Questions tagged [ad-certificate-services]
Active Directory Certificate Services is a role first made available in Windows Server 2008. Previously it was known as certificate services.
70
questions with no upvoted or accepted answers
11
votes
1
answer
5k
views
certutil -ping fails with 30 seconds timeout - what to do?
The certificate store on my Win7 box is constantly hanging. Observe:
C:\>1.cmd
C:\>certutil -? | findstr /i ping
-ping -- Ping Active Directory Certificate Services Request interface
...
- 755
4
votes
1
answer
3k
views
Fixing "server unavailable" login problems in exchange 2013 and outlook 2010
We've been facing some problems pertaining to expiring user passwords, causing "server unavailable" login problems for Outlook Outlook 2007 and 2010 clients on exchange 2013. The quick fix to this was ...
4
votes
2
answers
3k
views
RPC error when requesting computer certificate
I am using MMC with the certificate management snapin. I am requesting certificates from a brand new installation of a CA.
Requesting User certificates works perfectly.
Requesting Computer ...
- 2,039
3
votes
1
answer
2k
views
How to include all dns records and IP address of a server in automatic certificate enrollment of Microsoft AD CS?
In my company there are a lot of servers which users remotely login to them to do their duties. We have enabled computer certificate auto enrollment for them to assure secure connection. But because ...
3
votes
0
answers
1k
views
Windows Sub CA not issuing certificates
I set up a fresh 2-tier PKI to try and replace an old broken PKI with a CA that was no longer available. Everything seems to be working between the offline root and online issuing CAs, but now I'm ...
- 187
2
votes
1
answer
3k
views
Automatically renew certificate: Old cert gets archived, but no new one is issued
We are using Active Directory Certificate Services (AD CS) to issue certificates for internal web applications. We can manually request a certificate from the CA and it gets issued without problems. ...
2
votes
0
answers
1k
views
Enroll on-behalf-of certificate using existing CSR file
Good day,
I have a CSR (certificate signing request) file, which was generated
on some remote non-domain station.
I have created some AD user
account.
I have Enrollment Agent certificate signed for ...
- 193
2
votes
1
answer
18k
views
Windows 2012 CA Web Interface "No certificate templates could be found"
I have an enterprise certificate authority running on a Windows Server 2012 R2 member server. The web interface for the CA has recently started popping up an error each time I go to request a ...
- 165
2
votes
1
answer
2k
views
Create Windows CA Certificate Template from Command line
As part of installing our product, we are generally required to setup AD and CA services. I found a way to install the CA from the command line: https://technet.microsoft.com/en-us/library/ff849263(v=...
- 121
2
votes
0
answers
141
views
Internal EV SSL From A Windows Server 2012 R2 Root CA Shows Up As A Normal Certificate
I am trying to setup an internal ev ssl server for all of my internal applications giving ie the little green bar and chrome displaying my company name. It works fine in IE displaying the green bar as ...
- 121
2
votes
0
answers
2k
views
How does one create a certificate request for a managed service account in Windows?
I have a managed service account which needs a certificate in its personal store for decryption. I tried opening the Certificates snap-in and pointing to the service, but when I right-click on the "...
- 1,388
2
votes
0
answers
1k
views
Server 2012, Attempted to Install Certificate Services, now Win-RM is broken
I have two exchange servers, one running Exchange 2007 and one Exchange 2010. On the Exchange 2010 I attempted to install a AD-Certificate role but after installing the role I am unable to run the ...
- 168
2
votes
0
answers
559
views
Windows - Replace subject from CSR when issuing certificate
I've received a CSR from a client with a CN, but not with all the subject fields we require.
According to this answer from Scott*, it should be possible to specify the final subject values when the ...
- 281
2
votes
0
answers
677
views
Does the Windows Certification Authority support CMC Requests with CRMF Request Body?
I have a program that generates CMC
certificate requests with a
CRMF Request Body. When I
submit this request to a certification authority running on Windows
Server 2008 R2 Enterprise it always fails ...
- 173
2
votes
0
answers
4k
views
Unable to request new certificate: access denied. (2008 R2)
When trying to request a new certificate for DomainControllerAuthentication from our DC designated as the CA, we keep receiving an access denied error.
The following events are generated in the event ...
- 562
1
vote
0
answers
235
views
Windows CA Publishing Expired Certs in CRL When not configured to do so
I have a Windows ADDS CA that for some reason is publishing revoked but expired certificates in the CRL and I can't for the life of me figure out why. Here is my configuration:
Server 2012 R2
...
- 13
1
vote
1
answer
189
views
SubCA certificate of trust
I have deployed a PKI infrastructure with a Stand-Alone Root CA (which will be kept off) and 4 Enterprise SubCA's which depends on this Root CA.
To make the computers trust the Root CA, I am going to ...
- 39
1
vote
0
answers
122
views
Migrating Root Certificate Authority
I got thrown into the middle of a CA migration project. My co-workers are migrating a Root Certificate Authority off a 2008 R2 server and onto a new 2019 server. They have both servers running at the ...
- 11
1
vote
1
answer
1k
views
Unable to Backup or Restore Certificate Authority?
I migrated Certificate Authority Enterprise from windows server 2012 R2 to Windows Server 2019. Both Server are VMs
Here are the steps I took:
Baskup CA database, key and registry config of the ...
- 111
1
vote
1
answer
5k
views
Error installing Active Directory Certificate Services
I'm trying to install Active Directory Certificate Services on a Windows Server 2016 Standard Core VM where I logged in with the Administrator account.
I ran the following Powershell cmdlet:
ps> ...
- 113
1
vote
0
answers
397
views
AD CS Auto Enrollment Multiple Templates
I've recently setup AD Certificate Services and it seems to be working okay although I can't say I'm familiar with every aspect of this.
I can setup auto-enrollment and this works but I think I ...
1
vote
0
answers
6k
views
Issue certificate to IP address in AD CS
We're trying to get a Sophos XG 210 to connect via LDAPS to an Active Directory Domain Services (AD DS) / Domain Controller (DC) server but doing so fails with the following two errors:
Device - AD ...
- 905
1
vote
0
answers
224
views
Unable to generate and import user certificate from ADCS in Chrome
We are using Certificate Based Authentication using ADCS. So in order for user to access an internal website, they need their own signed certificate.
With ADCS, the user gets their signed certificate ...
- 91
1
vote
0
answers
309
views
Active Directory Certificate Services Code signing Subject Empty
I'm contracted by a branch of a large multinational company to write some in-house software. I'm trying to push this software out to users using ClickOnce. To sign the application, I was issued a code ...
- 111
1
vote
2
answers
889
views
PKI - What is the equivalency of a Registration Authority (RA) in AD Certificate Services?
What is the equivalency of a Registration Authority (RA) in AD Certificate Services? I was reading documentation on TechNet (the best ever, jk) and it had explained that NDES was technically the ...
- 21
1
vote
1
answer
2k
views
How to enable LDAP over SSL/TLS in AD without installing AD Certificate Services
I am installing a Sonicwall firewall into my organization. I've connected the Sonicwall with the Active Directory domain, however now on the status page of the appliance there is a huge warning:
...
- 1,164
1
vote
0
answers
2k
views
How to setup digital signatures on Microsoft CA (AD-CS)?
I've been trying to research across the web on how to setup a Microsoft CA (AD-CS on Windows Server 2008 R2) in order to create a certificate for digital signatures, allowing you to digitally sign ...
- 111
1
vote
1
answer
3k
views
ADCS Create a new certificate or Rename?
Just joined a new company. Apparently back last year they got rid of the old CA and restored the certificate on a new server. (2003 to 2012).
I was about to renew the certificate (self signed) on the ...
- 41
1
vote
1
answer
531
views
How can I limit the SMIME capabilities from a CA without using FIM?
These instructions describe how to prevent using SMIME with weak ciphers, however it requires an expensive product from Microsoft.
How can I prevent a CA from issuing SMIME certificates that permit ...
- 8,961
1
vote
1
answer
2k
views
How to move CertSrv from "Default Web Site" to a new site in IIS?
I have installed Active Directory Certificate services and it has created a CertSrv application under "Default Web Site" and it is accessible using http(s)://[hostname]/certsrv.
I want to move ...
- 2,174
1
vote
0
answers
231
views
MySQL SSL Problems
I need to configure SSL for a MySQL server. I've read all of the directions for doing self-signed certs but it's preferred that I sign and use the certs from a different CA running AD Certificate ...
- 125
1
vote
0
answers
75
views
EFS file access problems
in my organization, i have a deadline to deploy EFS using AD CS, and i am working with a single windows server 2003 box, which is the Root CA, and is the same server responsible to certificate ...
- 11
1
vote
0
answers
2k
views
How do I set up an 802.1X infrastructure for use with OS X and iPads?
At my workplace I have been tasked with setting up machine certificate based 802.1X wireless authentication for our Apple devices. It seems like on the client side this will be handled by Profiles (...
1
vote
0
answers
814
views
Change name of Win Server 2008 computer after CA install
I am importing an old certificate database into the new CA on a new server I'm installing. I am warned by Windows that I can't change the computer name, domain settings, etc., after installing the CA. ...
- 225
1
vote
1
answer
9k
views
Problematic Active Directory CA certificate
i came across one DC, which gives me RPC errors when dealing with AD Certificate Service.I can see in AD there is 2 Root CA , one is problematic. Is it safe to remove it? Or is there a procedure for ...
- 21
0
votes
2
answers
270
views
Should a subordinate CA appear under the Trusted Root CA?
Recently I needed to setup PKI for VDI solution as smart card functionality was needed to handle SSO with Azure. I configured an offline Root CA and a domain joined subordinate CA per MS instructions ...
- 1
0
votes
0
answers
236
views
Issuing Certificate For Child Domain After Issuing One From Parent From Same CA
I am trying it issue a certificate as part of my Enrollment ability for a 2FA device for our child domain from our parent domain. I was able to do this months ago but now it won't let me do the child ...
- 835
0
votes
0
answers
87
views
Windows Certification Authority Autoenrollment when Issuance Requirements is set
I have domain computers CA template which autoenrolls to machines without issues
I activated Issuance Requirements
I can automatically renew existing certificates, but cannot automatically/manyally ...
- 115
0
votes
0
answers
66
views
Export pfx certificate after approving pending request
In Active Directory Certificate Authority I have template with CA certificate manager approval.
CA picture
When I approve a request I can not export issued certificates to pfx format. How can I export ...
- 1
0
votes
1
answer
132
views
CA: Certificate User for VPN
From a subordinate Enterprise CA I want to generate a user certificate that serves as an authentication method for VPN connections.
I want to install this certificate with autoenroll on the domain ...
- 39
0
votes
0
answers
326
views
Migrating a CA to a new server - CA services won't start
We have an Enterprise Root CA running on Server 2012 R2. I built a replacement server running Server 2019 and followed the steps in the below article, I backed up the CA and relevant registry keys, ...
- 1
0
votes
1
answer
2k
views
Creating a new root certificate with new key length on windows ad certificate services
Due to new corporate guidelines I need to update the root certificate of my CA so the key length is 4096bits (Currently 2048bits).
My CA is AD integrated and currently running on our DC.
So now I am ...
0
votes
0
answers
240
views
How to submit certificate request from Red Hat machine to Windows CA?
I’m looking for solution, which helps me send certificate request from domain-joined RedHat Enterprise Linux machine to Certification Authority on Windows Sever 2022. Is there any solution to do this? ...
- 19
0
votes
1
answer
617
views
Trouble setting up CES and CEP PKI in a trusted forest scenario
I have two AD domains with a two-way forest trust. I want computer accounts in DomainB to enroll for computer client auth certificates from the two-tier Windows CA in DomainA. I configured a ...
- 1
0
votes
1
answer
331
views
Must all services of ADCS run under the same service account on the same server?
While deploying ADCS, on the documentation Microsoft recommends using service accounts for the services making up ADCS. The problem is that it doesn't address if these should be individually managed, ...
- 133
0
votes
0
answers
3k
views
How to configure AD Certificate Services to get past this WS_E_ENDPOINT_ACCESS_DENIED error?
I have followed the Microsoft test lab instructions for setting up a two-tier CA hierarchy. I have the Certificate Enrollment Policy Web Service (CEP) installed on the same machine as the issuing ...
- 425
0
votes
1
answer
2k
views
Windows AD CA Code Signing Cert Request for Wrong User
I am having an odd problem with a Code Signing certificate request from my Windows 10 workstation. We have a Windows Server 2012R2 CA setup with the Code Signing template and everything works fine if ...
- 476
0
votes
1
answer
1k
views
MMC > Certificates > Other computers: Which firewall ports used for this?
I am having a windows firewall issue when trying to access the Certificate Store from another computer on the same domain using MMC or PowerShell. I am logged in as a domain admin. Both servers are ...
- 101
0
votes
1
answer
1k
views
Publish certificate in Active Directory not working as intended
I have an AD forest and one CA server. In the certificate template I have "Publish certificate in Active Directory" checkbox checked.
Also in the template, the Subject Name option is set to &...
- 133
0
votes
1
answer
632
views
LDAPS 636 Works on Domain Controllers except Azure Domain Controller
I have a Domain Controller (Server 2016) in Azure. The Azure network this system is on is connected via a Virtual network gateway (VPN) to the on-prem network and the network engineers have configured ...
