Questions tagged [certificate-authority]
In cryptography, a certificate authority, or certification authority, (CA) is an entity that issues digital certificates.
701
questions
2
votes
1answer
38 views
Windows Certificate Authority Server runaway issuing certs
In our environment, we have a Windows Certificate Authority server. We've distributed our CA to our folks, and generated some certificates with CSRs for internal websites. That works great. We tried ...
0
votes
0answers
46 views
Submit SPKAC with subject to standalone ADCS
Microsoft's documentation suggests that it's possible to include a subject with a SPKAC CSR - https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-wcce/f88ecd9a-26bb-4b74-a471-4c46e773f75b.
...
0
votes
0answers
17 views
Why autoenrollment of some certificates out of the box in Windows Server with CA installed
I have learned that I have to do three things to start autoenrollment of certificates:
activate a template with autoenrollment and grant permissions on security tab for those users/ computers
Issue ...
0
votes
1answer
25 views
Certificates explanation for VPN Server Edgerouter + IPSec/IKEv2 + Active Directory Certification Authority
I’m trying to setup a IPSec/IKEv2 VPN Server for roadwarriors on my EdgeRouter 6P which has Linux Strongswan 5.6.3 on board, with Active Directory CA as TRUSTED ROOT CA and Microsoft NPS as Radius for ...
-1
votes
1answer
66 views
MTLS on Nginx that works with client side Android Apps?
Is there a way to pull off MTLS/Two-Way SSL/Client Certificates that work on unrooted v10+ Android Clients on the cheap?
I have a couple of personal api end points that I want to be publicly ...
1
vote
1answer
30 views
No certificate templates in Certificate Services server on Windows 2019
There are a lot of discussions on here about this problem, and I have spent all day exploring every one of them. All the servers involved in this are Windows 2019. 2 domain controllers and a ...
0
votes
0answers
26 views
Why have both CERT and TLSA DNS RR?
I know of at least 2 DNS resource record types that serve the purpose of enabling domain owners the ability to control approved/revoked certificates either self-signed or by CA's namely the CERT and ...
0
votes
0answers
19 views
Create EJBCA subCA during EJBCA installation
I am learning how to install and use EJBCA to deploy an enterprise PKI. I know I can install EJBCA using a quick install configuring the script ejbca-setup like is explained here, and I also have ...
0
votes
1answer
87 views
Does DANE allow for trustable self-signed certificates?
DANE has 4 modes of operation indexed 0-3 with mode 3 i.e. Domain issued certificate allowing for self-signed certificates. Can this mode be used in a trustable manner? and if so does that mean that ...
0
votes
1answer
51 views
Certificate Enrollment Error The Specified File Is Read Only
Well. It seems the entire internet has never seen this error before.
I have a Windows Enterprise PKI infrastructure. I have made a copy of the CEP Encryption template, and changed the security ...
0
votes
1answer
135 views
Failure renewing root CA certificate - 0x80090016 NTE_BAD_KEYSET
We have a multi-tiered PKI infrastructure with a standalone, offline Root CA. Every year we go through a process of extending the root CA certificate (renewing while reusing existing keys) and ...
0
votes
1answer
35 views
Autorenew not working when setting up key based renewal - Cep/CES
I am trying to configure Key Based renewal using WES to support autorenwal of certificates in workgroup computers and untrusted domains.
I have configured CEP (Certificate Authenticatoin, Key Based ...
0
votes
0answers
26 views
Microsoft CA Web Enrollment authentication issues
Currently i have a separate server configured for web enrollment with open trust delegation from the enterprise CA. (using kerberos only)
However, when i require windows authentication for the web ...
0
votes
0answers
25 views
3 Windows CA servers - needs to consolidate into one
Currently, we have 3 CA servers (two Windows 2012 servers one of which is also DC and one Windows 2016). We would like to export all active certificates from two Windows 2012 servers and then remove ...
0
votes
1answer
16 views
How to remove a “not safe” flag when getting into a RHEL cockpit portal on my intranet (AD based)?
I have an ERP server hosted on RHEL 8.3, and for management I use cockpit portal from my web browser.
Everytime I enter to this portal I get a message saying the website is not trustable, and I want ...
0
votes
0answers
80 views
SSL Root CA certificate is not recognized, although present in the trust store
We need to implement MTLS on nodejs - client side.
This is my code:
const fs = require('fs')
, path = require('path')
, certFile = fs.readFileSync('./client.crt')
, keyFile = fs....
0
votes
1answer
32 views
Upgrading certificate template schema
I need to update one of my Active Directory Certificate Services (ADCS) certificate templates from schema v2 to v3, to support KSP providers. It seems that I can only do this by cloning the template (...
0
votes
1answer
36 views
Verifying Certificate is installed on all computers in an OU - Powershell
I'm trying to confirm a certain certificate is installed on all computer in the Trusted Root Certification Authority folder. This is what I have so far:
$Computers = Get-ADComputer -Filter {...
0
votes
0answers
109 views
ca-certificates.crt doesn't include my custom CA certificate after “sudo update-ca-certificates”
I'm trying to install the public CA certificate of a 3rd party service, onto a Debian instance. I'm doing this so that the SSL certificate of the 3rd party service that I'm connecting to can be ...
2
votes
1answer
60 views
Windows Certificate Authority - Auto Enroll RDP certificates trusted CA error
So I'm running into an odd issue. I just setup a Windows Certificate Authority server and am able to use the web interface to issue Web SSL certs. My Fortigate and Fortianalyzer both have certs from ...
0
votes
2answers
48 views
Windows Certificate Templates CSP certificate with Exportable Private Key
I recently created a certificate for a developer using a certificate template. The template was based from an existing one which I believe is based on CNG.I was able to export the private key, but the ...
0
votes
1answer
42 views
Windows AD CA Code Signing Cert Request for Wrong User
I am having an odd problem with a Code Signing certificate request from my Windows 10 workstation. We have a Windows Server 2012R2 CA setup with the Code Signing template and everything works fine if ...
1
vote
1answer
41 views
Certificates in docker local registry
I'm trying to set up a docker local registry within my university network. Since they offer certificates from rediris I requested one, so I have now three different files:
cert.pem
intermediate.pem
...
0
votes
1answer
60 views
Certificate Used for Azure App Registration
We need to create an Azure Application registration for an application which is only being run internally. The requirements are that it uses certificate authentication and we can't use Self Signed.
I ...
0
votes
0answers
18 views
Resources using a successfully issued (I think?) ACM Certificate produce net::ERR_CERT_AUTHORITY_INVALID when accessed
We're using an ACM certificate to afford custom CNAMEs in a CloudFront Distribution and an API Gateway API. This was working correctly until we recently moved the creation and assignment of this ...
0
votes
1answer
62 views
I have an internal PKI with a shared root CA, and multiple intermediate CAs, how do I make anything issued by any intermediate CA to trust everything?
Situation: I have an internal PKI with a shared root CA, and multiple intermediate CAs. I want anything issued by any intermediate CA to all trust each other. Is there a way to do this that most ...
1
vote
1answer
24 views
Windows certificate templates: how to make certificates from certain templates recognizable
I'm using X.509 client certificates to authenticate a well-defined set of Windows clients via mutual TLS. A certificate template exists that issues this type of certificate to all clients in this set, ...
2
votes
1answer
35 views
Windows certificate templates: how to include group (or OU) claims in SSL/TLS client certiifcates
I'm using X.509 client certificates to authenticate a set of Windows clients via mutual TLS. Which clients are part of this set should somehow be administered in AD, e.g. via group membership or ...
0
votes
1answer
59 views
ADCS Subordinate CA: does the domain automatically trust the root
I created a subordinate "enterprise" CA server using ADCS on an active directory domain. The root CA that signed this subordinate CA's cert is not part of the windows domain.
Q1: Does the ...
0
votes
1answer
117 views
I want to combine my rsa.public with my rsa.private to a .pfx that I can use to digitally sign an xml file
Here is the code I have so far:
for the private key:
openssl genrsa -out rsa.private 1024
for the public key:
openssl rsa -in rsa.private -out rsa.public -pubout -outform PEM
Then I'm trying to ...
0
votes
1answer
476 views
CA with intermediate certificate for vault
I want to setup Private CA for internal services using Vault (HashiCorp). I am generating Root CA & Intermediate CA certificate outside of Vault. Vault will be generating short-lived (30 days) ...
1
vote
0answers
24 views
Windows server Essentials fault by not find correctly named server certificate
I have a problem with CA configuration on AD windows server 2012r2. It manifests itself by error with starting "windows server essentials services".
I figure out there is something wrong ...
0
votes
0answers
24 views
freeipa certificate sining a sub ca for a device
I have a working Freeipa server install, I am at a loss as to how one would need to go about signing a sub ca request from a juju vault request.
I have mostly followed the ubuntu enterprise install ...
0
votes
0answers
107 views
Enable TLS for SMTP in IIS6 on Windows Server 2012 R2
We have a situation where we have been advised to open ports 587 and 465 on our production server in order to receive traffic from Exchange Online to the server.
However, we understand that these ...
0
votes
1answer
58 views
Strongswan 5.7.x not sending intermediate certificate
I am attempting to use a letsencrypt certificate on my strong swan server; but I also see this behaviour with my own internal CA.
When trying to connect from a windows 10 host to a strong swan ...
1
vote
1answer
605 views
NGINX unable to get issuer certificate
I am using NGINX web server. Configured my site with a setting where user will be challenged to present his certificate when he makes first request to the site by using following setting:
...
0
votes
1answer
72 views
Overriding “SSL client : No” for a specific nginx vitual server
I have a bunch of clients (too many to easily retrofit) each holding a single certificate (signed by a non-standard CA over which I have no control; I just generated the CSRs).
Now I need to setup a &...
0
votes
0answers
31 views
Unable to convert Zentyal CA generated cert for Nginx
I installed Zentyal to be my certificate authority. CA was installed just fine and I generated few certs. However I wanted to replace Zentyal frontend (nginx based) SSL cert with the one from its own ...
0
votes
1answer
66 views
RootCA and Trusted RootCA
I am planning buy a domain name lets called it foobar.net
Home devices will similarly be added to network called foobar.net
I plan to run a certificate authority to issue certificates to these devices....
0
votes
3answers
406 views
I'm trying to create (SSL/TLS) certificate with AWS, failing
I'm trying to request a (SSL/TLS) certificate with AWS Certificate Manager.
but getting this error:
Something went wrong
Cannot request more certificates in this account. Contact Customer Service for ...
0
votes
0answers
45 views
Certificate validation with non-standard CA
I have a Certificate which has been issued by a non-standard CA over which I have no control.
I generated the CSR, sent it to non-standard CA and it returned a valid Certificate.
This Certificate is ...
0
votes
1answer
319 views
CAPolicy.inf and Install-AdcsCertificationAuthority
I am just working on creating 2-tier PKI and wonder why so many tutorials create such capolicy.inf
[Version]
Signature="$Windows NT$"
[PolicyStatementExtension]
Policies=InternalPolicy
[...
0
votes
1answer
130 views
Publish certificate in Active Directory not working as intended
I have an AD forest and one CA server. In the certificate template I have "Publish certificate in Active Directory" checkbox checked.
Also in the template, the Subject Name option is set to &...
1
vote
0answers
368 views
FreeIPA Server Install with external CA
I am tasked with building a FreeIPA server to help us manage TLS certificates to support Nginx, Postgres and RabbitMQ. I have never worked with certs from an admin perspective so I may be making some ...
0
votes
1answer
38 views
How to create a thirdlevel CA in Step?
Step allows to use an existing root-certificate using step ca init --root=a.crt --key=a.key. In that case step generates an intermediate certificate for later use. However, my root certificate was ...
0
votes
0answers
50 views
Enterprise Issuing CA denied bind by domain controller
I am setting up a test environment and have a standalone Root CA and an Enterprise Intermediate CA as my issuing. On a third server, I set up an OCSP responder. The OCSP server and the Issuing CA are ...
0
votes
0answers
545 views
Intermediate CA Certificate Renewal for Direct Access
Background:
We have DA, single site config. Enterprise PKI with Offline Root and online Intermediate CA (Intermediate CA used to issue Computer Certs to clients for DA).
The Intermediate CA's cert is ...
0
votes
1answer
46 views
Do I need to copy RootCA in machine 2 & 3's trusted root
I have 3 machines in domain and where I choose Machine1 to host asp.net web api application.
I have create my own CA RootCA and put in Machine1's trusted root.
then I issued one more certificate X ...
0
votes
1answer
116 views
How can I read explicit https proxy CA certificate on RHEL7?
I have server behind explicit https proxy with SSL decryption but I don't know its certificate and I have no way to obtain it from human being. Is it possible to retrieve https proxy certificate from ...
1
vote
1answer
447 views
One Mac user still stuck with expired AddTrust Root CA Certificate but the server has been updated
I recently ran into this issue of the Sectigo Root certs expiring on May 30th of this year: https://gist.github.com/minaguib/c8db186af450bceaaa7c452ba6a9901b
I updated the certificate chain on our ...
