Questions tagged [certificate-authority]

In cryptography, a certificate authority, or certification authority, (CA) is an entity that issues digital certificates.

Filter by
Sorted by
Tagged with
2
votes
1answer
38 views

Windows Certificate Authority Server runaway issuing certs

In our environment, we have a Windows Certificate Authority server. We've distributed our CA to our folks, and generated some certificates with CSRs for internal websites. That works great. We tried ...
0
votes
0answers
46 views

Submit SPKAC with subject to standalone ADCS

Microsoft's documentation suggests that it's possible to include a subject with a SPKAC CSR - https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-wcce/f88ecd9a-26bb-4b74-a471-4c46e773f75b. ...
0
votes
0answers
17 views

Why autoenrollment of some certificates out of the box in Windows Server with CA installed

I have learned that I have to do three things to start autoenrollment of certificates: activate a template with autoenrollment and grant permissions on security tab for those users/ computers Issue ...
0
votes
1answer
25 views

Certificates explanation for VPN Server Edgerouter + IPSec/IKEv2 + Active Directory Certification Authority

I’m trying to setup a IPSec/IKEv2 VPN Server for roadwarriors on my EdgeRouter 6P which has Linux Strongswan 5.6.3 on board, with Active Directory CA as TRUSTED ROOT CA and Microsoft NPS as Radius for ...
-1
votes
1answer
66 views

MTLS on Nginx that works with client side Android Apps?

Is there a way to pull off MTLS/Two-Way SSL/Client Certificates that work on unrooted v10+ Android Clients on the cheap? I have a couple of personal api end points that I want to be publicly ...
1
vote
1answer
30 views

No certificate templates in Certificate Services server on Windows 2019

There are a lot of discussions on here about this problem, and I have spent all day exploring every one of them. All the servers involved in this are Windows 2019. 2 domain controllers and a ...
0
votes
0answers
26 views

Why have both CERT and TLSA DNS RR?

I know of at least 2 DNS resource record types that serve the purpose of enabling domain owners the ability to control approved/revoked certificates either self-signed or by CA's namely the CERT and ...
0
votes
0answers
19 views

Create EJBCA subCA during EJBCA installation

I am learning how to install and use EJBCA to deploy an enterprise PKI. I know I can install EJBCA using a quick install configuring the script ejbca-setup like is explained here, and I also have ...
0
votes
1answer
87 views

Does DANE allow for trustable self-signed certificates?

DANE has 4 modes of operation indexed 0-3 with mode 3 i.e. Domain issued certificate allowing for self-signed certificates. Can this mode be used in a trustable manner? and if so does that mean that ...
0
votes
1answer
51 views

Certificate Enrollment Error The Specified File Is Read Only

Well. It seems the entire internet has never seen this error before. I have a Windows Enterprise PKI infrastructure. I have made a copy of the CEP Encryption template, and changed the security ...
0
votes
1answer
135 views

Failure renewing root CA certificate - 0x80090016 NTE_BAD_KEYSET

We have a multi-tiered PKI infrastructure with a standalone, offline Root CA. Every year we go through a process of extending the root CA certificate (renewing while reusing existing keys) and ...
0
votes
1answer
35 views

Autorenew not working when setting up key based renewal - Cep/CES

I am trying to configure Key Based renewal using WES to support autorenwal of certificates in workgroup computers and untrusted domains. I have configured CEP (Certificate Authenticatoin, Key Based ...
0
votes
0answers
26 views

Microsoft CA Web Enrollment authentication issues

Currently i have a separate server configured for web enrollment with open trust delegation from the enterprise CA. (using kerberos only) However, when i require windows authentication for the web ...
0
votes
0answers
25 views

3 Windows CA servers - needs to consolidate into one

Currently, we have 3 CA servers (two Windows 2012 servers one of which is also DC and one Windows 2016). We would like to export all active certificates from two Windows 2012 servers and then remove ...
0
votes
1answer
16 views

How to remove a “not safe” flag when getting into a RHEL cockpit portal on my intranet (AD based)?

I have an ERP server hosted on RHEL 8.3, and for management I use cockpit portal from my web browser. Everytime I enter to this portal I get a message saying the website is not trustable, and I want ...
0
votes
0answers
80 views

SSL Root CA certificate is not recognized, although present in the trust store

We need to implement MTLS on nodejs - client side. This is my code: const fs = require('fs') , path = require('path') , certFile = fs.readFileSync('./client.crt') , keyFile = fs....
0
votes
1answer
32 views

Upgrading certificate template schema

I need to update one of my Active Directory Certificate Services (ADCS) certificate templates from schema v2 to v3, to support KSP providers. It seems that I can only do this by cloning the template (...
0
votes
1answer
36 views

Verifying Certificate is installed on all computers in an OU - Powershell

I'm trying to confirm a certain certificate is installed on all computer in the Trusted Root Certification Authority folder. This is what I have so far: $Computers = Get-ADComputer -Filter {...
0
votes
0answers
109 views

ca-certificates.crt doesn't include my custom CA certificate after “sudo update-ca-certificates”

I'm trying to install the public CA certificate of a 3rd party service, onto a Debian instance. I'm doing this so that the SSL certificate of the 3rd party service that I'm connecting to can be ...
2
votes
1answer
60 views

Windows Certificate Authority - Auto Enroll RDP certificates trusted CA error

So I'm running into an odd issue. I just setup a Windows Certificate Authority server and am able to use the web interface to issue Web SSL certs. My Fortigate and Fortianalyzer both have certs from ...
0
votes
2answers
48 views

Windows Certificate Templates CSP certificate with Exportable Private Key

I recently created a certificate for a developer using a certificate template. The template was based from an existing one which I believe is based on CNG.I was able to export the private key, but the ...
0
votes
1answer
42 views

Windows AD CA Code Signing Cert Request for Wrong User

I am having an odd problem with a Code Signing certificate request from my Windows 10 workstation. We have a Windows Server 2012R2 CA setup with the Code Signing template and everything works fine if ...
1
vote
1answer
41 views

Certificates in docker local registry

I'm trying to set up a docker local registry within my university network. Since they offer certificates from rediris I requested one, so I have now three different files: cert.pem intermediate.pem ...
0
votes
1answer
60 views

Certificate Used for Azure App Registration

We need to create an Azure Application registration for an application which is only being run internally. The requirements are that it uses certificate authentication and we can't use Self Signed. I ...
0
votes
0answers
18 views

Resources using a successfully issued (I think?) ACM Certificate produce net::ERR_CERT_AUTHORITY_INVALID when accessed

We're using an ACM certificate to afford custom CNAMEs in a CloudFront Distribution and an API Gateway API. This was working correctly until we recently moved the creation and assignment of this ...
0
votes
1answer
62 views

I have an internal PKI with a shared root CA, and multiple intermediate CAs, how do I make anything issued by any intermediate CA to trust everything?

Situation: I have an internal PKI with a shared root CA, and multiple intermediate CAs. I want anything issued by any intermediate CA to all trust each other. Is there a way to do this that most ...
1
vote
1answer
24 views

Windows certificate templates: how to make certificates from certain templates recognizable

I'm using X.509 client certificates to authenticate a well-defined set of Windows clients via mutual TLS. A certificate template exists that issues this type of certificate to all clients in this set, ...
2
votes
1answer
35 views

Windows certificate templates: how to include group (or OU) claims in SSL/TLS client certiifcates

I'm using X.509 client certificates to authenticate a set of Windows clients via mutual TLS. Which clients are part of this set should somehow be administered in AD, e.g. via group membership or ...
0
votes
1answer
59 views

ADCS Subordinate CA: does the domain automatically trust the root

I created a subordinate "enterprise" CA server using ADCS on an active directory domain. The root CA that signed this subordinate CA's cert is not part of the windows domain. Q1: Does the ...
0
votes
1answer
117 views

I want to combine my rsa.public with my rsa.private to a .pfx that I can use to digitally sign an xml file

Here is the code I have so far: for the private key: openssl genrsa -out rsa.private 1024 for the public key: openssl rsa -in rsa.private -out rsa.public -pubout -outform PEM Then I'm trying to ...
0
votes
1answer
476 views

CA with intermediate certificate for vault

I want to setup Private CA for internal services using Vault (HashiCorp). I am generating Root CA & Intermediate CA certificate outside of Vault. Vault will be generating short-lived (30 days) ...
1
vote
0answers
24 views

Windows server Essentials fault by not find correctly named server certificate

I have a problem with CA configuration on AD windows server 2012r2. It manifests itself by error with starting "windows server essentials services". I figure out there is something wrong ...
0
votes
0answers
24 views

freeipa certificate sining a sub ca for a device

I have a working Freeipa server install, I am at a loss as to how one would need to go about signing a sub ca request from a juju vault request. I have mostly followed the ubuntu enterprise install ...
0
votes
0answers
107 views

Enable TLS for SMTP in IIS6 on Windows Server 2012 R2

We have a situation where we have been advised to open ports 587 and 465 on our production server in order to receive traffic from Exchange Online to the server. However, we understand that these ...
0
votes
1answer
58 views

Strongswan 5.7.x not sending intermediate certificate

I am attempting to use a letsencrypt certificate on my strong swan server; but I also see this behaviour with my own internal CA. When trying to connect from a windows 10 host to a strong swan ...
1
vote
1answer
605 views

NGINX unable to get issuer certificate

I am using NGINX web server. Configured my site with a setting where user will be challenged to present his certificate when he makes first request to the site by using following setting: ...
0
votes
1answer
72 views

Overriding “SSL client : No” for a specific nginx vitual server

I have a bunch of clients (too many to easily retrofit) each holding a single certificate (signed by a non-standard CA over which I have no control; I just generated the CSRs). Now I need to setup a &...
0
votes
0answers
31 views

Unable to convert Zentyal CA generated cert for Nginx

I installed Zentyal to be my certificate authority. CA was installed just fine and I generated few certs. However I wanted to replace Zentyal frontend (nginx based) SSL cert with the one from its own ...
0
votes
1answer
66 views

RootCA and Trusted RootCA

I am planning buy a domain name lets called it foobar.net Home devices will similarly be added to network called foobar.net I plan to run a certificate authority to issue certificates to these devices....
0
votes
3answers
406 views

I'm trying to create (SSL/TLS) certificate with AWS, failing

I'm trying to request a (SSL/TLS) certificate with AWS Certificate Manager. but getting this error: Something went wrong Cannot request more certificates in this account. Contact Customer Service for ...
0
votes
0answers
45 views

Certificate validation with non-standard CA

I have a Certificate which has been issued by a non-standard CA over which I have no control. I generated the CSR, sent it to non-standard CA and it returned a valid Certificate. This Certificate is ...
0
votes
1answer
319 views

CAPolicy.inf and Install-AdcsCertificationAuthority

I am just working on creating 2-tier PKI and wonder why so many tutorials create such capolicy.inf [Version] Signature="$Windows NT$" [PolicyStatementExtension] Policies=InternalPolicy [...
0
votes
1answer
130 views

Publish certificate in Active Directory not working as intended

I have an AD forest and one CA server. In the certificate template I have "Publish certificate in Active Directory" checkbox checked. Also in the template, the Subject Name option is set to &...
1
vote
0answers
368 views

FreeIPA Server Install with external CA

I am tasked with building a FreeIPA server to help us manage TLS certificates to support Nginx, Postgres and RabbitMQ. I have never worked with certs from an admin perspective so I may be making some ...
0
votes
1answer
38 views

How to create a thirdlevel CA in Step?

Step allows to use an existing root-certificate using step ca init --root=a.crt --key=a.key. In that case step generates an intermediate certificate for later use. However, my root certificate was ...
0
votes
0answers
50 views

Enterprise Issuing CA denied bind by domain controller

I am setting up a test environment and have a standalone Root CA and an Enterprise Intermediate CA as my issuing. On a third server, I set up an OCSP responder. The OCSP server and the Issuing CA are ...
0
votes
0answers
545 views

Intermediate CA Certificate Renewal for Direct Access

Background: We have DA, single site config. Enterprise PKI with Offline Root and online Intermediate CA (Intermediate CA used to issue Computer Certs to clients for DA). The Intermediate CA's cert is ...
0
votes
1answer
46 views

Do I need to copy RootCA in machine 2 & 3's trusted root

I have 3 machines in domain and where I choose Machine1 to host asp.net web api application. I have create my own CA RootCA and put in Machine1's trusted root. then I issued one more certificate X ...
0
votes
1answer
116 views

How can I read explicit https proxy CA certificate on RHEL7?

I have server behind explicit https proxy with SSL decryption but I don't know its certificate and I have no way to obtain it from human being. Is it possible to retrieve https proxy certificate from ...
1
vote
1answer
447 views

One Mac user still stuck with expired AddTrust Root CA Certificate but the server has been updated

I recently ran into this issue of the Sectigo Root certs expiring on May 30th of this year: https://gist.github.com/minaguib/c8db186af450bceaaa7c452ba6a9901b I updated the certificate chain on our ...

1
2 3 4 5
15