Questions tagged [pki]

Public Key Infrastructure is a cryptography system based on X.509 digital certificates, commonly used for encrypted communication and authentication.

Filter by
Sorted by
Tagged with
0
votes
0answers
30 views

This computer can't connect to the remote computer. Unknown key usage (1.3.6.1.4.1.311.54.1.2)

I'm unable to RDP to a server on our child domain after adding a Remote desktop certificate that is signed by one of our Certificate authorities. We have intentionally removed the self-signed RDP ...
2
votes
1answer
66 views

Certbot: Issuing a certfiicate for internal IP address with my own PKI?

I am running my own ACME CA server that allows issuing of certificates to IP addresses. I have installed the root certificate into all the devices in my LAN. Let's say that I am running the server at ...
0
votes
0answers
35 views

Microsoft NDES Automated Challenge Password retrieval

We recently implemented NDES and we are looking for a way to automate the challenge password retrieval with dynamic passwords as apposed to using a static password. However from my search on the ...
0
votes
0answers
31 views

ADCS Change AIA information from existing certificate

We have built a tier 2 PKI. Recently we decided to start hosting our CDP & AIA on a seperate webserver. However this was not originally in the design, so now we have problems with the certificate ...
1
vote
1answer
39 views

How to constrain ADCS Certificate template to user or computer type

How do I differentiate between a User or Computer certificate in my certificate templates? I currently have a template designed for a webserver SSL certificate, however, both users and computers can ...
0
votes
1answer
72 views

How to properly generate an x509 certificate with restricted usage

I'm putting certificates into a repository that will not allow a successive certificate with more limited usage than the previous one. I need an initial dummy cert/key/chain to bootstrap the process ...
0
votes
0answers
49 views

Icinga PKI Agent-Satellite-Master

According to the documentation on https://icinga.com/docs/icinga2/latest/doc/06-distributed-monitoring/, all nodes in an Icinga Monitoring need to have one CA which is on the master node. But I think, ...
1
vote
2answers
80 views

Algo VPN strongSwan client “no issuer certificate found”

I set up an Algo VPN instance on AWS Lightsail using the official Ansible playbook. I can establish the VPN connection using Wireguard, however I cannot get it to work with strongSwan. I configured ...
0
votes
2answers
113 views

FreeIPA Installation Failing During CA Restart

I'm trying to set up a simple vagrant box for testing with FreeIPA. I'm using the CentOS 7 image, and installing minimal extra things to the box, and using a very simple FreeIPA definition to start ...
0
votes
0answers
33 views

Windows CA Migration - Testing the Backup

I need to migrate our Certificate Services from one server to a new one. I am following a guide and there is the stage where you backup the old CA. How do you test that backup? I want to be able to ...
1
vote
1answer
335 views

Windows Server 2019 ADCS - Unable to Install Subordinate CA Certificate

I am setting up a two tier Active Directory Certificate Services PKI hierarchy with an offline standalone Root CA (Server 2019) and an online Enterprise Subordinate CA (also Server 2019). I've ...
0
votes
1answer
52 views

Ubuntu requires subordinate CA as well as Root CA

I have an environment with a root CA and a subordinate CA. my environment is mixed. I have both windows and Linux (Ubuntu 18) servers. On the windows machines it is enough to add the root CA to the ...
0
votes
0answers
54 views

Importing non-exportable certificates into Azure Key Vault?

Does somebody knows how to import a certificate into Azure Key Vault so it wouldn't be possible for anyone (including admin with highest privileges) to export its private key? Preferably into HSM, but ...
0
votes
1answer
52 views

Incorrect Subject field in Certificate

I used the certreq command utility (certreq -new) to generate a csr from an .inf file which I sent to an intermediate CA to be signed, using certreq -submit. For some reason the "Issued to" field ...
1
vote
1answer
92 views

Add certificate from Microsoft Azure Key Vault for LDAP/S

The only method I can seem to find to add a certificate for secure LDAP (LDAP/S) for Azure Active Directory Domain Services is to upload the certificate from my local computer. This seems like a very ...
1
vote
0answers
76 views

How can I purchase a document signing certificate to sign/certify PDFs on AWS? [closed]

I'm working a service that fills/generates/signs PDF documents. Users will draw their signature (or type their name) on a web interface, and then my servers will generate the signed PDF. I would like ...
1
vote
1answer
128 views

Why do I have to distribute my CA signed code signing certificate with GPO?

I have an enterprise PKI. My issuing CA is part of my Active Directory. For the Windows Package Publisher I issued a code signing certificate, which should normally be valid inside my whole AD ...
1
vote
1answer
32 views

ADCS PKI - AIA Location when using OCSP

My question is wheter or not I still need to configure the following AIA location on my subordinate CA when I'm using OCSP: http://SERVERFQN/DIRECTORY/<Serverdnsname>_<Caname><...
2
votes
0answers
377 views

Automatically renew certificate: Old cert gets archived, but no new one is issued

We are using Active Directory Certificate Services (AD CS) to issue certificates for internal web applications. We can manually request a certificate from the CA and it gets issued without problems. ...
0
votes
0answers
14 views

Certificate template not found

We use Globalsign as our internal CA. Trying to update it to latest version always fails on a template called "Machine". This template does not exist in Cert Templates MMC but there is an object for ...
0
votes
1answer
70 views

2 Tier ADCS PKI what's different when using HSM's?

In the near future I will be tasked with building a Tier 2 ADCS PKI that uses HSM's, can anyone tell me what I have to do differently when building the PKI, and how the HSM fits into the whole PKI? (...
1
vote
1answer
697 views

OCSP Location error in pkiview.msc. But OCSP responders seem to work

I am currently setting up a new internal Windows PKI infrastructure in our organisation, to replace an old setup. Things are mostly fine, but the OCSP location has the status "Error" in the pkiview ...
0
votes
1answer
51 views

In a production Environment, how does Kubernetes manage TLS Certificates

I've put in place a master and some slaves, I've also generated some TLS certificates manually, and trusted those certificates all around the system. Now, I've installed an open source PKI, and I'd ...
0
votes
1answer
212 views

OCSP client certificate validation

For a home automation project I have created an API (written in ASP.NET so hosted in IIS) and written my own Android app to communicate with this API. To prevent people from accessing specific ...
0
votes
0answers
137 views

EJBCA unable to apply newly created Certificate

The office is using EJBCA for its PKI infrastructure. The RootCA certificate has expired and has to be renewed. A new CA was generated called "Root2CA" and activated. The below steps were to be ...
0
votes
2answers
266 views

AD CS - OID for root and issuing CAs

I am willing to install a Root CA and an Issuing CA with AD CS for my private environment (test purpose). Do I need to obtain public OIDs (i.e. from IANA) or can I skip this requirement since my CAs ...
1
vote
0answers
242 views

Optional TPM Key Attestation in AD Certificate Services

We have a range of Windows 10 computers in our estate - some with no TPM chip, some with TPM 1.2, and some with TPM 2.0. I want to configure a certificate template to optionally perform TPM Key ...
1
vote
2answers
3k views

Explanation of new line in htaccess file: RewriteCond %{REQUEST_URI} !^/\.well-known/pki-validation/(?:\ Ballot169)?

Recently I noticed that a new line was added in the htaccess file in several locations throughout the file. RewriteCond %{REQUEST_URI} !^/\.well-known/pki-validation/(?:\ Ballot169)? I don't ...
1
vote
1answer
53 views

Digital Signatures Using Entreprise PKI

We are a global entreprise with thousands of employees worldwide. We have our own PKI infrastructure which is trusted internally by our systems but unknown externally. We sign contrats with our ...
3
votes
1answer
148 views

Template issues certificate with longer validity than CA Certiicate, what happens? [duplicate]

I am wonder what will happen as a certificate template with a 2 years validity period (for example) will issue a certificate when the CA certificate expires in 1 year. I can think of 2 things that ...
3
votes
3answers
419 views

Server ssh certificate chain against MITM attacks?

During first contact with a server via ssh, the server's public key of the chosen key algorithm is presented to the user to validate it. After validation, the result is usually saved into the ~/.ssh/...
3
votes
1answer
61 views

Smart Card removal behavior and card renewal

My customer is planning to introduce new Policy regarding smart card removal in their Windows Environment, most probably session break since it's a Citrix environment. Microsoft documentation on the ...
1
vote
1answer
64 views

How to distribute RDP certificates from ADCS to non-domain members?

I have a few hundred systems that are not AD-joined, for which I'd like to issue RDP certificates from an internal hierarchy (built with ADCS). I can do it manually, by generating CSRs, then signing ...
4
votes
1answer
1k views

SSH authentication sequence and key files : explain

As a background to troubleshooting various problems using SSH and rsync with key pairs, I wanted a straightforward overview of the sequence of events that takes place during SSH authentication, and ...
1
vote
1answer
178 views

Migrate to two-tier PKI (Microsoft)

Currently, I have one online enterprise root-ca (and issuing certificates - default templates) that installed on DC (yes, yes I know - worst case scenario). I set another offline not joined to a ...
2
votes
1answer
1k views

OpenVPN - trying to validate CRL on client certificate

I'm running OpenVPN on a hardware router running OpenWRT. Every time a client connects I get the following error in the logs: VERIFY WARNING: depth=0, unable to get certificate CRL I've got a 2 ...
0
votes
1answer
29 views

save openvpn PKI passphrase

I'm using two servers. VPN Server (A), and Client (B). They are both using Ubuntu. The VPN server was installed using PIVPN: curl -L https://install.pivpn.io | bash How do you save the OpenVPN PKI ...
0
votes
1answer
38 views

How to view signatures fulfilling the “Authroized Signatures” option in a Smart Card Logon certificate from a Windows CA

I'm playing with the Windows Server CA role and Smart Card logons. We have a working PKI setup and smart card issuance/logon working. What I'm curious about is the "Require this number of authorized ...
1
vote
2answers
77 views

HKPK Public Key Pinning - Auto add bash script

I recently started using HKPK Public Key Pinning. I have an automated script that generates my csr, certificate, and installs into apache2 on opensuse leap 42.3 I'm looking for a way to add spki ...
0
votes
1answer
199 views

StrongswanPKI - Adding status_request or MustStaple TLS extension to certificate?

Using PKI tool from strongswan to setup a CA. Trying to setup the OCSP side of things have run into many issues as per another thread I posted (Strongswan PKI - ED25519 Certifcates - OCSP Responder ...
1
vote
1answer
77 views

Word document signing - extremely long wait verifying signatures

Our users all have Office 2016 (365 subscription version). We have our own internal MS certificate authority with signing certificates issued to each user. I have a document in Word with 2 signature ...
0
votes
1answer
415 views

Strongswan PKI - ED25519 Certifcates - OCSP Responder having issues

I am trying to setup an ocsp for the certificates generated out of strongswan PKI - using it as a CA. If I try to use openssl it just throws out Can't open index.txt.attr for reading, No such file or ...
4
votes
1answer
648 views

JRE fails to establish LDAPS connection with AD after RootCA cert imported to cacerts truststore

LDAPS is working through ldp.exe and through a number of other programs on windows and linux systems that do not appear to require the Root Cert. at all. Some programs which use JSSE fail to connect ...
1
vote
0answers
433 views

SSH Gateway Pass-through Authentication

We are looking to configure a 'transparent' SSH gateway that passes authentication on to an upstream SSH server based upon the username in the SSH request. All users will be using public key ...
0
votes
2answers
498 views

Certificate with SubjectAlternativeName (SAN) gives ERR_CONNECTION_RESET in Google Chrome

There is a non-public-facing application. I am trying to make sure that there are no HTTPS-related warnings/errors. The error I receive after putting the certificate with SAN field (signed by a ...
0
votes
1answer
1k views

What's “COMODO DCV” is looking for on my server?

Setup: Apache 2.4 Webmin/Virtualmin I'm getting my SSL certificate with Let's encrypt, using also auto renewal. Several hosts with SSL certificate has been created but delete since several months(~...
0
votes
0answers
239 views

How to use public / private x.509 for user authentication with nginx

I have a small nginx web server setup at my house, and access to a CAC and reader. the CAC already has public/private x.509 certificates loaded on it. I can export the certificates no problem. I'm ...
2
votes
1answer
479 views

Disable SSH Public Key Login for a user when her Active Directory account is disabled

I have many users in my environment who deploy their public keys on the linux servers for password-less and secure login via SSH. All these users have accounts on our Active Directory, however, when ...
3
votes
0answers
467 views

PKI Authentication in HTTPD using Active Directory (LDAP)

In my environment, an external entity provides a Root CA & Intermediate CA(s). They issue thousands of smartcards with PKI certificates for authentication. They provide the Client Authentication ...
2
votes
3answers
1k views

How to create cross certificates (or bridge CAs) in ADCS?

I'm trying to set up a trust between 2 untrusting forests, and I'd like to use either a cross-certificate or Bridge CA solution (not using AD trusts or CEP). I've found loads of advice saying that ...