Questions tagged [certificate-authority]
In cryptography, a certificate authority, or certification authority, (CA) is an entity that issues digital certificates.
671
questions
1
vote
0answers
9 views
Certificate Auto-Enrollment for AD User When Requested by Service Account
I have one AD server and Microsoft Certification Authority in a domain. I also have a service account in AD which can request for client authentication certificate to be generated for any user. ...
0
votes
1answer
18 views
Is my CA doing anything?
One of our DC's is running the CA role. It was installed a long time ago, and I don't think it serves a purpose anymore. I would like to remove the role, but is there a way to determine if in fact ...
0
votes
1answer
27 views
Can we use CA signed certificate like let's encrypt in softether vpn server?
I am trying to attach let's encrypt certificate to my softether vpn server, But didn't found a way for it. Can we use CA signed certificate like let's encrypt in vpn server ? If yes, then please ...
0
votes
2answers
295 views
FreeIPA Intermediate CA Certificate Expired
We have 2 FreeIPA servers running in our network, today we found this: https://support.sectigo.com/articles/Knowledge/Sectigo-AddTrust-External-CA-Root-Expiring-May-30-2020
One of the intermediate ...
0
votes
0answers
31 views
This computer can't connect to the remote computer. Unknown key usage (1.3.6.1.4.1.311.54.1.2)
I'm unable to RDP to a server on our child domain after adding a Remote desktop certificate that is signed by one of our Certificate authorities. We have intentionally removed the self-signed RDP ...
0
votes
0answers
19 views
TCP Window with large SSL Packets. Distinguished Names Length 10kb
We are troubleshooting network latency related to SSL Handshake. This doesn't necessarily cause the delay every time but in some cases, Server take 5-10 seconds just to start sending first SSL packet ...
1
vote
0answers
24 views
Disable general public key authentication but allow SSH via CA
I would like to disable general pubKey authentication on my server and only allow auth via signed SSH CA (cert authority).
To enable SSH via CA you add this line:
TrustedUserCAKeys /etc/ssh/trusted-...
0
votes
0answers
28 views
What is the verification process with OpenSSL PKCS7_NOCHAIN flag
Im confused with the meaning of OpenSSL verify flag PKCS7_NOCHAIN. By definition it says:
If PKCS7_NOCHAIN is set then the certificates contained in the message
are not used as untrusted CAs. ...
1
vote
0answers
23 views
Migrating Root Certificate Authority
I got thrown into the middle of a CA migration project. My co-workers are migrating a Root Certificate Authority off a 2008 R2 server and onto a new 2019 server. They have both servers running at the ...
2
votes
1answer
67 views
Certbot: Issuing a certfiicate for internal IP address with my own PKI?
I am running my own ACME CA server that allows issuing of certificates to IP addresses. I have installed the root certificate into all the devices in my LAN. Let's say that I am running the server at ...
4
votes
1answer
385 views
Is the subdomain _acme-challenge protected?
I was looking into the DNS-01 challenge of Let's Encrypt; and I had a question about the sub domain process [1].
Let's say, the website example.com gives away free subdomains; what stops me to ...
0
votes
0answers
35 views
Microsoft NDES Automated Challenge Password retrieval
We recently implemented NDES and we are looking for a way to automate the challenge password retrieval with dynamic passwords as apposed to using a static password. However from my search on the ...
0
votes
0answers
17 views
Key attestation and Standalone Root CA
We are about to build a new PKI infrastructure and We are examinig different options for HSMs.
One option is based on HSM partitioning, where one partition will be used for the standalone root ca, ...
0
votes
1answer
33 views
Which CA certificates to send, if you have multiple trust paths?
I've come across this setting for the first time:
My server certificate is signed by INTERMEDIATE-CA1, which, in turn, is signed by ROOT-CA1. ROOT-CA1 is in the trust store of my Browser/OS.
That ...
0
votes
1answer
55 views
Requirements for certificates to sign PDFs in Adobe Reader?
I'm trying to set up PDF digital signatures using certificates generated by openssl. I have generated a CA certificate, and used that to sign end user certificates, which I archive in PKCS#12 format. ...
0
votes
0answers
28 views
Error generating client certificate using openssl
Getting this error with openssl 1.1.1d when using the CA generated as shown:
openssl req -new -x509 -config ca.cnf -newkey rsa:4096 -sha256 -nodes -out ca-certificate.pem -outform PEM
openssl req -...
1
vote
1answer
49 views
Active Directory Certificate Services autorenew
I have an LDAP application which needs to talk to Active Directory via LDAPS (LDAP over SSL). I installed Active Directory Certificate Services on a test Domain Controller (I know this is not best ...
0
votes
1answer
127 views
Authorize Multiple Authorities (CA) in OpenVPN
Desiring to transfer to a new Certificate Authority, I want to allow old clients to connect the VPN for some overlap time. Can I do this without running separate OpenVPN instances?
I see that I can ...
1
vote
1answer
268 views
How to tell domain controllers to not enroll a “Kerberos Authentication” certificate?
As per this question, I have an environment where certificates based on the "Kerberos Authentication" template cannot be issued (there are remote sites without direct connectivity to the CA, ...
5
votes
2answers
463 views
Error enrolling “Kerberos Authentication” certificate in a sparse network
I'm currently working on implementing an Enterprise Certification Authority for a customer whose network is not fully connected; it spans several geographical sites, and some of them don't have ...
0
votes
0answers
29 views
What does it mean when I can't locally verify SSL certificates?
Given that the webserver certs are correct (trying to connect to serverfault.com for example)
And that my local CA store, as a client, is valid
Where in the connection pipeline will a SSL ...
1
vote
0answers
33 views
What FreeIPA certificate profile is appropriate to issue a certificate for a VMWare VMCA instance?
This relates to my earlier question on why FreeIPA would not sign a CSR for an intermediate CA. I ask what certificate profile would be appropriate to sign an intermediate certificate signing request, ...
0
votes
0answers
39 views
Certificate renewal caching in clients
I did a regular certificate renewal with digicert and deployed a new certificate to our system. But it looks like some clients using openssl instead of schannel had problems updating and validating ...
0
votes
0answers
41 views
How to update certificate if API gateway connecting to RDS via lambda
AWS is emailing me to update the CA certificate of RDS and simultaneously update the client SSL which is making connection to RDS. According to the documentation I understood that I need to download ...
1
vote
1answer
120 views
CFSSL to start with intermediate certificate
I am trying to setup CFSSL (v1.4.1), after following this tutorial I have generated following files (self-sign)
ROOT_CA_CSR.json
intermediate_ca-key.pem
intermediate_ca.csr
intermediate_ca.pem
...
0
votes
0answers
33 views
Windows CA Migration - Testing the Backup
I need to migrate our Certificate Services from one server to a new one.
I am following a guide and there is the stage where you backup the old CA. How do you test that backup? I want to be able to ...
0
votes
0answers
27 views
Certificate Authentication “The request was aborted: Could not create SSL/TLS secure channel.”
We have imported a .pfx certificate under Personal store. It creates Root, Intermediate and Client certificate in Personal store.
This certificate is used for authentication to an API which works ...
0
votes
0answers
24 views
Aggregate the Intermediate CAs certificate to System Certificates Store
I recently received an API documentation, it came with customer certificate and the instructions says,
Symantec signs the server certificates of the Platform in Preproduction and Digicert in ...
0
votes
0answers
81 views
OpenSSL - Output PEM encoded part only when signing a certificate request
I've set up my own Certificate Authority based on a Debian 10 system and I can successfully sign certificates. But when I do so by using the command openssl ca -in /root/ca/certreqs/domain.tld.csr -...
2
votes
0answers
43 views
secondary fqdn for certificate authority [closed]
I have a CA that is serving computer clients successfully and NPS (Etc.) is all fine. We are currently looking to move some services outside of the network perimeter and I would like to create a ...
1
vote
0answers
83 views
An X509 certificate with easyrsa with CN only (no SAN)
I'm trying to create a certificate with the hostname in the CN, without using a SAN.
I know it is a deprecated, but I'm still interested in doing so for an old legacy project.
./easyrsa init-pki
./...
26
votes
2answers
4k views
Can a server certificate expire after its issuer?
Most if not all server certificates that I work with expire before its issuer, but is it possible for a server certificate to expire after its issuer and does this apply to an intermediate certificate ...
0
votes
1answer
35 views
Is the private key for S/MIME certificates generated on the CA servers or in the browser?
I heard that some certificate authorities generate your private key for S/MIME certificates on their servers.
However, some of them who recommend using Internet Explorer for this purpose, probably, ...
0
votes
0answers
19 views
How is the signature of an email S/MIME certificate verified?
To my knowledge, the signature of an SSL certificate is verified by the public keys of root certificates that are installed in the browser certificate storage.
How are signatures of the S/MIME ...
0
votes
2answers
268 views
Have the Certificate Signing Request (CSR) signed by a Freeipa CA
We have a certificate authority with Freeipa and I try to put in place a subordinate CA with Freeipa too.
I started the installation of the subordinate CA with the ipa-server-install --external-ca ...
0
votes
0answers
27 views
Windows Certificate Authority - Restored to a Server with different name
I am working on a customers DC and their CA has been restored from an old Windows 2008 R2 VM. Whoever did it, didn't properly migrate, and now it has the old name and is not letting me create ...
1
vote
0answers
76 views
How can I purchase a document signing certificate to sign/certify PDFs on AWS? [closed]
I'm working a service that fills/generates/signs PDF documents.
Users will draw their signature (or type their name) on a web interface, and then my servers will generate the signed PDF. I would like ...
2
votes
1answer
128 views
AD CS Configuration Using Install-AdcsCertificationAuthority Cmdlet
I am trying to configure a subordinate CA using a .PFX file with PowerShell. I am using the below parameters:
$params = @{
CAType = "EnterpriseSubordinateCA"
Credential = $credential
...
0
votes
0answers
15 views
S/MIME Certificate has expired and I am unable to Re-Issue
Screenshot of Certificates Snap-in (Local Computer)
Screenshot of GPO
Hello,
I have a Windows Server 2012 R2 machine that is our internal CA server. I have a GPO to push a Secure Email certificate ...
2
votes
1answer
36 views
Windows Server 2012 Certification Authority : where to install?
In my environment I've this servers:
Windows server 2012 R2 Domain Controller
Windows server 2012 R2 Remote Desktop host
many linux server
I want to deploy my certificates from local authority and ...
1
vote
0answers
97 views
Unable to Backup or Restore Certificate Authority?
I migrated Certificate Authority Enterprise from windows server 2012 R2 to Windows Server 2019. Both Server are VMs
Here are the steps I took:
Baskup CA database, key and registry config of the ...
1
vote
2answers
137 views
Using SHA-256 in policy INF file
I have a CA policy inf file for an offline certificate request:
[Version]
Signature="$Windows NT$"
[PolicyStatementExtension]
Policies=InternalPolicy
[InternalPolicy]
OID=1.2.3.4.1455.67.89....
0
votes
0answers
46 views
Can a auto login Oracle Wallet (cwallet.sso) be used to provide trust store certificates for Weblogic?
I am trying to configure a Weblogic server using weblogic scripting tool. All my trusted certificates are in a autologin Oracle Wallet. I am assuming Oracle technologies will work with each other but ...
0
votes
0answers
37 views
Can't secure my Gitlab with self-signed SSL because browsers don't accept it
I am trying to secure my Gitlab server with self signed certificates and I fail over and over again because the browsers refuse to trust my certificates.
What works is Chrome combined with Mac. I ...
1
vote
1answer
224 views
SSH CA-signed key fails via bastion
I'm setting up some servers for a new system and decided to do things a little bit differently. I'm running into an issue that I just can't seem to get past though. My desired configuration is having ...
0
votes
0answers
481 views
nginx - self-signed certificate signed by a self signed root ca is not accepted
I want to set up a CA for my local network. The root certificate should be installed on various devices (iPhone, Windows PC, MacBook). With a server certificate I want to secure the traffic between ...
2
votes
0answers
377 views
Automatically renew certificate: Old cert gets archived, but no new one is issued
We are using Active Directory Certificate Services (AD CS) to issue certificates for internal web applications. We can manually request a certificate from the CA and it gets issued without problems. ...
-2
votes
1answer
49 views
Create Certificate using ssh_keygen and letsEncrypt for IIS
I am pretty new to public-private key and creating certificates so I wanted to write out my thinking and see if I have the correct approach.
1) Use ssh_keygen to create a key pair.
I have basic git-...
0
votes
1answer
116 views
Root CA DOESN'T WORK in Internet Explorer 11 - but DOES work in Edge, Firefox
On a few user's workstations, I'm seeing an issue.
Though this "Root CA" is in the Trusted Root Certification Authorities Store, for both their machine and their user, IE11 will not trust this ...
0
votes
1answer
53 views
Getting CA signed SSL certificates for Windows servers on internal network
I'm hitting a wall here so need some help.
I am currently involved in a project that will require use of a third party software installed on one of our internal servers.
The software in question ...
