Questions tagged [certificate-authority]

In cryptography, a certificate authority, or certification authority, (CA) is an entity that issues digital certificates.

Filter by
Sorted by
Tagged with
0 votes
0 answers
6 views

Windows Firewall Connection Security Rule setup certificate authentication using thumbprint

Unable to setup thumbprint because once I configure to Validation only, client machine getting error. Here are the sample screenshot of my Connection Security Rule setup. Selection Setup enter image ...
user avatar
0 votes
2 answers
25 views

How can I set the ACL of a CA programmatically?

When launching the CA console (certsrv.msc), I can right-click on my CA, select Properties and then I can modify the ACL of my CA in the Security tab. When I modify it, the changes are applied to the ...
user avatar
0 votes
0 answers
14 views

Would SCCM require a second SubCA when using HTTPS with 2 domains?

I have a domain called one.local. It already has it's own Windows Root CA and SubCA. There is a second domain called two.local that is using SSCM. The team that is managing two.local wants to manage ...
user avatar
  • 101
0 votes
1 answer
28 views

Domain Member Servers - Accessing Certificate Revocation List (CRL)

In my environment I have a Enterprise Root CA installed on a domain controller and a separate domain controller configured as a Subordinate CA - I know this isn't recommended for security reasons but ...
user avatar
  • 578
0 votes
1 answer
8 views

Generate CA signed ECDSA certificate

I need a CA signed ECDSA certificate for testing purposes. I am able to generate an ECDSA certificate and key but I have never signed one. I use OpenSSL in a Windows environment to generate ...
user avatar
0 votes
1 answer
24 views

Windows Certificate Authority - Adding Additional Attributes

In AD Certificate Templates the templates have an option to build from AD information and includes Email, DNS, UPN, etc. When creating a CSR using powershell, openssl and the certificate mmc snap-in ...
user avatar
  • 578
0 votes
0 answers
54 views

NET::ERR_CERT_AUTHORITY_INVALID error in Chrome but not in Firefox

I'm using AWS and I have requested an ACM certificate. I used DNS validation to make it a valid cert. Now I've attached it to a private ALB. The URL is private. When I connect with my VPN and I can ...
user avatar
  • 283
0 votes
1 answer
88 views

The certificate request was submitted to the online authority, but was not issued. The request was denied

I've a Hyper-V lab with few VMs. I'm trying to renew expired server certificate for one of my virtual machines which is running Windows Server 2019 (version 1809). I'm trying to renew the certificate ...
user avatar
  • 225
0 votes
1 answer
28 views

How does OCSP handle deleted certificates?

We have a Microsoft Certificate Authority running on Windows Server 2019. We are issuing certificates to Android devices via a MDM. The Android device users browse to a web application (hosted by ...
user avatar
2 votes
2 answers
30 views

GPO to add a purpose to root certificate

The root certificate of the DFN-PKI "T-TeleSec GlobalRoot Class 2" is not activated in the Windows certificate store for the certificate purpose "code signing". I can activate it ...
user avatar
  • 295
0 votes
1 answer
49 views

Non-working Windows server 2003 Enterprise CA removal

Amongst a bunch of server, I have a Windows 2003 server, domain controller, Enterprise CA installed, cannot start CA service, because "a required certificate is not within its validity period ...
user avatar
0 votes
0 answers
28 views

Renewing domain CA SSL/SSTP Certificate from non-domain Clients

I have a VPN setup using RRAS/SSTP to authenticate clients. However, some of the clients are connecting via personal computers which are not joined to the domain. Initial setup was done by manually ...
user avatar
  • 1
1 vote
1 answer
82 views

How do I sign my own SSL certificates so that they cover www and non-www domain names?

When using a commercial Certificate Authority, generating a csr for the common name www.mysite.com and sending it to them will result in a certificate being issued that works for both www.mysite.com ...
user avatar
  • 4,413
0 votes
2 answers
39 views

Is it necessary to include a CA file reference in my Apache vhost config block?

I'm upgrading my Apache web server and wondering if I even need to declare a CA file in the vhost config? My vhost setup is SSLEngine on SSLCertificateFile /home/user/ssl/${SITE}-cert.pem ...
user avatar
  • 1,374
0 votes
1 answer
264 views

Laptop asking for "action needed" on NPS Computer auth WiFi connect, despite valid Server Thumbprint

I have configured computer authentication on WiFi connect to company network, using the microsoft nps server, group policy certificate auto-enrollment and group-policy wifi config. Has been working ...
user avatar
  • 944
0 votes
1 answer
79 views

Parent Domain Certificate Authority For Child Domains

I have a parent domain and 2 child domains of that parent. All servers are Windows Server 2019. I am working on deploying security software and I need to obtain a valid certificate from the ...
user avatar
  • 761
0 votes
1 answer
847 views

curl: (60) server certificate verification failed CRLfile: none

I'm slowly transitioning from an exclusive developer role and into more of a hybrid DevOps role at my company. Which means I'm new to a lot of this, please go easy on me... :-p My client's server is ...
user avatar
  • 101
0 votes
1 answer
278 views

How to Properly Migrate Active Directory Certificate Services

I have Active Directory Certificate Services installed on a Windows 2016 domain controller. We plan on spinning up Windows 2019 instances to replace our 2016 domain controllers. We have one DC with ...
user avatar
  • 578
1 vote
1 answer
75 views

What does the "crt" abbreviation mean in certificates?

I can find what all the other abbreviations mean like PEM and CSR as is mentioned here: https://pki-tutorial.readthedocs.io/en/latest/index.html but what does CRT stand for?
user avatar
  • 113
3 votes
1 answer
260 views

Domain Controller autoenrollment - changing issuing CA

We are cleaning up our Windows PKI/CA environment and replacing our root CA with a new server. The current root CA has been issuing the following certificate templates for years now (in addition to ...
user avatar
  • 32.2k
0 votes
0 answers
70 views

FreeRadius with mixed CAs

Is it possible to run FreeRadius (version 3.0.13) with two different CAs? So that I have a server certificate from one CA and the client certificates come from a different CA? Our current setup in /...
user avatar
  • 135
0 votes
1 answer
30 views

aws client vpn - choice of certificate authority

I am tasked to research on how to use aws client vpn service. After some reading I am a bit confused with the choice of certificate. It seems to use the client vpn, we will need to use aws private CA, ...
user avatar
  • 169
1 vote
1 answer
515 views

Replace Self Signed RDP Cert with CA Signed Cert

A few servers are getting picked up by security scans with the following message: The following certificate was at the top of the certificate chain sent by the remote host, but it is signed by an ...
user avatar
  • 578
0 votes
0 answers
16 views

How long are certificates available in ADCS Web Enrollment page after issued

I have a windows 2008 enterprise ADCS server with web enrollment. I want to know/configure how long do issued certificates last on the page before a user has to submit another request. While ...
user avatar
1 vote
2 answers
430 views

NET::ERR_CERT_AUTHORITY_INVALID with self-signed CA in Windows

I created a (self-signed) root certificate and signed a web server certificate using a system I developed in Java (the web certificate is used in Apache 2.4.41). The certificates work without issues ...
user avatar
  • 466
0 votes
0 answers
33 views

created a new offline root CA . All of the certs that are based off of this ca cert root for fail, when used on non Microsoft systems

The reason it is failing is because I used a Microsoft example as the the policy.inf file. I edited the file to match my data but I left in the line: AlternateSignatureAlgorithm=1 How do I fix this ...
user avatar
0 votes
0 answers
184 views

Submitting CSR to Microsoft CA from linux bash best practice

Similar questions: https://stackoverflow.com/questions/31283476/submitting-base64-csr-to-a-microsoft-ca-via-curl The link above presents an answer but it is far too complicated for me. Below is an ...
user avatar
0 votes
1 answer
69 views

How networking secures the connection between Certificate Authority and Client? [closed]

I know HTTPS is based on the Certificate Authority (CA). If a client tries to send a request to a server (Assuming there is a Certificate), is it possible that a middleman can take the certificate ...
user avatar
  • 103
0 votes
1 answer
532 views

Steps to update certificate in edge servers

Onprem mailbox servers is in exchange 2013 and edge servers in dmz. Can someone please share the steps to renew third part cert in edge servers. I am unable to find a ms article. Please help
user avatar
  • 1
0 votes
1 answer
28 views

How does XCEP policy (XML) define SubjectType for User or Computer constraint?

We've developed our own implementation of a XCEP/CES WCF service that uses a combination of our certificate management solution and the Microsoft CA to issue the certificates. The standard XCEP XML ...
user avatar
0 votes
1 answer
27 views

CentOS Certificate Authority increase key strength

I have a self signed CA that I have been using for several years. Certs that I sign/issue these days for our LAN are now getting warnings in Chrome due to "Weak Key". Is there a ...
user avatar
  • 1,327
1 vote
1 answer
135 views

CA Recovery in Active Directory

I think I understand, but I want to be sure. We are running two Windows 2016 domain controllers (VMs), one of which is performing the role of a certificate server. We perform system state backups ...
user avatar
  • 13
1 vote
1 answer
925 views

hashicorp vault - load pre-existing CA certificate into PKI engine

I'm looking to migrate a process that generates client certificates from a custom root CA into hashicorp vault. The root is already trusted by a lot of applications, so I'd like to import it (or an ...
user avatar
0 votes
1 answer
88 views

Chrome not trusting self-signed cert

I have mutual TLS enabled on my nginx reverse proxy. I can view the site only when I have the client cert and custom CA installed in my keychain. This works in Safari and Chrome. However, in Chrome it ...
user avatar
  • 115
0 votes
1 answer
27 views

Safe to start CA-server past its tombstone?

I have a CA-server that has been offline for 185 days, so past the tombstone period of 180 days. Is it safe to start it up, or is there a high chance I will mess up my domain? The only roles installed ...
user avatar
1 vote
1 answer
87 views

Instaliing microsoft ADCS using brainpool ECC keys

I got a request from a custumer to install ADCS using ECDSA while using a specific ECC curve for the keys (bp384r1). This curve is not listed in the ADCS installation process when creating a new key ...
user avatar
1 vote
0 answers
2k views

Why does Debian 11 still have the expired DST Root CA X3 certificate?

On an up-to-date Debian 11 server, I noticed the expired DST Root CA X3 certificate is still present: $ grep DST /etc/ca-certificates.conf mozilla/DST_Root_CA_X3.crt This certificate is expired ...
user avatar
  • 111
1 vote
1 answer
2k views

User agents not trusting web server due to Let's Encrypt DST Root CA X3 root certificate expiration

I handle a NodeJS server with an SSL certificate issued by Let's Encrypt. It works on some clients (Safari and Firefox on my macOS) and not others (curl on my macOS, Safari on iOS). The notice on iOS ...
user avatar
1 vote
0 answers
473 views

Why does Chrome on Windows 7 still display the old root certificate?

Early this morning, I updated (with win-acme) the web server's (IIS 8.5) SSL certificate due to the known problem of Let's Encrypt with the expiration of the its root certificate (DST Root CA X3). So ...
user avatar
1 vote
1 answer
2k views

How do I fix "No usable signing certificates are available" in VBA?

We have a VBA script in Outlook that generates a popup when sending external emails. Apparently the script's signature expired over the weekend. The person who signed it is no longer here. I see ...
user avatar
0 votes
0 answers
163 views

Generate CSR including certificate template information with OpenSSL/Keytool for submitting to Microsoft CA

i'm trying to generate a CSR which includes the microsoft template CA name. i have tried the below config file but didn't work...any clues ? i want to generate the x509v3 CSR oid_section = OIDs [ OIDs ...
user avatar
0 votes
1 answer
60 views

Transfering ssl certificate issued by a Windows Domain Controller CA to another machine running IIS

I have two AD servers in a domain, both running Windows Server 2019, the second is a Core server configured as a RODC. I have the main server working as a Certification Authority, where I'm supposed ...
user avatar
0 votes
2 answers
135 views

How to Create a SSL Key and a SSL Cert from a Given CA File (Certificate Authority)

I Need to create a encrypted db connection to the Azure Cloud MySQL Servers, They have given us a CA certificate called "BaltimoreCyberTrustRoot.crt.pem" to use when connecting with the ...
user avatar
  • 3,845
0 votes
0 answers
103 views

Automatically updating the CRL for pfSense

I want to be able to automatically update the certificate revocation list on a virtual pfSense server running OpenVPN. I don't want the certificate authority to be on the same vpn server, but if ...
user avatar
  • 365
0 votes
1 answer
66 views

PKI trust in Active Directory

Assuming that the certificate of the ADCS CAs joined to a given domain are signed by an offline root CA which is then trusted by all systems in the domain/forest. If that offline root was then used to ...
user avatar
  • 51
2 votes
0 answers
34 views

Which clients support self-signed certificates with DANE?

We've been considering to make more use of DANE as a decentralised authority for our certificates. Especially with S/MIME. However, the key obstacle is... how widely are DANE treated as an authority ...
user avatar
0 votes
0 answers
24 views

Windows Domain Controller - SSL Cert with Two Hosts In Subj. Alternative Name (SAN)

My Domain Controllers auto enroll and get a Computerv2 cert that handles server authentication. One of the apps we use requires an SSL cert with a SAN that contains multiple hosts. I know how to ...
user avatar
  • 101
0 votes
0 answers
20 views

Azure storage account enable file listing over HTTP

I want to publish the domain CRL to an Azure Storage Account as this has the benefits of being highly available. For the storage account, is it required to have the HTTP endpoint allow file listing. ...
user avatar
  • 647
0 votes
2 answers
261 views

Retire internal Windows root CA

A former colleague created an internal root CA named CA1 with server2008. During migration to a newer OS version a Server CA2 was created and CA1 turned off. Now my problem is, all systems still think ...
user avatar
0 votes
1 answer
116 views

Installing a PFX with bundle-ca included, do I still have to install the ca-authority in root?

I have a Windows web server, and usually I install the ca-authority in "LocalMachine\Root" and the intermediary PFX certificate in "LocalMachine\My", everything works well. Now I ...
user avatar
  • 211

1
2 3 4 5
15