with the Code Signing template and everything works fine if ...
Caynadian's user avatar
  • 466
0 votes
1 answer
1k views

MMC > Certificates > Other computers: Which firewall ports used for this?

I am having a windows firewall issue when trying to access the Certificate Store from another computer on the same domain using MMC or PowerShell. I am logged in as a domain admin. Both servers are ...
Tony's user avatar
  • 101
2 votes
2 answers
953 views

Should Remote Desktop use a dedicated certificate template?

Practically all instructions on enabling certificates for Remote Desktop server authentication (and configuring auto-enrollment through Group Policy) say that you should create a new certificate ...
u1686_grawity's user avatar
1 vote
1 answer
816 views

install additional Enterprise Subordinate CA

I have already set up a working two tier Active Directory Certificate Services PKI hierarchy with an offline standalone Root CA (ROOT-CA) and one online Enterprise Subordinate CA (ISSUING-CA). For ...
mokum's user avatar
  • 23
0 votes
1 answer
1k views

Publish certificate in Active Directory not working as intended

I have an AD forest and one CA server. In the certificate template I have "Publish certificate in Active Directory" checkbox checked. Also in the template, the Subject Name option is set to &...
ramtech's user avatar
  • 133
2 votes
1 answer
2k views

How do I request a new certificate from a Windows 2016 Issuing CA which has an expired certificate?

We have an offline RootCA which still has a valid certificate. Our subordinate issuing CA unfortunately expired before we renewed. How does one recover from this scenario? Windows Server 2016 ...
Jim Hankins's user avatar

1
2 3 4 5