Questions tagged [ad-certificate-services]

Active Directory Certificate Services is a role first made available in Windows Server 2008. Previously it was known as certificate services.

Filter by
Sorted by
Tagged with
7 votes
2 answers
36k views

Adding new root/enterprise CA without disturbing existing one?

I am looking at installing a new AD-integrated enterprise certificate authority structure, but have discovered that somebody already has created a CA (mostly used for SSL on internal websites). I ...
ewall's user avatar
  • 1,074
1 vote
1 answer
6k views

Missing Certificate template From certificate to issue

I have following problem: Environement: SERVER 2008 STANDARD EDITION ACTIVE DOMAIN SERVICIES INSTALLED ACTICE CERTIFICATE SERVICIES INSTALLED ENTERPRISE CA INSTALLED I create a duplicate of ...
user avatar
1 vote
1 answer
4k views

How to tell domain controllers to not enroll a "Kerberos Authentication" certificate?

As per this question, I have an environment where certificates based on the "Kerberos Authentication" template cannot be issued (there are remote sites without direct connectivity to the CA, ...
Massimo's user avatar
  • 71.3k
16 votes
3 answers
60k views

Distribution of root certificate with Windows AD Certificate Services

Windows Server provides a certificate authority service. However, it's not clear from its documentation how (or if) the root certificate gets distributed to clients. Do domain member computers ...
wfaulk's user avatar
  • 6,958
8 votes
1 answer
3k views

Protecting credentials in Desired State Configuration using certificates

I'm new to DSC and trying to figure out how to make it work for us. What I'm stuck on is how the credentials are actually protected. My current understanding is that it isn't all that great. The big ...
Simon Gill's user avatar
8 votes
5 answers
81k views

Certificate Template Missing from "Certificate Template to Issue"

I'm having a problem similar to that posted in this question: Missing Certificate template From certificate to issue The short version is that I've created a duplicate certificate template and I'm ...
Adam Robinson's user avatar
6 votes
1 answer
2k views

How large is the certificate OCSP and CRL cache in my Windows server?

How can I see the size of the in-memory OCSP cache to a CRL cache in my Domain Controllers? In other words, most Windows process that uses CryptoAPIs have an in-memory cache of every CRL and OCSP ...
makerofthings7's user avatar
5 votes
2 answers
17k views

Error enrolling "Kerberos Authentication" certificate in a sparse network

I'm currently working on implementing an Enterprise Certification Authority for a customer whose network is not fully connected; it spans several geographical sites, and some of them don't have ...
Massimo's user avatar
  • 71.3k
2 votes
1 answer
316 views

Distribute Secrets via Active Directory [Group Policy]

I would like to simplify my life and distribute secrets (real secrets, like encryption private keys) to Active Directory domain member computers. Probably via Active Directory Group Policy, but will ...
adontz's user avatar
  • 347
2 votes
3 answers
5k views

Are code signing certificates automatically trusted across the domain if the root CA is trusted?

We have a Microsoft enterprise certificate authority, and I would like to start issuing a few code signing certificates. But what I'm unsure of is this: since all our domain/forest machines trust the ...
ewall's user avatar
  • 1,074
2 votes
2 answers
683 views

Can a Windows Server CA separate code-signing keys from keys for other purposes?

I am a software developer. My team encrypts the sensitive sections of our ASP.NET web.config files. aspnet_regiis.exe is used to manage the local key store, encrypt and decrypt. I want to build a ...
Emyr's user avatar
  • 153
0 votes
1 answer
1k views

LDAPS certificate isn't working on new server for third parties

About 5-6 years ago I setup LDAPS on my Primary Domain controller. I setup Active Directory Certificate Services (all on the same server), forwarded the port 636 on my firewall, and was able to ...
ItsPronounced's user avatar
0 votes
1 answer
971 views

Active Directory Certificate Services set up For Skype for business setup

I'm following this link to set up a skype for business server 2015. Matt Landis' Article On setting up S4B server is there a way i can bypass the Request Certificates step. Or if not How can I add ...
Jins Peter's user avatar