As of May 31, 2023, we have updated our Code of Conduct.

Questions tagged [certificate-authority]

In cryptography, a certificate authority, or certification authority, (CA) is an entity that issues digital certificates.

Filter by
Sorted by
Tagged with
0 votes
0 answers
19 views

CA root and CA subordinate administrator

I want to deploy a new PKI infrastructure on a domain that has several subdomains and trusted domains. I would like to be able to delegate the administration between several administrators ...
Santyuste's user avatar
0 votes
0 answers
27 views

Two Enterprise Root CA's on same domain

I am currently replacing 4 2012 domain controllers with 4 new 2022 domain controllers. I have run into an issue with the certificate authority as there were two enterprise root CA's installed on the ...
Tom Gordon's user avatar
0 votes
0 answers
24 views

LDAPS, Certificate Authority, and Domain Controllers

I have a domain environment with 4 2012 Domain Controllers that I am working on replacing with 4 new 2022 domain controllers. I have some questions regarding how the CA works when issuing certificates ...
Tom Gordon's user avatar
0 votes
1 answer
37 views

Windows Server 2019 ADCS. CA subordinate

I have a "CA1" server with Windows 2019 that has the CA root Enterprise service. Additionally I have another server "CA-Subordinate" with Windows 2019 with the CA subordinate ...
Santyuste's user avatar
0 votes
0 answers
55 views

How to sign a certificate for s/mime and generate pkcs12 store with existing CA?

I want to create a certificate store file in pkcs12 format to use in thunderbird for s/mime signing and encrypting. I already run a mail and web server that use certificates signed by a CA certificate ...
FalcoGer's user avatar
  • 136
0 votes
2 answers
92 views

Can I make strongSwan accept any certificate as long as it is only signed by a specific CA?

Using a swanctl config, is there a way to make strongSwan accept any certificate for an IKEv2 connection as long as it is signed by a specific CA? What I mean is, without having to install the public ...
Mecki's user avatar
  • 869
0 votes
0 answers
75 views

Stuck trying to remove Certificate Authority role from a Windows 2019 AD domain controller

I am trying to remove the Certificate Authority role from a Windows 2019 AD domain controller and am stuck at Step 5, Item 4 "Delete the private key that is associated with the CA" of the ...
greenvomit8's user avatar
0 votes
2 answers
38 views

How to get a google issued certificate for my service behind l4 load balancer

I am running a mqtt broker behind gke LoadBalancer type service. The lb type service is a l4 load balancer and I need to handle the tls termination at my service/broker level. I have associated an A ...
java_doctor_101's user avatar
0 votes
2 answers
64 views

With multiple RDP certificates, do all get checked?

If a Windows host has multiple RDP certificates. Do all get checked while connecting or only the first found? I have a RDP certificates deployed from an Root CA with now invalid OCSP location in the ...
Synertry's user avatar
0 votes
1 answer
79 views

Windows AD cert renewal implementation vs cert copying

Windows PKI policy has a setting for what I think is automated renewal of AD template issued certificates when they expire. It must be also enabled on the certificate authority (CA) side. Question - ...
Seva Alekseyev's user avatar
1 vote
1 answer
327 views

Error: error contacting notary server: x509: certificate signed by unknown authority

I am puzzled how docker and Notary work together. I can not sign image docker pull nginx:latest got Error: error contacting notary server: x509: certificate signed by unknown authority I followed ...
MikiBelavista's user avatar
1 vote
1 answer
83 views

Windows Certificate Authority server

A default installation of a Microsoft PKI running Windows includes LDAP URL's as first within CRL distribution points (CDP's) and Authority Information Access (AIA). Question 1 : I want to issue a ...
nithyanadham singaravadivelu's user avatar
-1 votes
1 answer
197 views

Redhat ubi8-micro container without trusted root ca certificates

I want to run a simple GO application on the registry.access.redhat.com/ubi8/ubi-micro image. But unfortunately I get x509: certificate signed by unknown authority errors in my app because there it ...
Michel's user avatar
  • 183
0 votes
0 answers
40 views

Remote Desktop Gateway (RDG) Public CA certificate not trusted on external connection

Currently moving RDG role from "nene-server" to "NTRDG01, but when trying to connect externally to the gateway, getting certificate error:External error on gateway over https. This was ...
JackWrighty's user avatar
0 votes
0 answers
359 views

K8s : nginx-ingress: SSL_do_handshake() failed (SSL: error:191CF08C:SSL routines:tls_parse_ctos_key_share:bad key share)

As we found out that the nginx ingress as well as the cert-manager were outdated and not compatible with the Kubernetes version of 1.22 anymore. I upgrade the two components: nginx-ingress from 0.26.1 ...
sam23's user avatar
  • 29
0 votes
1 answer
41 views

Can we add a subordinate enterprise certificate authority linked to an existing enterprise Root certificate authority

The Root CA is domain joined. The Sub CA will be domain joined. The Sub CA will deliver workstation Authentification (template) to PC clients via GPO. Is there any known issue with this configuration? ...
dr23trik's user avatar
0 votes
2 answers
50 views

Can a CA generate a signed certificate for a host in to a top-level domain not under the CA's control?

Background I need to replace an existing certificate on a host named h1.vx.mydomain.net (not the real domain obviously). The existing certificate says it was issued by a chain of CAs that I do not ...
JamesHoux's user avatar
  • 257
0 votes
0 answers
49 views

how to add Certificate Sign on .pem file under x509v3 Basic constraints

Could anyone please suggest me to add or remove Certificate Sign parameter which I marked in the below-mentioned picture? I know it can be done on openssl.cnf file but couldn't able to identify the ...
ram ajay's user avatar
0 votes
0 answers
59 views

Client side certificate cannot be installed on Apple ios. Error-"The authenticity of "cloudflare" cannot be verified"

We use client side Cloudflare certificate to allow or disallow access to our site since the site is meant to be used by a small group of users who are provided a Cloudflare client certificate. Our ...
Muhammad Ebrahym's user avatar
0 votes
0 answers
324 views

Nginx SSL private key error

I'm configuring Nginx with self-signed SSL certificate. Nginx fails to start due to the following error [emerg] cannot load certificate key "/path/to/my.key": PEM_read_bio_PrivateKey() ...
kebugcheck's user avatar
0 votes
1 answer
119 views

Import Custom SSL Certificate in Zyxel GS1920-8HPv2

I have a problem with importing a server ssl cert for https web connection on myZyxel GS1920-8HPv2. On the WebGui of the Switch, there is an information, that the cert and key has to be in a pkcs12 ...
sangul's user avatar
  • 1
2 votes
2 answers
263 views

create a self-signed certificate for a subdomain, the main domain does not belong to me

I have my internet box provider who offers me a free subdomain to connect to my network, ex: xxxxx.provider.com I have generated a self-signed certificate for the subdomain foo.provider.com I tried to ...
Pascal de Sélys's user avatar
1 vote
1 answer
283 views

Windows Custom Certificate (certlm.msc) - Default Values

In windows server 2019, I create custom CSR by invoking certlm.msc, and selecting Personal -> All Tasks -> Advanced Operations -> Create Custom Request & then use the Certificate ...
vasikan's user avatar
  • 15
0 votes
0 answers
89 views

Domain Certificate Authority Role On None Domain Controller

I am setting up a new domain and I need to setup a Root CA and a Certificate Authority to hand out certificates to domain computers as well as to handle certificate actions and secure communications. ...
JukEboX's user avatar
  • 811
0 votes
0 answers
27 views

2 Issuing CAs are Effected by Subnet Region

We are working to set up a 2-tier pki with 2 issuing CAs in different regions/subnets. We were able to get everything looking right on pkiview.msc. We are still having trouble though with the second ...
Woogi's user avatar
  • 1
0 votes
0 answers
12 views

For an IoT device is there a way to associate a certificate authority that will not expire in a year so the device can roll certs periodically?

To me it is a chicken and egg thing. I want an architecture that will always have the device renewing keys on updates or periodically. Initially, I can have manufacturer setup the CA on the device. ...
Christian Matthew's user avatar
0 votes
0 answers
267 views

Certificate Server Issues

We have 1 root server and 2 intermediate servers. We have been having issues where every year when it's time to renew user and computer certs issued from the intermediate servers, they do not renew ...
ShatmireEverpants's user avatar
1 vote
1 answer
669 views

OpenVPN - Can client certificates and keys be created if you only have ca.crt

All servers are debian 9 linux. I have 200 servers with openvpn installed, each with three to four clients (tunnel 2) clients ---> server1 (1 of 200) (also client for jumpserver) ---> jumpserver ...
Cruise5's user avatar
  • 73
0 votes
1 answer
226 views

Can a server certificate from a CA not have CRL URLs?

I'm trying create a validation for server certificates and one of the things I need to do is to check if the certificate is revoked, but the server certificates from a specific server seems to not ...
nicolasassi's user avatar
0 votes
0 answers
57 views

How do I fix missing or multiple CA certificates causing chain issues?

There is only one enterprise CA server. The server has 4 certificates configured under properties > general. These certificates show up in the local store of all domain computers under "...
naps1saps's user avatar
  • 177
-1 votes
1 answer
464 views

CertUtil: The directory service encountered an unknown failure. 0x800720ef (WIN32: 8431 ERROR_DS_UNKNOWN_ERROR)

I am trying to publish revoked certificates and I am getting an unknown failure when using the Certificate Authority console: The Application Log in the Event Viewer: It says: Active Directory ...
thotheolh's user avatar
0 votes
1 answer
439 views

Having trouble issuing the 2nd enterprise CA on the same offline Root CA as the 1st. Windows Server 2016

I am running into an issue and hoping someone can help me. We were asked to set up a new Root CA and 2 subordinate (issuing) CAs under it (the request includes using Azure and placing each VM in a ...
Woogi's user avatar
  • 1
0 votes
0 answers
49 views

Certificate marked as "not trusted by CA

I have a rather surprising problem these last days on one of my certificates signed by my root CA (via AD-CS). I noticed that my browser sends me back a message that I have never seen in place of my ...
Sagaroth's user avatar
-1 votes
1 answer
374 views

Cant Enroll/renew Certificate : Server 2008R2 as client ans Server 2019 as CA

I have an issue with all my 2008R2 servers, they can no longer enroll/renew certificates. It works with windows 10 and server 2012 R2 as client. Error is RPC not available. From Event Viewer L’...
Alex Lum's user avatar
  • 145
0 votes
0 answers
18 views

Why does Acrobat list invalid local root CA certificates when I sign documents?

We use certificate signing in Acrobat internally in our org. An issue has come up when signing documents there is a banner that says "at least one signature has problems". Investigating ...
naps1saps's user avatar
  • 177
3 votes
1 answer
6k views

Update CRL with OpenVPN server for longer expiration?

If the error "VERIFY ERROR: depth=0, error=CRL has expired" is received when a client attempts to connect to the OpenVPN server, it can be fixed as follows: cd /etc/openvpn/easy-rsa easyrsa ...
AlphaCentauri's user avatar
-1 votes
1 answer
237 views

How to have good SSL/TLS certificates without proxying through cloudflare?

I currently have a site hosted on my local raspberry pi, and I have my domain registered through cloudflare. I would also like to be able to use PiVPN to access the contents of the VPS when I am away ...
Craig's user avatar
  • 99
0 votes
1 answer
61 views

Deprecation of OrganizationalUnit in Subject of TLS Certificates

Recently we got a mail from our certificate provider that they are removing the OU field from Subject of new/renewed certificates after 1st September. This is related to decision made by Certificate ...
Abhishek Jayaram's user avatar
1 vote
2 answers
531 views

How to Delete CRL Files in Local Cert Store

I need to import CRL files to a Bastion server that is not part of my environments domain. The CRL files are updated every few days so a new copy needs to be imported to the local cert store on the ...
jrd1989's user avatar
  • 668
2 votes
1 answer
750 views

openssl - cross sign certificate

I want to cross-sign a third-party root ca (third-party-ca) with my own root ca (r1). (Background: restricting usage) To do this, I use openssl x509-in third-party-ca.crt -CA /etc/pki/r1/ca.crt -CAkey ...
Zulakis's user avatar
  • 4,133
0 votes
2 answers
210 views

How can I set the ACL of a CA programmatically?

When launching the CA console (certsrv.msc), I can right-click on my CA, select Properties and then I can modify the ACL of my CA in the Security tab. When I modify it, the changes are applied to the ...
stackprotector's user avatar
0 votes
1 answer
1k views

Domain Member Servers - Accessing Certificate Revocation List (CRL)

In my environment I have a Enterprise Root CA installed on a domain controller and a separate domain controller configured as a Subordinate CA - I know this isn't recommended for security reasons but ...
jrd1989's user avatar
  • 668
0 votes
1 answer
716 views

Generate CA signed ECDSA certificate

I need a CA signed ECDSA certificate for testing purposes. I am able to generate an ECDSA certificate and key but I have never signed one. I use OpenSSL in a Windows environment to generate ...
Amal Jesudas's user avatar
0 votes
2 answers
2k views

Windows Certificate Authority - Adding Additional Attributes

In AD Certificate Templates the templates have an option to build from AD information and includes Email, DNS, UPN, etc. When creating a CSR using powershell, openssl and the certificate mmc snap-in ...
jrd1989's user avatar
  • 668
1 vote
0 answers
798 views

NET::ERR_CERT_AUTHORITY_INVALID error in Chrome but not in Firefox

I'm using AWS and I have requested an ACM certificate. I used DNS validation to make it a valid cert. Now I've attached it to a private ALB. The URL is private. When I connect with my VPN and I can ...
DenCowboy's user avatar
  • 303
0 votes
1 answer
2k views

The certificate request was submitted to the online authority, but was not issued. The request was denied

I've a Hyper-V lab with few VMs. I'm trying to renew expired server certificate for one of my virtual machines which is running Windows Server 2019 (version 1809). I'm trying to renew the certificate ...
RBT's user avatar
  • 243
0 votes
1 answer
119 views

How does OCSP handle deleted certificates?

We have a Microsoft Certificate Authority running on Windows Server 2019. We are issuing certificates to Android devices via a MDM. The Android device users browse to a web application (hosted by ...
user2140583's user avatar
2 votes
2 answers
521 views

GPO to add a purpose to root certificate

The root certificate of the DFN-PKI "T-TeleSec GlobalRoot Class 2" is not activated in the Windows certificate store for the certificate purpose "code signing". I can activate it ...
Kris_R's user avatar
  • 305
0 votes
1 answer
324 views

Non-working Windows server 2003 Enterprise CA removal

Amongst a bunch of server, I have a Windows 2003 server, domain controller, Enterprise CA installed, cannot start CA service, because "a required certificate is not within its validity period ...
Odysseus's user avatar
1 vote
1 answer
725 views

How do I sign my own SSL certificates so that they cover www and non-www domain names?

When using a commercial Certificate Authority, generating a csr for the common name www.mysite.com and sending it to them will result in a certificate being issued that works for both www.mysite.com ...
Nick's user avatar
  • 4,503

1
2 3 4 5
16