Questions tagged [certificate-authority]
In cryptography, a certificate authority, or certification authority, (CA) is an entity that issues digital certificates.
740
questions
0
votes
0
answers
6
views
Windows Firewall Connection Security Rule setup certificate authentication using thumbprint
Unable to setup thumbprint because once I configure to Validation only, client machine getting error. Here are the sample screenshot of my Connection Security Rule setup.
Selection Setup
enter image ...
0
votes
2
answers
25
views
How can I set the ACL of a CA programmatically?
When launching the CA console (certsrv.msc), I can right-click on my CA, select Properties and then I can modify the ACL of my CA in the Security tab. When I modify it, the changes are applied to the ...
- 298
0
votes
0
answers
14
views
Would SCCM require a second SubCA when using HTTPS with 2 domains?
I have a domain called one.local. It already has it's own Windows Root CA and SubCA.
There is a second domain called two.local that is using SSCM. The team that is managing two.local wants to manage ...
- 101
0
votes
1
answer
28
views
Domain Member Servers - Accessing Certificate Revocation List (CRL)
In my environment I have a Enterprise Root CA installed on a domain controller and a separate domain controller configured as a Subordinate CA - I know this isn't recommended for security reasons but ...
- 578
0
votes
1
answer
8
views
Generate CA signed ECDSA certificate
I need a CA signed ECDSA certificate for testing purposes.
I am able to generate an ECDSA certificate and key but I have never signed one.
I use OpenSSL in a Windows environment to generate ...
0
votes
1
answer
24
views
Windows Certificate Authority - Adding Additional Attributes
In AD Certificate Templates the templates have an option to build from AD information and includes Email, DNS, UPN, etc.
When creating a CSR using powershell, openssl and the certificate mmc snap-in ...
- 578
0
votes
0
answers
54
views
NET::ERR_CERT_AUTHORITY_INVALID error in Chrome but not in Firefox
I'm using AWS and I have requested an ACM certificate. I used DNS validation to make it a valid cert. Now I've attached it to a private ALB.
The URL is private.
When I connect with my VPN and I can ...
- 283
0
votes
1
answer
88
views
The certificate request was submitted to the online authority, but was not issued. The request was denied
I've a Hyper-V lab with few VMs. I'm trying to renew expired server certificate for one of my virtual machines which is running Windows Server 2019 (version 1809). I'm trying to renew the certificate ...
- 225
0
votes
1
answer
28
views
How does OCSP handle deleted certificates?
We have a Microsoft Certificate Authority running on Windows Server 2019. We are issuing certificates to Android devices via a MDM. The Android device users browse to a web application (hosted by ...
2
votes
2
answers
30
views
GPO to add a purpose to root certificate
The root certificate of the DFN-PKI "T-TeleSec GlobalRoot Class 2" is not activated in the Windows certificate store for the certificate purpose "code signing".
I can activate it ...
- 295
0
votes
1
answer
49
views
Non-working Windows server 2003 Enterprise CA removal
Amongst a bunch of server, I have a Windows 2003 server, domain controller, Enterprise CA installed, cannot start CA service, because "a required certificate is not within its validity period ...
- 3
0
votes
0
answers
28
views
Renewing domain CA SSL/SSTP Certificate from non-domain Clients
I have a VPN setup using RRAS/SSTP to authenticate clients. However, some of the clients are connecting via personal computers which are not joined to the domain. Initial setup was done by manually ...
- 1
1
vote
1
answer
82
views
How do I sign my own SSL certificates so that they cover www and non-www domain names?
When using a commercial Certificate Authority, generating a csr for the common name www.mysite.com and sending it to them will result in a certificate being issued that works for both www.mysite.com ...
- 4,413
0
votes
2
answers
39
views
Is it necessary to include a CA file reference in my Apache vhost config block?
I'm upgrading my Apache web server and wondering if I even need to declare a CA file in the vhost config?
My vhost setup is
SSLEngine on
SSLCertificateFile /home/user/ssl/${SITE}-cert.pem
...
- 1,374
0
votes
1
answer
264
views
Laptop asking for "action needed" on NPS Computer auth WiFi connect, despite valid Server Thumbprint
I have configured computer authentication on WiFi connect to company network, using the microsoft nps server, group policy certificate auto-enrollment and group-policy wifi config.
Has been working ...
- 944
0
votes
1
answer
79
views
Parent Domain Certificate Authority For Child Domains
I have a parent domain and 2 child domains of that parent. All servers are Windows Server 2019. I am working on deploying security software and I need to obtain a valid certificate from the ...
- 761
0
votes
1
answer
847
views
curl: (60) server certificate verification failed CRLfile: none
I'm slowly transitioning from an exclusive developer role and into more of a hybrid DevOps role at my company. Which means I'm new to a lot of this, please go easy on me... :-p
My client's server is ...
- 101
0
votes
1
answer
278
views
How to Properly Migrate Active Directory Certificate Services
I have Active Directory Certificate Services installed on a Windows 2016 domain controller. We plan on spinning up Windows 2019 instances to replace our 2016 domain controllers. We have one DC with ...
- 578
1
vote
1
answer
75
views
What does the "crt" abbreviation mean in certificates?
I can find what all the other abbreviations mean like PEM and CSR as is mentioned here:
https://pki-tutorial.readthedocs.io/en/latest/index.html
but what does CRT stand for?
- 113
3
votes
1
answer
260
views
Domain Controller autoenrollment - changing issuing CA
We are cleaning up our Windows PKI/CA environment and replacing our root CA with a new server. The current root CA has been issuing the following certificate templates for years now (in addition to ...
- 32.2k
0
votes
0
answers
70
views
FreeRadius with mixed CAs
Is it possible to run FreeRadius (version 3.0.13) with two different CAs? So that I have a server certificate from one CA and the client certificates come from a different CA?
Our current setup in /...
- 135
0
votes
1
answer
30
views
aws client vpn - choice of certificate authority
I am tasked to research on how to use aws client vpn service. After some reading I am a bit confused with the choice of certificate. It seems to use the client vpn, we will need to use aws private CA, ...
- 169
1
vote
1
answer
515
views
Replace Self Signed RDP Cert with CA Signed Cert
A few servers are getting picked up by security scans with the following message:
The following certificate was at the top of the certificate chain sent by the remote host, but it is signed by an ...
- 578
0
votes
0
answers
16
views
How long are certificates available in ADCS Web Enrollment page after issued
I have a windows 2008 enterprise ADCS server with web enrollment. I want to know/configure how long do issued certificates last on the page before a user has to submit another request.
While ...
- 33
1
vote
2
answers
430
views
NET::ERR_CERT_AUTHORITY_INVALID with self-signed CA in Windows
I created a (self-signed) root certificate and signed a web server certificate using a system I developed in Java (the web certificate is used in Apache 2.4.41).
The certificates work without issues ...
- 466
0
votes
0
answers
33
views
created a new offline root CA . All of the certs that are based off of this ca cert root for fail, when used on non Microsoft systems
The reason it is failing is because I used a Microsoft example as the the policy.inf file. I edited the file to match my data but I left in the line: AlternateSignatureAlgorithm=1
How do I fix this ...
0
votes
0
answers
184
views
Submitting CSR to Microsoft CA from linux bash best practice
Similar questions:
https://stackoverflow.com/questions/31283476/submitting-base64-csr-to-a-microsoft-ca-via-curl
The link above presents an answer but it is far too complicated for me.
Below is an ...
0
votes
1
answer
69
views
How networking secures the connection between Certificate Authority and Client? [closed]
I know HTTPS is based on the Certificate Authority (CA). If a client tries to send a request to a server (Assuming there is a Certificate), is it possible that a middleman can take the certificate ...
- 103
0
votes
1
answer
532
views
Steps to update certificate in edge servers
Onprem mailbox servers is in exchange 2013 and edge servers in dmz. Can someone please share the steps to renew third part cert in edge servers. I am unable to find a ms article. Please help
- 1
0
votes
1
answer
28
views
How does XCEP policy (XML) define SubjectType for User or Computer constraint?
We've developed our own implementation of a XCEP/CES WCF service that uses a combination of our certificate management solution and the Microsoft CA to issue the certificates. The standard XCEP XML ...
0
votes
1
answer
27
views
CentOS Certificate Authority increase key strength
I have a self signed CA that I have been using for several years. Certs that I sign/issue these days for our LAN are now getting warnings in Chrome due to "Weak Key". Is there a ...
- 1,327
1
vote
1
answer
135
views
CA Recovery in Active Directory
I think I understand, but I want to be sure.
We are running two Windows 2016 domain controllers (VMs), one of which is performing the role of a certificate server. We perform system state backups ...
- 13
1
vote
1
answer
925
views
hashicorp vault - load pre-existing CA certificate into PKI engine
I'm looking to migrate a process that generates client certificates from a custom root CA into hashicorp vault.
The root is already trusted by a lot of applications, so I'd like to import it (or an ...
- 929
0
votes
1
answer
88
views
Chrome not trusting self-signed cert
I have mutual TLS enabled on my nginx reverse proxy. I can view the site only when I have the client cert and custom CA installed in my keychain. This works in Safari and Chrome. However, in Chrome it ...
- 115
0
votes
1
answer
27
views
Safe to start CA-server past its tombstone?
I have a CA-server that has been offline for 185 days, so past the tombstone period of 180 days.
Is it safe to start it up, or is there a high chance I will mess up my domain?
The only roles installed ...
- 3
1
vote
1
answer
87
views
Instaliing microsoft ADCS using brainpool ECC keys
I got a request from a custumer to install ADCS using ECDSA while using a specific ECC curve for the keys (bp384r1). This curve is not listed in the ADCS installation process when creating a new key ...
- 70
1
vote
0
answers
2k
views
Why does Debian 11 still have the expired DST Root CA X3 certificate?
On an up-to-date Debian 11 server, I noticed the expired DST Root CA X3 certificate is still present:
$ grep DST /etc/ca-certificates.conf
mozilla/DST_Root_CA_X3.crt
This certificate is expired ...
- 111
1
vote
1
answer
2k
views
User agents not trusting web server due to Let's Encrypt DST Root CA X3 root certificate expiration
I handle a NodeJS server with an SSL certificate issued by Let's Encrypt. It works on some clients (Safari and Firefox on my macOS) and not others (curl on my macOS, Safari on iOS). The notice on iOS ...
- 253
1
vote
0
answers
473
views
Why does Chrome on Windows 7 still display the old root certificate?
Early this morning, I updated (with win-acme) the web server's (IIS 8.5) SSL certificate due to the known problem of Let's Encrypt with the expiration of the its root certificate (DST Root CA X3). So ...
- 105
1
vote
1
answer
2k
views
How do I fix "No usable signing certificates are available" in VBA?
We have a VBA script in Outlook that generates a popup when sending external emails. Apparently the script's signature expired over the weekend. The person who signed it is no longer here. I see ...
- 66
0
votes
0
answers
163
views
Generate CSR including certificate template information with OpenSSL/Keytool for submitting to Microsoft CA
i'm trying to generate a CSR which includes the microsoft template CA name.
i have tried the below config file but didn't work...any clues ? i want to generate the x509v3 CSR
oid_section = OIDs
[ OIDs ...
- 1
0
votes
1
answer
60
views
Transfering ssl certificate issued by a Windows Domain Controller CA to another machine running IIS
I have two AD servers in a domain, both running Windows Server 2019, the second is a Core server configured as a RODC.
I have the main server working as a Certification Authority, where I'm supposed ...
0
votes
2
answers
135
views
How to Create a SSL Key and a SSL Cert from a Given CA File (Certificate Authority)
I Need to create a encrypted db connection to the Azure Cloud MySQL Servers, They have given us a CA certificate called "BaltimoreCyberTrustRoot.crt.pem" to use when connecting with the ...
- 3,845
0
votes
0
answers
103
views
Automatically updating the CRL for pfSense
I want to be able to automatically update the certificate revocation list on a virtual pfSense server running OpenVPN. I don't want the certificate authority to be on the same vpn server, but if ...
- 365
0
votes
1
answer
66
views
PKI trust in Active Directory
Assuming that the certificate of the ADCS CAs joined to a given domain are signed by an offline root CA which is then trusted by all systems in the domain/forest. If that offline root was then used to ...
- 51
2
votes
0
answers
34
views
Which clients support self-signed certificates with DANE?
We've been considering to make more use of DANE as a decentralised authority for our certificates.
Especially with S/MIME.
However, the key obstacle is... how widely are DANE treated as an authority ...
0
votes
0
answers
24
views
Windows Domain Controller - SSL Cert with Two Hosts In Subj. Alternative Name (SAN)
My Domain Controllers auto enroll and get a Computerv2 cert that handles server authentication. One of the apps we use requires an SSL cert with a SAN that contains multiple hosts. I know how to ...
- 101
0
votes
0
answers
20
views
Azure storage account enable file listing over HTTP
I want to publish the domain CRL to an Azure Storage Account as this has the benefits of being highly available.
For the storage account, is it required to have the HTTP endpoint allow file listing. ...
- 647
0
votes
2
answers
261
views
Retire internal Windows root CA
A former colleague created an internal root CA named CA1 with server2008. During migration to a newer OS version a Server CA2 was created and CA1 turned off. Now my problem is, all systems still think ...
0
votes
1
answer
116
views
Installing a PFX with bundle-ca included, do I still have to install the ca-authority in root?
I have a Windows web server, and usually I install the ca-authority in "LocalMachine\Root" and the intermediary PFX certificate in "LocalMachine\My", everything works well. Now I ...
- 211