Questions tagged [certificate-authority]

In cryptography, a certificate authority, or certification authority, (CA) is an entity that issues digital certificates.

Filter by
Sorted by
Tagged with
2 votes
1 answer
5k views

Windows CA and .pfx Files

What is the proper way to obtain a certificate, ca cert, and private key (aka .pfx file) from a Windows CA via command line? The way I've been doing it is I create a request file using notepad with ...
l0sts0ck's user avatar
  • 213
1 vote
1 answer
3k views

ADCS Create a new certificate or Rename?

Just joined a new company. Apparently back last year they got rid of the old CA and restored the certificate on a new server. (2003 to 2012). I was about to renew the certificate (self signed) on the ...
KitKatNeko's user avatar
3 votes
1 answer
11k views

Certificate revocation check fails for non-domain guest in spite of accessible CRL

When we try to use certificates on computers that are not part of the domain, Windows complains that The revocation function was unable to check revocation because the revocation server was ...
0xFE's user avatar
  • 201
33 votes
2 answers
33k views

Difference between ca-bundle.crt and ca-bundle.trust.crt

On CentOS 6.5, in /etc/pki/tls/certs I have: ca-bundle.crt and ca-bundle.trust.crt With different file sizes. Which should I use as the trust path for nginx proxy_ssl_trusted_certificate.
Justin's user avatar
  • 5,438
3 votes
2 answers
234 views

Certificate distribution and management

I am planning to setup PKI for our organization as we're fed up with all of these security warnings when using self-signed certs. I want an offline root CA and two issuing CAs and I want to set that ...
Alex's user avatar
  • 516
0 votes
1 answer
345 views

Solution for SSL client certificates with user self service

I'm administrating a linux-based small business network. User information is centrally stored in an OpenLDAP directory. There is an existing CA which is currently used to sign server certificates. It ...
jan's user avatar
  • 103
2 votes
0 answers
556 views

Windows - Replace subject from CSR when issuing certificate

I've received a CSR from a client with a CN, but not with all the subject fields we require. According to this answer from Scott*, it should be possible to specify the final subject values when the ...
Bruno's user avatar
  • 281
0 votes
1 answer
718 views

How to change/remove CRL on root cert?

A few years ago we installed certificate authority onto a widnows 2003 server (CAserver1). we created a self-signed root cert, and issued certs for internal services (https, WCF services, etc). Fast ...
Justin Killen's user avatar
2 votes
1 answer
15k views

Windows CA Certificate Request via Commandline

I have a non-domain PC (windows 7) attempting to obtain a cert from a Windows 2008 R2 Enterprise CA. I have the root ca and crl's installed on the non-domain client. I'm working on a script that will ...
l0sts0ck's user avatar
  • 213
3 votes
2 answers
4k views

Email results of PowerShell Script

I have a powershell script that check the certificate store for expiring certificates. It will display these results within the CLI. I want to modify this script to email the results of the output in ...
DangeRuss's user avatar
  • 217
9 votes
2 answers
5k views

Powershell Remotely Delete PKI Certificates

I recently rebuilt my PKI and I would like to delete the certificates that were issued to all client machines across my network. Sounds like a job for Powershell! So I wrote this script to be ...
Byron C.'s user avatar
  • 747
5 votes
3 answers
28k views

No Certificate Templates in Certification Authority

I have installed AD Certificate Services on a Windows Server 2012 R2 Standard edition. But when I open Certification Authority snap-in, there is no Certificate Templates folder: Why? Have I missed ...
Aleksey Shubin's user avatar
7 votes
3 answers
23k views

How can I get an OID for a certificate template?

I'm using C# (or VBScript) to issue a certificate from an Enterprise CA. According to this answer, I need to specify the OID instead of the certificate name, and place it in an unexpected portion of ...
makerofthings7's user avatar
1 vote
1 answer
305 views

How to install a root certificate from file

We are in the process of migrating to Exchange 2013 on Server 2012 R2, and will be using third party certificates once fully up and running. In the meantime, however, I have been asked to use a root ...
Steve's user avatar
  • 25
8 votes
1 answer
24k views

Publish root CA and sub ca certificate to the Trusted root certificate store

I have a root CA which is standalone and I have subordinate CA which is domain joined. I recently renewed the certificate of my root CA and sub CA. How do I push these certificates in the trusted root ...
user227931's user avatar
1 vote
1 answer
893 views

Do I need to resign/regen a cert when moving IPs?

Are these errors related to moving a site to a new IP and keeping the same SSL CERT? Will I need to regen/sign to fix this? [Sun Jun 22 07:13:11.054280 2014] [mpm_worker:notice] [pid 2775:tid ...
Jason's user avatar
  • 3,941
2 votes
2 answers
13k views

ADCS - How can I diagnose the exact reason a certificate request was denied by a policy module?

I need to develop operational procedures to audit and understand why a specific request was rejected by an Active Directory Certificate Services (ADCS) Policy Module. I've attempted turning on all ...
makerofthings7's user avatar
8 votes
3 answers
4k views

Windows 2012R2 seems to automatically download and install intermediate root certificates

Whilst preparing a new Windows 2012R2 server for production I needed to install a (GlobalSign Domain) SSL certificate for the website powering our application. I did this by generating a certificate ...
Kev's user avatar
  • 7,897
65 votes
4 answers
24k views

How to decide where to purchase a wildcard SSL certificate?

Recently I needed to purchase a wildcard SSL certificate (because I need to secure a number of subdomains), and when I first searched for where to buy one I was overwhelmed with the number of choices, ...
user664833's user avatar
  • 1,277
1 vote
0 answers
177 views

Exchange on WP7 - 80072F0D

Last week, the self-signed certificate on our Exchange 2010 mailserver expired, so we made a new one. Everything works fine after this, except mail on Windows Phone 7. All phones are giving an error ...
Jente's user avatar
  • 161
1 vote
1 answer
1k views

Root certificate authority works windows/linux but not mac osx - (malformed)

I have created a self-signed root certificate authority which if I install onto windows, linux, or even using the certificate store in firefox (windows/linux/macosx) will work perfectly with my ...
AKwhat's user avatar
  • 11
0 votes
0 answers
102 views

SSL warning appears only to some devices

I have godaddy ssl certificate for domain.There wasn't any problems with my SSL certificate and visiting my domain(Haven't receiveed any errors), but couple times(two weeks ago) when I visited site ...
user1718607's user avatar
0 votes
1 answer
3k views

Unable to install Certificate Enrolment Policy Web Service

I'm running on Windows 2k8 Enterprise edition, and when adding the Active Directory Certificate Services, I don't see the option to add the Certificate Enrolment Policy Web service in the dialog box. ...
stealthmode's user avatar
7 votes
1 answer
1k views

Does Apache needs to know about intermediate certificates for client authentication?

I have a following hierarchy of certificates. And I need to do a client authentication on Apache. . └── root (CA) - self signed ├── intermediate 1 (CA) | ├── client1 | ├── client2 ...
Victor Ronin's user avatar
4 votes
2 answers
185 views

Beginning a company's digital certificate infrastructure [closed]

What type of digital certificate product do I need to begin a digital security infrastructure within my company and for use by our customers (pre-trusted by chaining)? I believe I need some kind of ...
Jason Kleban's user avatar
0 votes
0 answers
229 views

no local computer physical store, only registry and smartcard

I'm currently encountering an issue whereby i cannot see the "local computer" physical store, under trusted root CA, when attempting to install a cert. Instead the only stores i see are "Registry" and ...
Z Holt's user avatar
  • 219
1 vote
2 answers
4k views

How to change root CA certificate?

I am running an own CA for my network, just to have it installed into the browser, so that I can see if a server still has the certificate I created (vulgar: having the green lock). Of course I just ...
fdafgfdgfagfdagfdagfdagfdagfda's user avatar
0 votes
0 answers
475 views

Update Root CA Certificate values (Country/location(locality)/etc)

Our Offline Root CA server was setup prior to my joining the company and has com as the country code which is invalid for several things that I'm needing to do...primarily to get clients to stop ...
Jared's user avatar
  • 281
0 votes
1 answer
163 views

Could Certificate Authorities have been compromised by the Heartbleed bug? [closed]

OpenSSL is widely used and was affected by the Heartbleed bug for years. A lot of services were impacted and everybody is trying to recover from this bug by updating there system, generating new ...
kunnix's user avatar
  • 3
0 votes
1 answer
271 views

How should I structure my CA hierarchy?

My current setup involved a self signed root CA, which has then signed my SSL/TLS CA and my OpenVPN client CA. The SSL/TLS CA signs the certificates of my servers, and the OpenVPN client CA signs the ...
Robin McCorkell's user avatar
7 votes
1 answer
6k views

If I get a certificate signed for ECDSA will older browsers be able to use RSA?

I'm looking into using ECDHE-ECDSA and there are a lot of great articles on why (https://hynek.me/articles/hardening-your-web-servers-ssl-ciphers/) and (http://blog.cloudflare.com/ecdsa-the-digital-...
paintedbicycle's user avatar
1 vote
1 answer
666 views

Windows Server 2008 R2 CA not issuing more than 2 years

I have active directory environment in 2003 R2. I have installed 2008 R2 Enterprise Edition CA. Then I have created custom template from web server template and add expiry date as 15 years. my root ...
user34694's user avatar
4 votes
2 answers
7k views

Why do I need to create symbolic links for certificates?

Other than noticing something like this: yourid@linuxtpf:~/certificates> ls -l lrwxrwxrwx 1 yourid users 9 2009-04-07 18:06 50a694ac.0 -> cert2.pem #<-- was missing lrwxrwxrwx 1 yourid ...
MrDaniel's user avatar
  • 143
3 votes
1 answer
2k views

How to include all dns records and IP address of a server in automatic certificate enrollment of Microsoft AD CS?

In my company there are a lot of servers which users remotely login to them to do their duties. We have enabled computer certificate auto enrollment for them to assure secure connection. But because ...
Pezhman Toghia's user avatar
3 votes
1 answer
2k views

Time stamped digital signatures with AD-CS

We are planning to implement a time proof digital signature solution in our intranet. Currently we have a Enterprise AD CS up and running. We are planning to use these signatures only inside our ...
Sandor's user avatar
  • 131
1 vote
1 answer
2k views

SSL on AWS? Cert installed but still having issues

We bought an SSL certificate (From Comodo) and when I visit the page in Chrome I see the green padlock and it has the following information: Your connection to ...... is encrypted with 128-bit ...
niczak's user avatar
  • 191
1 vote
3 answers
21k views

Does a domain computer trust certs from domain CA

I have investigated this but have been unable to find a definitive answer to my question. I have never used certificate services in active directory before so am unsure of its possible usage/...
James Edmonds's user avatar
1 vote
2 answers
618 views

How to determine if the user requested a certificate using "Mark keys as exportable"?

We have a Windows 2008 R2 running a standalone CA (certificate authority) and the web enrollment, so the users access http://[server-name]/certsrv websote for request certificates. The Advanced ...
armydeveloper's user avatar
1 vote
0 answers
75 views

EFS file access problems

in my organization, i have a deadline to deploy EFS using AD CS, and i am working with a single windows server 2003 box, which is the Root CA, and is the same server responsible to certificate ...
user117894's user avatar
0 votes
1 answer
840 views

Win2008 SRV Certutil csv option not present

I have an Enterprise Certificate Authority running well. I am attempting to automate some monitoring tasks using batch files and the certutil.exe command. After reading the documentation at: ...
JuanKB1024's user avatar
5 votes
1 answer
3k views

How do I configure AD CS to support Name Constraints (4.2.1.11 in RFC 2459)?

I am trying to figure out how to do Qualified Subordination with the critical extension set, but I'm unable to figure out how to do this in MSFT AD CS. For a given certificate, how do I make sure ...
makerofthings7's user avatar
1 vote
2 answers
143 views

Which operating systems ship with StartCom_Certification_Authority.pem

I purchased some (cheap) HTTPS certificates from StartSSL. They work great on all browsers I tested. According to this post they are even recognized in IE 7 and 8, which good enough for me. However, ...
Jeroen Ooms's user avatar
  • 2,239
12 votes
3 answers
3k views

Why issue a SSL certificate that expires in 2037?

In Firefox, if I view the Verisign Universal Root Certificate Authority, I notice that it expires in 2037. (Settings tab -> advanced -> view certificates -> VeriSign Universal Root Certification ...
user3298687's user avatar
0 votes
1 answer
1k views

Auto-enrollment certificate without enroll permission

I am Domain Admin of a company. We implement Active Directory Certificate Services in our company for email signature and encryption. Because we have more than 1000 users in our company, we want to ...
Hojjat Jashnniloofar's user avatar
2 votes
1 answer
18k views

LDAP-based Apache auth (mod_ldap + mod_authnz_ldap) using own CA for SSL/TLS

SOLVED: Turned out problem was caused by forgotten legacy LDAPTrustedGlobalCert directives in various config files, using old certificate for the same FQDN tl;dr: We uses a self-signed CA and we ...
CDuv's user avatar
  • 242
1 vote
1 answer
4k views

ADCS WebEnrollment : The context was acquired as silent

I have setup Active Directory Certificate Services with Web Enrollment and I have the following error when enrolling certificate on other computers that are in the same domain : Certificate ...
Steven Muhr's user avatar
0 votes
1 answer
783 views

Is it safe to delete Exchange/IIs server certificate that is not tied to any service?

Exchange [EMC] View of certs Name: Blank Self Signed: False Status: The cert is valid for exchange server usage Services: None Subject: CN=Servername.domain.local Issuer: CN=Domain-servername-CA ...
zman's user avatar
  • 633
0 votes
1 answer
52 views

How can I get HTTPS working with this particular site?

I am trying to make an SSL wrapper to a website (and eventually redirect all HTTP requests to the HTTPS domain), on a Saucy EC2 instance. Right now Apache restarts without reported error, and it ...
Christos Hayward's user avatar
1 vote
2 answers
1k views

Postfix, TLS and StartSSL certificates

I recently changed my postfix installation to use TLS with a certificate issued by StartSSL. I then ran SMTP and TLS checks with no errors or warnings. Everything seemed to work fine. My problem now ...
Chris's user avatar
  • 193
0 votes
2 answers
214 views

Send a server certificate to a customer in pkcs?

I was asked by a customer / partner company to send them the certificate for one our webservers and the corresponding root ca certificate in .pkcs or .pem format to install it in his Riverbed proxy ...
st3dster's user avatar

1
10 11
12
13 14
17