Skip to main content

Questions tagged [certificate-authority]

In cryptography, a certificate authority, or certification authority, (CA) is an entity that issues digital certificates.

Filter by
Sorted by
Tagged with
1 vote
3 answers
150 views

What is the role of Subject Name (SN) / Subject Alternative Name (SAN) in Microsoft Public Key Infrastructure (PKI)?

What is the Subject Names / Subject alternative names and how do they differ from each other? Specially the template below "subject name" tab. What does that change in the normal certificate ...
kambm's user avatar
  • 53
1 vote
1 answer
38 views

Specifying Dynamic filenames for AIA and CDP in CAPolicy?

In the "CAPolicy.inf" file where you define [AuthorityInformationAccess] and [CRLDistributionPoint], can these sections use dynamic values? For instance: [CRLDistirubtionPoint] URL="...
artomason's user avatar
  • 133
4 votes
1 answer
278 views

How to create an Authenticode Signing infrastructure?

I am attempting to create the necessary infrastructure to allow authorised users to sign PowerShell scripts and have them be trusted by the organisation, this allows deploying scripts to computers ...
Hugo's user avatar
  • 143
1 vote
2 answers
67 views

Why does Active Directory Certificate Services require Remote Registry Service?

I'm setting up a two-tier certificate authority using Active Directory Certificate Services. The offline air-gapped root certificate authority was easy to set up and get going. The intermediate ...
threehundredvolts's user avatar
1 vote
1 answer
80 views

How to reenroll certificate on behalf of someone else? Windows Certification Authority

I have Windows Server 2022 CA with a configured Enrollment Agent. I can enroll new certificate on behalf of another user but I can't do the same with renewing it, while logged on as the Enrollment ...
amperek's user avatar
  • 19
0 votes
0 answers
40 views

OpenWISP -- inputing a certification authority

We're trying to set up OpenWISP using a paid-for wildcard (*.ngv.com.au) SSL certificate. The certificate comes to us as a ZIP of these files: AAACertificateServices.crt ...
Michael NGV's user avatar
2 votes
1 answer
106 views

What happens if the startdate of a CA is later that the startdate of a X509 certificate signed by it?

I am in the process of extending the lifetime of a private CA creating a new certificate with the same name, serial number, private/public keys, etc. The only change would be the "startdate" ...
jcea's user avatar
  • 273
0 votes
1 answer
167 views

How to make kubeadm init work with external CAs?

I am trying to bootstrap a Kubernetes cluster using my own Certificate Authorities (CAs). I am following the Kubernetes Hardening Guide, which recommends having separate CAs for etcd and the rest of ...
Admineral's user avatar
0 votes
0 answers
154 views

Creating Web Secure Proxy in GCP - Certificate Issue

I am trying to configure GCP Secure Web Proxy https://cloud.google.com/secure-web-proxy/docs/overview. The proxy is under IP: 10.10.0.16. Besides that, it has a local DNS Zone proxy.carecode.lan that ...
p.magalhaes's user avatar
0 votes
1 answer
140 views

TLS through CDN

I'm trying to understand how TLS is terminated between a client and an origin when a CDN is involved. I think it's pretty straightforward when a client connects directly to an origin, a handshake can ...
4m1r's user avatar
  • 133
0 votes
0 answers
128 views

Add a new Subordinate CA on a single ROOT CA environment

I'll have an ROOT CA that is already joined to an Active Directory, this one has been serving certificates to the Joined Computers. Now we want to add a subordinate/intermediate CA to deploy new ...
Uh Trog's user avatar
  • 105
0 votes
2 answers
459 views

Should a subordinate CA appear under the Trusted Root CA?

Recently I needed to setup PKI for VDI solution as smart card functionality was needed to handle SSO with Azure. I configured an offline Root CA and a domain joined subordinate CA per MS instructions ...
omgosh's user avatar
  • 1
0 votes
0 answers
674 views

Verify return code: 21 unable to verify the first certificate

I'm encountering an issue on my Ubuntu server when attempting to establish an email connection from the frontend application. The error message I receive reads: "Verify return code: 21 unable to ...
Swapneswar Mohapatra's user avatar
0 votes
1 answer
1k views

Docker- Giving Container access to Host's CA certs

I was wondering security wise if there was anything wrong with volume mounting the host's ca certs into a container. I.e, docker run \ -v /usr/local/share/ca-certificates:/usr/local/share/ca-...
Snappawapa's user avatar
0 votes
1 answer
577 views

How do I create a replacement root CA without migrating old certificates?

Expanding on my post here: How do I fix missing or multiple CA certificates causing chain issues? I believe the issue above is that there are missing root CA certs in the CA itself and group policy ...
naps1saps's user avatar
  • 192
0 votes
0 answers
135 views

Windows Certification Authority Autoenrollment when Issuance Requirements is set

I have domain computers CA template which autoenrolls to machines without issues I activated Issuance Requirements I can automatically renew existing certificates, but cannot automatically/manyally ...
overflowed's user avatar
0 votes
1 answer
293 views

Why is certificate request invalid from Exchange 2019?

I am creating a cert request in powershell on an exchange 2019 server as follows: $binrequest = New-ExchangeCertificate -Server "exchange" -BinaryEncoded -GenerateRequest -FriendlyName "...
TSG's user avatar
  • 1,852
-2 votes
1 answer
316 views

Active Directory TLS authentication issue (Windows Server 2019 & 2012 R2)

I am facing an issue with AD TLS communication-related issues. Six months before I could authenticate the user on SSL communication using the CA certificate alone. Currently, I cannot authenticate ...
ram ajay's user avatar
1 vote
1 answer
2k views

How to extract CA Certificate from .pfx file and add it to a trust store file

I have a .pfx file that has multiple certificates, one of them is the signing CA certificate of a server certificate assigned to the IBM i Remote Command Server in DCM. I managed to use openssl and ...
tarekahf's user avatar
  • 119
0 votes
0 answers
126 views

Multiple certificate chains in a single file

My company has a Windows-based PKI with a single standalone root CA and several subordinate CAs for different audiences/purposes (e.g. two subordinate CAs for user/machine auto-enrollment, an ...
Paulo1205's user avatar
  • 101
1 vote
0 answers
336 views

Windows CA Publishing Expired Certs in CRL When not configured to do so

I have a Windows ADDS CA that for some reason is publishing revoked but expired certificates in the CRL and I can't for the life of me figure out why. Here is my configuration: Server 2012 R2 ...
Helstrom's user avatar
0 votes
1 answer
972 views

Why doesn't Google Chrome on Mac pick up local Certificate Authority as the other browsers?

I have generated local CA and Cert on my Mac, from this walkthrough: https://blog.arrogantrabbit.com/ssl/Root-CA-macOS/ I then provide the certificate/key to nginx local server, that I visit with my ...
Pandaiolo's user avatar
  • 101
0 votes
1 answer
821 views

How can I add a CRL to an existing Certificate Authority Certificate?

We have our own CA for internal use that secures about ten servers/services. We don't actually have or need a Certificate Revocation List. But, as we are attempting to setup Dovecot to verify the ...
Nick's user avatar
  • 4,646
1 vote
1 answer
513 views

Implementing PKI on an Active Directory domain

I would like to implement a two-tier PKI in a relatively small Windows environment: about 35 users and five virtual servers. Although I have little experience with Linux, I am trying to use XCA on a ...
coprolaliant's user avatar
1 vote
1 answer
275 views

FreeIPA subject name encoding mismatch when renewing certificate

When reading this question and answer, it seems this should be possible but I need a little more help understanding the answer. Is there a way to change the string format for an existing CSR "...
Sapg's user avatar
  • 11
2 votes
0 answers
612 views

openssl s_client shows an incorrect certificate chain

On one of my servers belonging to a customer I "suddenly" cannot verify any public TLS certificates. All requests to "the public" fail on an invalid certificate. I can, however, ...
Martin Melka's user avatar
1 vote
1 answer
378 views

Bluehost - wrong certificate presented by host for API call to Twilio

Bluehost VPS running CentOS, but cat /etc/redhat-release reveals CloudLinux release 6.10 (Final). Executing curl commands against Twilio APIs on my local PC (Win11/IIS/PHP) works fine. When I attempt ...
HerrimanCoder's user avatar
2 votes
1 answer
352 views

Unable to enroll Windows workstation in enterprise CA - DNS_ERROR_NAME_DOES_NOT_EXIST

I have a single machine, out of hundreds, that will not pull a certificate from our enterprise CA when trying to enroll it. The CA shows a failed request with error: DNS name does not exist. ...
Appleoddity's user avatar
  • 3,872
0 votes
1 answer
2k views

Cannot pull images from Kubernetes from a private registry with self-sign certificates if I change CA

I created a private registry with a self-sign certificate If I'll try to pull the image from it w/o importing the CA into trusted certificates, it will fail. If I'll try to update trusted certificates ...
Astin Gengo's user avatar
3 votes
1 answer
806 views

OpenVPN Revoke a certificate without the CRT file with Easy RSA

I'm confused, I have an OpenVPN server on Debian. The previous system administrator who was in charge of this server deleted the user certificates (.crt file) with the command "rm -f example.crt&...
g1398's user avatar
  • 33
0 votes
1 answer
728 views

Attributes Windows CA templates

Windows Enterprise CA. I have been requested that in the certificates appear the following attributes: OU, C (country) and O (organization). I have seen that in the certificate template in the "...
Santyuste's user avatar
1 vote
1 answer
238 views

Warning with sending emails from Thunderbird to Postfix using its own CA

I'm asking for help because I simply don't have the strength anymore, I've spent a lot of time and I'm still left with an unsolved puzzle. My problem: I keep getting "Wrong Site" warnings ...
lkuc18's user avatar
  • 31
0 votes
0 answers
605 views

Must a valid SSL/TLS certificate include "client authentication" purpose (OID 1.3.6.1.5.5.7.3.2)?

In other words, could the missing "client authentication" purpose in our CA-issued SSL cert be the reason it's not trusted by browsers? If so, how do I add that purpose / OID in a CSR (...
kindzmarauli's user avatar
0 votes
4 answers
506 views

Can Standalone (online) CA + Subordinate Enterprise CA configuration issue valid intranet SSL certs?

The question is purely about whether this config is capable of issuing valid intranet SSL certs (i.e. SSL certs for internally facing sites), and not any other implications or concerns. (The focus of ...
kindzmarauli's user avatar
0 votes
1 answer
987 views

Find issued certs based on signing templates

I am looking for a way to query on issued certs from my CA based on their signing template. Here is what I start using (based on PSPKI 4.0.0 module); $AllCerts= Get-CertificationAuthority -name ...
mandg's user avatar
  • 27
0 votes
1 answer
406 views

CA Offline Standard publish Active Directory

I have a hierarchy of one offline CA (standard) and 2 subCAs (enterprise). The offline CA is not published in Active Directory and the 2 SubCa's are published in AD. Can the offline CA be modified to ...
Santyuste's user avatar
0 votes
0 answers
39 views

CA template Windows

In a Windows CA, I have mistakenly removed permissions from a template and now I can't modify it. How do I modify or delete this template to create it again? Thanks
Santyuste's user avatar
0 votes
0 answers
49 views

Request Certificate CA

I have a Windows server configured as a Certificate Authority (CA). When requesting a certificate via https://server/certServ and choosing the template to request (Request Certificate->Advance ...
Santyuste's user avatar
0 votes
1 answer
1k views

How to renew the Root CA Certificate on Microsoft Active Directory Enterprise CA

How to renew the Root CA certificate on Microsoft Active Directory Enterprise Root Certificate Authority Windows Server 2012 R2? The certificate expired on 27 Aug. 2023, getting the error below while ...
user avatar
0 votes
1 answer
147 views

CA: Certificate User for VPN

From a subordinate Enterprise CA I want to generate a user certificate that serves as an authentication method for VPN connections. I want to install this certificate with autoenroll on the domain ...
Santyuste's user avatar
0 votes
0 answers
386 views

Migrating a CA to a new server - CA services won't start

We have an Enterprise Root CA running on Server 2012 R2. I built a replacement server running Server 2019 and followed the steps in the below article, I backed up the CA and relevant registry keys, ...
LeeCS's user avatar
  • 1
0 votes
1 answer
2k views

LDAPS certificate isn't working on new server for third parties

About 5-6 years ago I setup LDAPS on my Primary Domain controller. I setup Active Directory Certificate Services (all on the same server), forwarded the port 636 on my firewall, and was able to ...
ItsPronounced's user avatar
0 votes
0 answers
349 views

Are crl updated automatically to user after a certificate is being revoke?

I'm clueless on how does this CRL/OCSP works. We do have a local enterprise CA, and was set on the CRL publication interval to 8 days. As what was told, when the certificate is revoked, it does not ...
boxi's user avatar
  • 1
1 vote
1 answer
234 views

SubCA certificate of trust

I have deployed a PKI infrastructure with a Stand-Alone Root CA (which will be kept off) and 4 Enterprise SubCA's which depends on this Root CA. To make the computers trust the Root CA, I am going to ...
Santyuste's user avatar
0 votes
0 answers
182 views

SSH CA-signed key does not work from certain hosts

I've tried to setup CA signed ssh user keys. I got my configuration working on most clients, there seems to be problem on a few specific ones. The key verification fails and they are prompted for ...
Tadeas Vintrlik's user avatar
0 votes
0 answers
236 views

How to setup https website when I have own CA

I have very interesting question for me... I'm runnig webserver on linux machine (debian 10) with apache. In the same domain I have Windows Server on which are my DNS server and Certificate authority. ...
Dave's user avatar
  • 35
0 votes
0 answers
232 views

How to submit certificate request from RedHat machine to Windows CA?

I’m looking for solution, which helps me send certificate request from domain-joined RedHat Enterprise Linux machine to Certification Authority on Windows Sever 2022. Is there any solution to do this? ...
amperek's user avatar
  • 19
1 vote
1 answer
428 views

Kubernetes cluster with certificate authority

Certificate error after upgrade of kubernetes Error is SSL certificate problem:unable to get local issuer certificate After doing multiple modifications Now I'm getting above error.
Ruthew's user avatar
  • 11
1 vote
1 answer
1k views

PKI hierarchy. Root CA CAand subordinate

I have to deploy a new PKI hierarchy I have one domain and several subdomains I had thought about having a Root CA and a Sub CA. What are the advantages of this option over having a root CA only? Do ...
Santyuste's user avatar
0 votes
1 answer
364 views

How can we stop a repeated request for the same certificate in ADCS?

If I submit the same CSR file twice to my Active Directory Certificate Services (online via the certsrv web interface), I am issued two different certificates (judging by the serial numbers). Is there ...
tjlds's user avatar
  • 23

1
2 3 4 5
17