Questions tagged [certificate-authority]

In cryptography, a certificate authority, or certification authority, (CA) is an entity that issues digital certificates.

Filter by
Sorted by
Tagged with
1
vote
0answers
9 views

Certificate Auto-Enrollment for AD User When Requested by Service Account

I have one AD server and Microsoft Certification Authority in a domain. I also have a service account in AD which can request for client authentication certificate to be generated for any user. ...
0
votes
1answer
18 views

Is my CA doing anything?

One of our DC's is running the CA role. It was installed a long time ago, and I don't think it serves a purpose anymore. I would like to remove the role, but is there a way to determine if in fact ...
0
votes
1answer
27 views

Can we use CA signed certificate like let's encrypt in softether vpn server?

I am trying to attach let's encrypt certificate to my softether vpn server, But didn't found a way for it. Can we use CA signed certificate like let's encrypt in vpn server ? If yes, then please ...
0
votes
2answers
295 views

FreeIPA Intermediate CA Certificate Expired

We have 2 FreeIPA servers running in our network, today we found this: https://support.sectigo.com/articles/Knowledge/Sectigo-AddTrust-External-CA-Root-Expiring-May-30-2020 One of the intermediate ...
0
votes
0answers
31 views

This computer can't connect to the remote computer. Unknown key usage (1.3.6.1.4.1.311.54.1.2)

I'm unable to RDP to a server on our child domain after adding a Remote desktop certificate that is signed by one of our Certificate authorities. We have intentionally removed the self-signed RDP ...
0
votes
0answers
19 views

TCP Window with large SSL Packets. Distinguished Names Length 10kb

We are troubleshooting network latency related to SSL Handshake. This doesn't necessarily cause the delay every time but in some cases, Server take 5-10 seconds just to start sending first SSL packet ...
1
vote
0answers
24 views

Disable general public key authentication but allow SSH via CA

I would like to disable general pubKey authentication on my server and only allow auth via signed SSH CA (cert authority). To enable SSH via CA you add this line: TrustedUserCAKeys /etc/ssh/trusted-...
0
votes
0answers
28 views

What is the verification process with OpenSSL PKCS7_NOCHAIN flag

Im confused with the meaning of OpenSSL verify flag PKCS7_NOCHAIN. By definition it says: If PKCS7_NOCHAIN is set then the certificates contained in the message are not used as untrusted CAs. ...
1
vote
0answers
23 views

Migrating Root Certificate Authority

I got thrown into the middle of a CA migration project. My co-workers are migrating a Root Certificate Authority off a 2008 R2 server and onto a new 2019 server. They have both servers running at the ...
2
votes
1answer
67 views

Certbot: Issuing a certfiicate for internal IP address with my own PKI?

I am running my own ACME CA server that allows issuing of certificates to IP addresses. I have installed the root certificate into all the devices in my LAN. Let's say that I am running the server at ...
4
votes
1answer
385 views

Is the subdomain _acme-challenge protected?

I was looking into the DNS-01 challenge of Let's Encrypt; and I had a question about the sub domain process [1]. Let's say, the website example.com gives away free subdomains; what stops me to ...
0
votes
0answers
35 views

Microsoft NDES Automated Challenge Password retrieval

We recently implemented NDES and we are looking for a way to automate the challenge password retrieval with dynamic passwords as apposed to using a static password. However from my search on the ...
0
votes
0answers
17 views

Key attestation and Standalone Root CA

We are about to build a new PKI infrastructure and We are examinig different options for HSMs. One option is based on HSM partitioning, where one partition will be used for the standalone root ca, ...
0
votes
1answer
33 views

Which CA certificates to send, if you have multiple trust paths?

I've come across this setting for the first time: My server certificate is signed by INTERMEDIATE-CA1, which, in turn, is signed by ROOT-CA1. ROOT-CA1 is in the trust store of my Browser/OS. That ...
0
votes
1answer
55 views

Requirements for certificates to sign PDFs in Adobe Reader?

I'm trying to set up PDF digital signatures using certificates generated by openssl. I have generated a CA certificate, and used that to sign end user certificates, which I archive in PKCS#12 format. ...
0
votes
0answers
28 views

Error generating client certificate using openssl

Getting this error with openssl 1.1.1d when using the CA generated as shown: openssl req -new -x509 -config ca.cnf -newkey rsa:4096 -sha256 -nodes -out ca-certificate.pem -outform PEM openssl req -...
1
vote
1answer
49 views

Active Directory Certificate Services autorenew

I have an LDAP application which needs to talk to Active Directory via LDAPS (LDAP over SSL). I installed Active Directory Certificate Services on a test Domain Controller (I know this is not best ...
0
votes
1answer
127 views

Authorize Multiple Authorities (CA) in OpenVPN

Desiring to transfer to a new Certificate Authority, I want to allow old clients to connect the VPN for some overlap time. Can I do this without running separate OpenVPN instances? I see that I can ...
1
vote
1answer
268 views

How to tell domain controllers to not enroll a “Kerberos Authentication” certificate?

As per this question, I have an environment where certificates based on the "Kerberos Authentication" template cannot be issued (there are remote sites without direct connectivity to the CA, ...
5
votes
2answers
463 views

Error enrolling “Kerberos Authentication” certificate in a sparse network

I'm currently working on implementing an Enterprise Certification Authority for a customer whose network is not fully connected; it spans several geographical sites, and some of them don't have ...
0
votes
0answers
29 views

What does it mean when I can't locally verify SSL certificates?

Given that the webserver certs are correct (trying to connect to serverfault.com for example) And that my local CA store, as a client, is valid Where in the connection pipeline will a SSL ...
1
vote
0answers
33 views

What FreeIPA certificate profile is appropriate to issue a certificate for a VMWare VMCA instance?

This relates to my earlier question on why FreeIPA would not sign a CSR for an intermediate CA. I ask what certificate profile would be appropriate to sign an intermediate certificate signing request, ...
0
votes
0answers
39 views

Certificate renewal caching in clients

I did a regular certificate renewal with digicert and deployed a new certificate to our system. But it looks like some clients using openssl instead of schannel had problems updating and validating ...
0
votes
0answers
41 views

How to update certificate if API gateway connecting to RDS via lambda

AWS is emailing me to update the CA certificate of RDS and simultaneously update the client SSL which is making connection to RDS. According to the documentation I understood that I need to download ...
1
vote
1answer
120 views

CFSSL to start with intermediate certificate

I am trying to setup CFSSL (v1.4.1), after following this tutorial I have generated following files (self-sign) ROOT_CA_CSR.json intermediate_ca-key.pem intermediate_ca.csr intermediate_ca.pem ...
0
votes
0answers
33 views

Windows CA Migration - Testing the Backup

I need to migrate our Certificate Services from one server to a new one. I am following a guide and there is the stage where you backup the old CA. How do you test that backup? I want to be able to ...
0
votes
0answers
27 views

Certificate Authentication “The request was aborted: Could not create SSL/TLS secure channel.”

We have imported a .pfx certificate under Personal store. It creates Root, Intermediate and Client certificate in Personal store. This certificate is used for authentication to an API which works ...
0
votes
0answers
24 views

Aggregate the Intermediate CAs certificate to System Certificates Store

I recently received an API documentation, it came with customer certificate and the instructions says, Symantec signs the server certificates of the Platform in Preproduction and Digicert in ...
0
votes
0answers
81 views

OpenSSL - Output PEM encoded part only when signing a certificate request

I've set up my own Certificate Authority based on a Debian 10 system and I can successfully sign certificates. But when I do so by using the command openssl ca -in /root/ca/certreqs/domain.tld.csr -...
2
votes
0answers
43 views

secondary fqdn for certificate authority [closed]

I have a CA that is serving computer clients successfully and NPS (Etc.) is all fine. We are currently looking to move some services outside of the network perimeter and I would like to create a ...
1
vote
0answers
83 views

An X509 certificate with easyrsa with CN only (no SAN)

I'm trying to create a certificate with the hostname in the CN, without using a SAN. I know it is a deprecated, but I'm still interested in doing so for an old legacy project. ./easyrsa init-pki ./...
26
votes
2answers
4k views

Can a server certificate expire after its issuer?

Most if not all server certificates that I work with expire before its issuer, but is it possible for a server certificate to expire after its issuer and does this apply to an intermediate certificate ...
0
votes
1answer
35 views

Is the private key for S/MIME certificates generated on the CA servers or in the browser?

I heard that some certificate authorities generate your private key for S/MIME certificates on their servers. However, some of them who recommend using Internet Explorer for this purpose, probably, ...
0
votes
0answers
19 views

How is the signature of an email S/MIME certificate verified?

To my knowledge, the signature of an SSL certificate is verified by the public keys of root certificates that are installed in the browser certificate storage. How are signatures of the S/MIME ...
0
votes
2answers
268 views

Have the Certificate Signing Request (CSR) signed by a Freeipa CA

We have a certificate authority with Freeipa and I try to put in place a subordinate CA with Freeipa too. I started the installation of the subordinate CA with the ipa-server-install --external-ca ...
0
votes
0answers
27 views

Windows Certificate Authority - Restored to a Server with different name

I am working on a customers DC and their CA has been restored from an old Windows 2008 R2 VM. Whoever did it, didn't properly migrate, and now it has the old name and is not letting me create ...
1
vote
0answers
76 views

How can I purchase a document signing certificate to sign/certify PDFs on AWS? [closed]

I'm working a service that fills/generates/signs PDF documents. Users will draw their signature (or type their name) on a web interface, and then my servers will generate the signed PDF. I would like ...
2
votes
1answer
128 views

AD CS Configuration Using Install-AdcsCertificationAuthority Cmdlet

I am trying to configure a subordinate CA using a .PFX file with PowerShell. I am using the below parameters: $params = @{ CAType = "EnterpriseSubordinateCA" Credential = $credential ...
0
votes
0answers
15 views

S/MIME Certificate has expired and I am unable to Re-Issue

Screenshot of Certificates Snap-in (Local Computer) Screenshot of GPO Hello, I have a Windows Server 2012 R2 machine that is our internal CA server. I have a GPO to push a Secure Email certificate ...
2
votes
1answer
36 views

Windows Server 2012 Certification Authority : where to install?

In my environment I've this servers: Windows server 2012 R2 Domain Controller Windows server 2012 R2 Remote Desktop host many linux server I want to deploy my certificates from local authority and ...
1
vote
0answers
97 views

Unable to Backup or Restore Certificate Authority?

I migrated Certificate Authority Enterprise from windows server 2012 R2 to Windows Server 2019. Both Server are VMs Here are the steps I took: Baskup CA database, key and registry config of the ...
1
vote
2answers
137 views

Using SHA-256 in policy INF file

I have a CA policy inf file for an offline certificate request: [Version] Signature="$Windows NT$" [PolicyStatementExtension] Policies=InternalPolicy [InternalPolicy] OID=1.2.3.4.1455.67.89....
0
votes
0answers
46 views

Can a auto login Oracle Wallet (cwallet.sso) be used to provide trust store certificates for Weblogic?

I am trying to configure a Weblogic server using weblogic scripting tool. All my trusted certificates are in a autologin Oracle Wallet. I am assuming Oracle technologies will work with each other but ...
0
votes
0answers
37 views

Can't secure my Gitlab with self-signed SSL because browsers don't accept it

I am trying to secure my Gitlab server with self signed certificates and I fail over and over again because the browsers refuse to trust my certificates. What works is Chrome combined with Mac. I ...
1
vote
1answer
224 views

SSH CA-signed key fails via bastion

I'm setting up some servers for a new system and decided to do things a little bit differently. I'm running into an issue that I just can't seem to get past though. My desired configuration is having ...
0
votes
0answers
481 views

nginx - self-signed certificate signed by a self signed root ca is not accepted

I want to set up a CA for my local network. The root certificate should be installed on various devices (iPhone, Windows PC, MacBook). With a server certificate I want to secure the traffic between ...
2
votes
0answers
377 views

Automatically renew certificate: Old cert gets archived, but no new one is issued

We are using Active Directory Certificate Services (AD CS) to issue certificates for internal web applications. We can manually request a certificate from the CA and it gets issued without problems. ...
-2
votes
1answer
49 views

Create Certificate using ssh_keygen and letsEncrypt for IIS

I am pretty new to public-private key and creating certificates so I wanted to write out my thinking and see if I have the correct approach. 1) Use ssh_keygen to create a key pair. I have basic git-...
0
votes
1answer
116 views

Root CA DOESN'T WORK in Internet Explorer 11 - but DOES work in Edge, Firefox

On a few user's workstations, I'm seeing an issue. Though this "Root CA" is in the Trusted Root Certification Authorities Store, for both their machine and their user, IE11 will not trust this ...
0
votes
1answer
53 views

Getting CA signed SSL certificates for Windows servers on internal network

I'm hitting a wall here so need some help. I am currently involved in a project that will require use of a third party software installed on one of our internal servers. The software in question ...

1
2 3 4 5
14