Questions tagged [certificate-authority]
In cryptography, a certificate authority, or certification authority, (CA) is an entity that issues digital certificates.
1
vote
1answer
37 views
What Does “L1K” indicate on an Entrust Certificate
I was working with a teammate importing certificates into a java keystore and I noticed our intermediate certificate had the ".L1K" notation, was then about to import into our Java application's ...
0
votes
0answers
28 views
Server certificate validation 802.1x
I have recently deployed CA and NPS for WPA2-Enterprise authentication. However doing the pen testing I found out that clients are accepting a certificate from any valid certificate authority. This is ...
0
votes
2answers
41 views
Generate/Sign certificates with the AD trusted root certificate?
I know that when an Active Directory domain is created:
it creates it's own root certificate
and that root certificate is automatically pushed into machines when they are joined to the domain
You ...
0
votes
1answer
31 views
Custom Certificate Authority not recognised on Windows server / Cert shows as “self signed”
Scenario:
We run our own Certificate Authority for internal server to server TLS connections. Created a new SSL certificate for a web server. Deployed to server, SSL works....
Send CA public key and ...
3
votes
1answer
45 views
What happens when someone gets to know the secret key (of the web server / a CA)?
basically, I have three questions and I would be grateful for a brief explanation of the differences in the consequences of these thefts:
What happens when someone gets to know the secret key of the ...
3
votes
1answer
158 views
Certificate Authority does not show Templates
No templates are shown in the Template folder of the Certificate Authority.
In the Certificate Templates (certtmpl.msc) are Templates shown.
Running certutil -CATemplates returns 0x80070490 (WIN32: ...
1
vote
1answer
35 views
Request Certificate points to wrong Server
We migrated a while ago from SBS 2008 to Windows Server 2012 R2. The new Server is also the Certificationauthority. But when I want to renew a certificate, a get the error messsage "Error: RPC Server ...
0
votes
0answers
60 views
How do I add my organization's self-signed certificated to the trusted list?
I am trying to provision some servers running Ubuntu 18.04 within my company and have run into errors such as
Error response from daemon: Get https://registry-1.docker.io/v2/: x509: certificate ...
0
votes
1answer
90 views
Install CA - Not trusted certificate - Apache
I am trying to install a chain certificate from Entrust on a red hat server 7.5 that uses apache 2.4.6. Following some articles I found, I did the following:
Edited /etc/httpd/conf.d/ssl.conf file in ...
1
vote
1answer
42 views
Migrate to two-tier PKI (Microsoft)
Currently, I have one online enterprise root-ca (and issuing certificates - default templates) that installed on DC (yes, yes I know - worst case scenario). I set another offline not joined to a ...
0
votes
0answers
28 views
Certification authority limited to a domain
we generate test environments on demand. We're using Let's Encrypt to provide SSL certificates. Each of the test environments needs around a dozen domain names in the form <part>.<...
0
votes
0answers
69 views
IANA PEN OID in CAPolicy.inf
I want to setup a two-tier Microsoft Windows Certificate Authority.
I've read that I need an OID from IANA - which I got.
Now I am unsure how to apply this OID that it is generally taken by my CA... ...
-2
votes
2answers
49 views
block Certificate authority server [closed]
is this possible to block a specific TLS CA(certificate authority) on network ?
for example block all certs that is issued by letsencrypt on my network
is there any ip or host name for blocking ?
0
votes
1answer
199 views
CA root install issue on Ubuntu 16.04 LTS Server
I am setting up nginx reverse proxy on Ubuntu 16.04 LTS Server for Web-Server.
There will three different Services running on Ubuntu. Services will communicate each other using API calls. Similarly ...
0
votes
0answers
41 views
Expired DC certificate back after reboot
In our environment we use DC-Cluster_CA to generate SSL certificates for .foo-bar.local domains for internal use.
Example is certificate 'DC-01.foo-bar.local'
The Radius server also uses this ...
0
votes
2answers
56 views
Client certificate authentication - Apache2
I'm trying to set up a client authentication for one of my app but for now, it's not successfull.
I bought a Gandi wildcard ssl certificate for my domain *.example.com and here is the configuration on ...
1
vote
1answer
565 views
SSL “unable to get local issuer certificate” : “full chain” vs “root”?
Summary
In summary I have some certificate related files and some certificate related instructions but I'm not sure which files are which !
Background
I've just installed a certificate from Lets ...
0
votes
0answers
58 views
Prevent Smart Card prompt when looking for Enrollment Certificate
I'm using an Enrollment Agent user certificate to amend CSRs (in order to add SANs)
My method is working fine - using the following command:
certreq -config "CertAuth" -policy "PathtoCSR" "Path to ...
0
votes
1answer
40 views
Trouble creating SAN certificate with Internal CA
This is on WSE 2016.
I've created a Certificate Template called 'SAN Web Server.'
Per this advice, on its properties sheet I've specified Supply in the request on the Subject Name tab. However, the ...
-2
votes
1answer
314 views
OpenVPN server as it's own CA — security concerns?
I was reading the Digital Ocean guide to setting up an OpenVPN server on Ubuntu in anticipation of doing exactly that, and saw this tidbit:
Additionally, you will need a separate machine to serve ...
3
votes
2answers
1k views
Why does curl work with a specific https site, but wget has problems with certificates?
Centos 6. After updating recently ca-certificates I run into some troubles. I have the most recent versions of curl for centos 6:
-bash-4.1$ curl -V -v
curl 7.19.7 (x86_64-redhat-linux-gnu) libcurl/7....
0
votes
1answer
36 views
How to view signatures fulfilling the “Authroized Signatures” option in a Smart Card Logon certificate from a Windows CA
I'm playing with the Windows Server CA role and Smart Card logons. We have a working PKI setup and smart card issuance/logon working. What I'm curious about is the "Require this number of authorized ...
0
votes
1answer
1k views
How to configure SSL through GoDaddy using AWS Certificate Manager?
I created an SSL cert with AWS Certificate Manager. I followed the instructions provided to create a CNAME in GoDaddy, but my AWS Certificate status is still "Pending validation" six hours later.
I ...
0
votes
1answer
26 views
Some Macs not authorizing via 802.1x
Hello I have a really weird issue with some macs not being able to connect to 801.1x in some areas on campus. They however can connect in other places on campus. The configs for both switches are the ...
-1
votes
1answer
465 views
Setting up a Windows domain CA with a wildcard certificate
As the title suggests, I'm trying to set up a new Windows domain. Seemingly a simple thing, and one I've already done before, but this time around, management wants this to be synced up with Office ...
0
votes
0answers
12 views
SAML SP Certificate Changing: do changes actually need to happen at the Identity Provider for a CA-issued cert?
Our certificate that we use for signing SAML redirect requests is expiring.
We've renewed the certificate by a trusted CA, but I've been told that once we update the certificate, we need to notify ...
0
votes
0answers
155 views
cloud-config unable to install kubernetes debian repository
I've got a basic cloud-config user-data script that simply installs the Kubernetes repositories on raspbian (hypriot), however, apt-get update seems to fail due to certificate issues.
The thing that ...
1
vote
1answer
162 views
Intranet Cert Signed by Custom Root CA: I'm Seeing “Revocation function was unable to check”
Background
I have a set of internal company websites, which need to have TLS certificates. I went through a whole bunch of tutorials, and ended up using OpenSSL to create a self-signed root ...
github
1
vote
2answers
161 views
Local SSL CA always expires 30 days after creation
I'm following similar steps as this answer to create a local CA.
Despite setting the default_days option to 1825 (days) in my config file, the resulting CA certificate is always set to expire 30 days ...
1
vote
1answer
384 views
strongSwan VPN Intermediate Certificate Authority
I have been testing out strongSwan VPN on a Linux server in a Windows Active Directory domain.
I have managed to get a single-tier PKI with EAP authentication to work, but when I attempt to add a ...
1
vote
2answers
624 views
User Certificate vs Computer Certificate
Normally when deploying an SSL VPN solution with a cert check, I would deploy an internal MS CA and configure a GPO to give out computer certificates. The username/password with MFA proves the user is ...
2
votes
0answers
149 views
SSH known_hosts entry for port number and tunneling using @cert-authority
I've set up SSH certificate authority on my server, including a signed host key with the applicable principals. I've set up my local known_hosts file to recognize the certificate authority and when I ...
0
votes
1answer
205 views
Submit unsigned pkcs10 to windows certificate authority
Is it possible to make a Windows Server Certificate Authority accept a PKCS10 certificate request that is unsigned? I get the following error Error Verifying Request Signature or Signing Certificate ...
0
votes
1answer
34 views
Configure how long requests are displayed in CertSrv web enrollment
I have a Win2008R2 enterprise CA in ADCS and the certificate template is set to ask CA administrator to issue or deny the request. By default, when the user submits the requests through web enrollment,...
2
votes
2answers
2k views
RDP presents Self-Signed certificate instead of Certificate Authority's one
Few days ago I witnessed a strange problem within my domain:
During RDP connection I see warnings about certificate being not trusted (and I see self-signed certificate, not issued by domain CA)
I ...
0
votes
3answers
50 views
Minimum Hardware Requirement For Setting Up OpenSSL Certificate Authority in Linux
I've been seeing a lot of OpenSSL Certificate Authority "how tos" for Linux, but if I plan to create our own Certificate Authority for a WAN network both externally and internally...
What is the ...
0
votes
0answers
116 views
Risks of installing a new Certificate Authority
We have a w2k8r2 CA on our network, which only seems to have issued certificates for our domain controllers, and two user accounts. Since it was originally set up, we've gone through a company name ...
0
votes
1answer
85 views
StrongswanPKI - Adding status_request or MustStaple TLS extension to certificate?
Using PKI tool from strongswan to setup a CA.
Trying to setup the OCSP side of things have run into many issues as per another thread I posted (Strongswan PKI - ED25519 Certifcates - OCSP Responder ...
0
votes
1answer
3k views
ERR_CERT_COMMON_NAME_INVALID with internal AD CA wildcard
I have created an internal ADCS CA using this guide, and then submitted a certificate request to create a wild card certificate for my domain eds89.com. Intention behind this being to apply to some of ...
0
votes
1answer
184 views
Strongswan PKI - ED25519 Certifcates - OCSP Responder having issues
I am trying to setup an ocsp for the certificates generated out of strongswan PKI - using it as a CA. If I try to use openssl it just throws out
Can't open index.txt.attr for reading, No such file or ...
1
vote
0answers
113 views
Changing OpenVPN-AS root CA
I'm trying to set up an OpenVPN-AS instance (on an Azure virtual machine) that users can connect to and connect to some IoT devices behind routers in the field where the routers support OpenVPN.
My ...
0
votes
0answers
35 views
Push CA cert to Mac clients
I have a large group of Mac clients I need to push an internal CA cert out to. How can I do this without going to each one? They are all linked to Active Directory; would pushing a cert out to them ...
0
votes
1answer
188 views
DirectAccess Certificate Authentication Breaks After New Certificate Authority Deployed
An environment had two Windows Certificate Authorities, publishing a computer certificate via auto-enrollment for DirectAccess authentication.
Customer CA 1
Customer CA 2
The Certificate authorities ...
1
vote
1answer
138 views
Update Intermediate CA certificate?
Tonight I updated our TSL certificate. We deploy behind haproxy with a certificate bundled with an intermediate CA crt and private key in .pem file format. Having downloaded the renewed certificate ...
0
votes
0answers
73 views
get SHA256 has of certificate chain of my certificate
I got my server certificate mycert.pem by command:
cho -n | openssl s_client -connect <my.server.hostname> | sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' > mycert.pem.
I would like ...
4
votes
1answer
285 views
JRE fails to establish LDAPS connection with AD after RootCA cert imported to cacerts truststore
LDAPS is working through ldp.exe and through a number of other programs on windows and linux systems that do not appear to require the Root Cert. at all. Some programs which use JSSE fail to connect ...
16
votes
2answers
2k views
Why not validate self signed certificates through DNS-record instead of letsencrypt
I was just wondering. We use a lot of SSL certificates. Nowadays, we almost exclusively use letsencrypt (thanks!). The bottom line of these certificates is, that proof of ownership of the domain name(...
1
vote
1answer
2k views
SSL routines:ssl23_write:ssl handshake failure:s23_lib.c:177:
I have an openldap master and 2 openldap slaves. Using a non self-sign CA.
openldap master: name debian based on stretch
slapd 2.4.44+dfsg-5+d amd64
openssl 1.1.0f-3+deb9u1 amd64
openldap ...
0
votes
2answers
265 views
Certificate with SubjectAlternativeName (SAN) gives ERR_CONNECTION_RESET in Google Chrome
There is a non-public-facing application. I am trying to make sure that there are no HTTPS-related warnings/errors.
The error I receive after putting the certificate with SAN field (signed by a ...
3
votes
3answers
1k views
Windows server 2012 Sub CA fails because the revocation was offline when using root CA certificate from Linux/OpenSSL root CA
I've been working on a lab setting up a two-tier PKI using a Linux (Debian 9 with OpenSSL) root certificate authority and a Windows server 2012 R2 subordinate certificate authority.
When I attempt ...
