Questions tagged [certificate-authority]
In cryptography, a certificate authority, or certification authority, (CA) is an entity that issues digital certificates.
771
questions
0
votes
0
answers
19
views
CA root and CA subordinate administrator
I want to deploy a new PKI infrastructure on a domain that has several subdomains and trusted domains.
I would like to be able to delegate the administration between several administrators ...
- 11
0
votes
0
answers
27
views
Two Enterprise Root CA's on same domain
I am currently replacing 4 2012 domain controllers with 4 new 2022 domain controllers. I have run into an issue with the certificate authority as there were two enterprise root CA's installed on the ...
- 101
0
votes
0
answers
24
views
LDAPS, Certificate Authority, and Domain Controllers
I have a domain environment with 4 2012 Domain Controllers that I am working on replacing with 4 new 2022 domain controllers. I have some questions regarding how the CA works when issuing certificates ...
- 101
0
votes
1
answer
37
views
Windows Server 2019 ADCS. CA subordinate
I have a "CA1" server with Windows 2019 that has the CA root Enterprise service. Additionally I have another server "CA-Subordinate" with Windows 2019 with the CA subordinate ...
- 11
0
votes
0
answers
55
views
How to sign a certificate for s/mime and generate pkcs12 store with existing CA?
I want to create a certificate store file in pkcs12 format to use in thunderbird for s/mime signing and encrypting. I already run a mail and web server that use certificates signed by a CA certificate ...
- 136
0
votes
2
answers
92
views
Can I make strongSwan accept any certificate as long as it is only signed by a specific CA?
Using a swanctl config, is there a way to make strongSwan accept any certificate for an IKEv2 connection as long as it is signed by a specific CA? What I mean is, without having to install the public ...
- 869
0
votes
0
answers
75
views
Stuck trying to remove Certificate Authority role from a Windows 2019 AD domain controller
I am trying to remove the Certificate Authority role from a Windows 2019 AD domain controller and am stuck at Step 5, Item 4 "Delete the private key that is associated with the CA" of the ...
- 21
0
votes
2
answers
38
views
How to get a google issued certificate for my service behind l4 load balancer
I am running a mqtt broker behind gke LoadBalancer type service. The lb type service is a l4 load balancer and I need to handle the tls termination at my service/broker level.
I have associated an A ...
- 103
0
votes
2
answers
64
views
With multiple RDP certificates, do all get checked?
If a Windows host has multiple RDP certificates. Do all get checked while connecting or only the first found?
I have a RDP certificates deployed from an Root CA with now invalid OCSP location in the ...
- 83
0
votes
1
answer
79
views
Windows AD cert renewal implementation vs cert copying
Windows PKI policy has a setting for what I think is automated renewal of AD template issued certificates when they expire.
It must be also enabled on the certificate authority (CA) side. Question - ...
- 197
1
vote
1
answer
327
views
Error: error contacting notary server: x509: certificate signed by unknown authority
I am puzzled how docker and Notary work together. I can not sign image
docker pull nginx:latest
got
Error: error contacting notary server: x509: certificate signed by unknown authority
I followed ...
- 323
1
vote
1
answer
83
views
Windows Certificate Authority server
A default installation of a Microsoft PKI running Windows includes LDAP URL's as first within CRL distribution points (CDP's) and Authority Information Access (AIA).
Question 1 :
I want to issue a ...
-1
votes
1
answer
197
views
Redhat ubi8-micro container without trusted root ca certificates
I want to run a simple GO application on the registry.access.redhat.com/ubi8/ubi-micro image.
But unfortunately I get x509: certificate signed by unknown authority errors in my app because there it ...
- 183
0
votes
0
answers
40
views
Remote Desktop Gateway (RDG) Public CA certificate not trusted on external connection
Currently moving RDG role from "nene-server" to "NTRDG01, but when trying to connect externally to the gateway, getting certificate error:External error on gateway over https.
This was ...
0
votes
0
answers
359
views
K8s : nginx-ingress: SSL_do_handshake() failed (SSL: error:191CF08C:SSL routines:tls_parse_ctos_key_share:bad key share)
As we found out that the nginx ingress as well as the cert-manager were outdated and not compatible with the Kubernetes version of 1.22 anymore.
I upgrade the two components: nginx-ingress from 0.26.1 ...
- 29
0
votes
1
answer
41
views
Can we add a subordinate enterprise certificate authority linked to an existing enterprise Root certificate authority
The Root CA is domain joined.
The Sub CA will be domain joined.
The Sub CA will deliver workstation Authentification (template) to PC clients via GPO.
Is there any known issue with this configuration?
...
- 3
0
votes
2
answers
50
views
Can a CA generate a signed certificate for a host in to a top-level domain not under the CA's control?
Background
I need to replace an existing certificate on a host named h1.vx.mydomain.net (not the real domain obviously).
The existing certificate says it was issued by a chain of CAs that I do not ...
- 257
0
votes
0
answers
49
views
how to add Certificate Sign on .pem file under x509v3 Basic constraints
Could anyone please suggest me to add or remove Certificate Sign parameter which I marked in the below-mentioned picture?
I know it can be done on openssl.cnf file but couldn't able to identify the ...
- 11
0
votes
0
answers
59
views
Client side certificate cannot be installed on Apple ios. Error-"The authenticity of "cloudflare" cannot be verified"
We use client side Cloudflare certificate to allow or disallow access to our site since the site is meant to be used by a small group of users who are provided a Cloudflare client certificate.
Our ...
0
votes
0
answers
324
views
Nginx SSL private key error
I'm configuring Nginx with self-signed SSL certificate. Nginx fails to start due to the following error
[emerg] cannot load certificate key "/path/to/my.key": PEM_read_bio_PrivateKey() ...
0
votes
1
answer
119
views
Import Custom SSL Certificate in Zyxel GS1920-8HPv2
I have a problem with importing a server ssl cert for
https web connection on myZyxel GS1920-8HPv2.
On the WebGui of the Switch, there is an information, that the cert and key
has to be in a pkcs12 ...
- 1
2
votes
2
answers
263
views
create a self-signed certificate for a subdomain, the main domain does not belong to me
I have my internet box provider who offers me a free subdomain to connect to my network, ex: xxxxx.provider.com
I have generated a self-signed certificate for the subdomain foo.provider.com
I tried to ...
1
vote
1
answer
283
views
Windows Custom Certificate (certlm.msc) - Default Values
In windows server 2019, I create custom CSR by invoking certlm.msc, and selecting Personal -> All Tasks -> Advanced Operations -> Create Custom Request & then use the Certificate ...
- 15
0
votes
0
answers
89
views
Domain Certificate Authority Role On None Domain Controller
I am setting up a new domain and I need to setup a Root CA and a Certificate Authority to hand out certificates to domain computers as well as to handle certificate actions and secure communications. ...
- 811
0
votes
0
answers
27
views
2 Issuing CAs are Effected by Subnet Region
We are working to set up a 2-tier pki with 2 issuing CAs in different regions/subnets. We were able to get everything looking right on pkiview.msc. We are still having trouble though with the second ...
- 1
0
votes
0
answers
12
views
For an IoT device is there a way to associate a certificate authority that will not expire in a year so the device can roll certs periodically?
To me it is a chicken and egg thing. I want an architecture that will always have the device renewing keys on updates or periodically. Initially, I can have manufacturer setup the CA on the device. ...
0
votes
0
answers
267
views
Certificate Server Issues
We have 1 root server and 2 intermediate servers. We have been having issues where every year when it's time to renew user and computer certs issued from the intermediate servers, they do not renew ...
1
vote
1
answer
669
views
OpenVPN - Can client certificates and keys be created if you only have ca.crt
All servers are debian 9 linux. I have 200 servers with openvpn installed, each with three to four clients (tunnel 2)
clients ---> server1 (1 of 200) (also client for jumpserver) ---> jumpserver ...
- 73
0
votes
1
answer
226
views
Can a server certificate from a CA not have CRL URLs?
I'm trying create a validation for server certificates and one of the things I need to do is to check if the certificate is revoked, but the server certificates from a specific server seems to not ...
- 103
0
votes
0
answers
57
views
How do I fix missing or multiple CA certificates causing chain issues?
There is only one enterprise CA server. The server has 4 certificates configured under properties > general. These certificates show up in the local store of all domain computers under "...
- 177
-1
votes
1
answer
464
views
CertUtil: The directory service encountered an unknown failure. 0x800720ef (WIN32: 8431 ERROR_DS_UNKNOWN_ERROR)
I am trying to publish revoked certificates and I am getting an unknown failure when using the Certificate Authority console:
The Application Log in the Event Viewer:
It says:
Active Directory ...
- 99
0
votes
1
answer
439
views
Having trouble issuing the 2nd enterprise CA on the same offline Root CA as the 1st. Windows Server 2016
I am running into an issue and hoping someone can help me. We were asked to set up a new Root CA and 2 subordinate (issuing) CAs under it (the request includes using Azure and placing each VM in a ...
- 1
0
votes
0
answers
49
views
Certificate marked as "not trusted by CA
I have a rather surprising problem these last days on one of my certificates signed by my root CA (via AD-CS).
I noticed that my browser sends me back a message that I have never seen in place of my ...
- 1
-1
votes
1
answer
374
views
Cant Enroll/renew Certificate : Server 2008R2 as client ans Server 2019 as CA
I have an issue with all my 2008R2 servers, they can no longer enroll/renew certificates.
It works with windows 10 and server 2012 R2 as client.
Error is RPC not available.
From Event Viewer
L’...
- 145
0
votes
0
answers
18
views
Why does Acrobat list invalid local root CA certificates when I sign documents?
We use certificate signing in Acrobat internally in our org. An issue has come up when signing documents there is a banner that says "at least one signature has problems". Investigating ...
- 177
3
votes
1
answer
6k
views
Update CRL with OpenVPN server for longer expiration?
If the error "VERIFY ERROR: depth=0, error=CRL has expired" is received when a client attempts to connect to the OpenVPN server, it can be fixed as follows:
cd /etc/openvpn/easy-rsa
easyrsa ...
- 131
-1
votes
1
answer
237
views
How to have good SSL/TLS certificates without proxying through cloudflare?
I currently have a site hosted on my local raspberry pi, and I have my domain registered through cloudflare. I would also like to be able to use PiVPN to access the contents of the VPS when I am away ...
- 99
0
votes
1
answer
61
views
Deprecation of OrganizationalUnit in Subject of TLS Certificates
Recently we got a mail from our certificate provider that they are removing the OU field from Subject of new/renewed certificates after 1st September.
This is related to decision made by Certificate ...
1
vote
2
answers
531
views
How to Delete CRL Files in Local Cert Store
I need to import CRL files to a Bastion server that is not part of my environments domain. The CRL files are updated every few days so a new copy needs to be imported to the local cert store on the ...
- 668
2
votes
1
answer
750
views
openssl - cross sign certificate
I want to cross-sign a third-party root ca (third-party-ca) with my own root ca (r1). (Background: restricting usage)
To do this, I use
openssl x509-in third-party-ca.crt -CA /etc/pki/r1/ca.crt -CAkey ...
- 4,133
0
votes
2
answers
210
views
How can I set the ACL of a CA programmatically?
When launching the CA console (certsrv.msc), I can right-click on my CA, select Properties and then I can modify the ACL of my CA in the Security tab. When I modify it, the changes are applied to the ...
- 556
0
votes
1
answer
1k
views
Domain Member Servers - Accessing Certificate Revocation List (CRL)
In my environment I have a Enterprise Root CA installed on a domain controller and a separate domain controller configured as a Subordinate CA - I know this isn't recommended for security reasons but ...
- 668
0
votes
1
answer
716
views
Generate CA signed ECDSA certificate
I need a CA signed ECDSA certificate for testing purposes.
I am able to generate an ECDSA certificate and key but I have never signed one.
I use OpenSSL in a Windows environment to generate ...
0
votes
2
answers
2k
views
Windows Certificate Authority - Adding Additional Attributes
In AD Certificate Templates the templates have an option to build from AD information and includes Email, DNS, UPN, etc.
When creating a CSR using powershell, openssl and the certificate mmc snap-in ...
- 668
1
vote
0
answers
798
views
NET::ERR_CERT_AUTHORITY_INVALID error in Chrome but not in Firefox
I'm using AWS and I have requested an ACM certificate. I used DNS validation to make it a valid cert. Now I've attached it to a private ALB.
The URL is private.
When I connect with my VPN and I can ...
- 303
0
votes
1
answer
2k
views
The certificate request was submitted to the online authority, but was not issued. The request was denied
I've a Hyper-V lab with few VMs. I'm trying to renew expired server certificate for one of my virtual machines which is running Windows Server 2019 (version 1809). I'm trying to renew the certificate ...
- 243
0
votes
1
answer
119
views
How does OCSP handle deleted certificates?
We have a Microsoft Certificate Authority running on Windows Server 2019. We are issuing certificates to Android devices via a MDM. The Android device users browse to a web application (hosted by ...
2
votes
2
answers
521
views
GPO to add a purpose to root certificate
The root certificate of the DFN-PKI "T-TeleSec GlobalRoot Class 2" is not activated in the Windows certificate store for the certificate purpose "code signing".
I can activate it ...
- 305
0
votes
1
answer
324
views
Non-working Windows server 2003 Enterprise CA removal
Amongst a bunch of server, I have a Windows 2003 server, domain controller, Enterprise CA installed, cannot start CA service, because "a required certificate is not within its validity period ...
- 3
1
vote
1
answer
725
views
How do I sign my own SSL certificates so that they cover www and non-www domain names?
When using a commercial Certificate Authority, generating a csr for the common name www.mysite.com and sending it to them will result in a certificate being issued that works for both www.mysite.com ...
- 4,503