Questions tagged [pki]
Public Key Infrastructure is a cryptography system based on X.509 digital certificates, commonly used for encrypted communication and authentication.
222
questions
0
votes
1
answer
39
views
PKI hierarchy. Root CA CAand subordinate
I have to deploy a new PKI hierarchy
I have one domain and several subdomains
I had thought about having a Root CA and a Sub CA.
What are the advantages of this option over having a root CA only?
Do ...
- 11
-1
votes
0
answers
29
views
How to reinstate a revoked certifcate
When you revoke a certificate if the reason is "certificate-hold" you can reinstate it. I am using pki to revoke. I can't find anywhere on the internet how to reinstate a cert that was ...
- 111
0
votes
0
answers
24
views
CA root and CA subordinate administrator
I want to deploy a new PKI infrastructure on a domain that has several subdomains and trusted domains.
I would like to be able to delegate the administration between several administrators ...
- 11
0
votes
1
answer
40
views
Windows Server 2019 ADCS. CA subordinate
I have a "CA1" server with Windows 2019 that has the CA root Enterprise service. Additionally I have another server "CA-Subordinate" with Windows 2019 with the CA subordinate ...
- 11
0
votes
2
answers
40
views
How to get a google issued certificate for my service behind l4 load balancer
I am running a mqtt broker behind gke LoadBalancer type service. The lb type service is a l4 load balancer and I need to handle the tls termination at my service/broker level.
I have associated an A ...
- 103
0
votes
1
answer
92
views
Windows AD cert renewal implementation vs cert copying
Windows PKI policy has a setting for what I think is automated renewal of AD template issued certificates when they expire.
It must be also enabled on the certificate authority (CA) side. Question - ...
- 197
0
votes
1
answer
150
views
Trouble setting up CES and CEP PKI in a trusted forest scenario
I have two AD domains with a two-way forest trust. I want computer accounts in DomainB to enroll for computer client auth certificates from the two-tier Windows CA in DomainA. I configured a ...
- 1
1
vote
0
answers
107
views
Fedora Server 37 CA certificate store most equivalent to LocalMachine\root
Fedora Server 37 CA certificate store most equivalent to LocalMachine\root in a Windows environment?
Background notes: I have plenty of experience in the Windows area for certificate management, but ...
- 288
0
votes
1
answer
352
views
Publish Root CA CRL to network drive
I am currently "prototyping" a Windows PKI with AD CS Role. I have two-tier hierarchy (Root Offline CA -> Enterprise Sub-CA -> Digital Certs).
Furthermore, I am trying to publish the ...
0
votes
0
answers
27
views
2 Issuing CAs are Effected by Subnet Region
We are working to set up a 2-tier pki with 2 issuing CAs in different regions/subnets. We were able to get everything looking right on pkiview.msc. We are still having trouble though with the second ...
- 1
0
votes
1
answer
464
views
Having trouble issuing the 2nd enterprise CA on the same offline Root CA as the 1st. Windows Server 2016
I am running into an issue and hoping someone can help me. We were asked to set up a new Root CA and 2 subordinate (issuing) CAs under it (the request includes using Azure and placing each VM in a ...
- 1
0
votes
0
answers
209
views
Is it possible to generate a new self-signed certificate from an existing private key with powershell?
New-SelfSignedCertificate -ExistingKey "c:\cts_privkey.pem" -Container localhost -Provider "Microsoft Enhanced RSA and AES cryptographic Provider" -DnsName "example.com" -...
- 101
0
votes
0
answers
36
views
Is possible to use cert-manager with a private microsoft PKI?
I have a microsoft server with PKI Installed. I want to know if it possible to allow to cert-manager to talk to the microsoft server pki (microsoft CA) to get certificats ?. Any example of this case ?
- 101
2
votes
1
answer
106
views
Changing the OU for a Windows Subordinate CA
We have a Subordinate CA that is servicing our AD domain. For reasons of tidiness, we want to change the OU that the Sub CA is in. I know that you can't do things like change the name of the Sub CA or ...
2
votes
1
answer
762
views
openssl - cross sign certificate
I want to cross-sign a third-party root ca (third-party-ca) with my own root ca (r1). (Background: restricting usage)
To do this, I use
openssl x509-in third-party-ca.crt -CA /etc/pki/r1/ca.crt -CAkey ...
- 4,133
0
votes
0
answers
71
views
1 ICA and CRL serving 2 different domain
I have 1 ICA and 1 CRL and I would like it to serve 2 different domain in my setup. Is that possible? I'm running Windows Server 2019.
Note, I'm not able to set a trust relationship between the 2 ...
- 1
0
votes
1
answer
464
views
Windows doesn't create assign "Key Container" when adding cert tied to Cavium (AWS CloudHSMv2)
I've got two windows systems tied to the AWS CloudHSM v2 (the cavium HSM). On one, I generated the CSR, and accepts/added the cert purchased with that CSR. I can sign and the private key is pulled ...
- 207
0
votes
1
answer
376
views
CDP container in Active Directory required if not part of AD?
We have a Microsoft Active Directory Certificate Services Enterprise CA.
After installing the service, an AD container is created within CN=CDP,CN=Public Key Services,CN=Services,CN=Configuration,DC=...
- 6,930
1
vote
1
answer
846
views
FreeRadius with mixed CAs
Is it possible to run FreeRadius (version 3.0.13) with two different CAs? So that I have a server certificate from one CA and the client certificates come from a different CA?
Our current setup in /...
- 145
0
votes
1
answer
282
views
Target specific Enterprise CA for auto-enrollment?
We have two intermediate Enterprise CAs (Windows AD CS) in our AD domain. Both CAs only have the Certification Authority role enabled.
CA1 is responsible for issuing certificates to workstations and ...
- 6,930
0
votes
2
answers
810
views
Auto-Enrollment with manager approval, but auto-approval for re-enrollment
I have a certificate template (auto-enrolled) that must require manager approval.
To achieve this, I checked the CA certificate manager approval checkbox in the Issuance Requirements tab.
The ...
- 6,930
1
vote
1
answer
253
views
How to import a CSR on a root CA into the Pending Requests queue and viewing the applied policy on the command line?
I have a standalone root CA base on Windows Server 2019 Core.
I know that with certutil.exe -dump certificate.req I can inspect the CSR, but the root CA's policies may override the requested extension ...
- 6,930
1
vote
1
answer
405
views
Standalone Root CA does not enforce KeyUsage settings from CAPolicy.inf when issuing certificates
I have a standalone root CA (RootCA) and an enterprise subordinate CA (SubCA). Both Windows Server 2019.
The RootCA seems to ignore the CAPolicy.inf file configuration settings, when attempting to ...
- 6,930
0
votes
1
answer
843
views
Create new SubCA certificate fails with NTE_PROV_TYPE_NOT_DEF
I am trying to manually create a key and CSR for a new Windows AD CS Enterprise Subordinate CA (Windows Server 2019).
I'd like to store the key in the modern Microsoft Software Key Storage Provider.
...
- 6,930
0
votes
1
answer
351
views
Microsoft ADCS: change Subject in existing CSR
Suppose I have a CSR in which some Subject fields were not created according to X.509 - there are forbidden characters in Subject, or Country was provided as "England".
Is there any way to ...
- 860
1
vote
1
answer
3k
views
hashicorp vault - load pre-existing CA certificate into PKI engine
I'm looking to migrate a process that generates client certificates from a custom root CA into hashicorp vault.
The root is already trusted by a lot of applications, so I'd like to import it (or an ...
- 969
0
votes
1
answer
699
views
Ldap service not running on Windows Server 2019
I have 2 windows server 2019. e.g. server1 and server2.
server1 is the domain controller.
server1 has below roles installed: ADDS, ADCS, DNS, FILE STORAGE, IIS.
server2 is connected to that domain ...
- 101
3
votes
1
answer
1k
views
Do I need Active Directory Certificate Services
I have an AD setup that apparently has a vulnerability related to the Certificate Services feature. Thinking back through the MS Server courses I've sat, I don't remember anything on it, so I dug ...
- 153
0
votes
1
answer
221
views
PKI trust in Active Directory
Assuming that the certificate of the ADCS CAs joined to a given domain are signed by an offline root CA which is then trusted by all systems in the domain/forest. If that offline root was then used to ...
- 51
0
votes
2
answers
1k
views
Retire internal Windows root CA
A former colleague created an internal root CA named CA1 with server2008. During migration to a newer OS version a Server CA2 was created and CA1 turned off. Now my problem is, all systems still think ...
2
votes
1
answer
2k
views
Finding out if a certificate is due for renewal without triggering the actual renewal with Certbot
I am trying to use Certbot to allow for semi-automated certificate updates. I don't want fully-automated updates to avoid automatic certificate replacements that could interrupt business and ensure ...
- 1,745
0
votes
1
answer
324
views
Where is the data about certificate is stored when i run dspublish in a domain joined computer?
When is run the command certutil -f -dspublish "CA01_Fabrikam Root CA.crt" RootCA
Output is
ldap:///CN=Fabrikam Root CA,CN=Certification Authorities,CN=Public Key Services,CN=Services,CN=...
- 13
0
votes
1
answer
380
views
Root CA certificate missing from chain but only in IE, Chrome is fine
Does anyone have any idea why the root CA certificate is completely absent (not just present but untrusted) from the HTTPS chain but only in Internet Explorer?
The certificate is installed as a ...
- 905
0
votes
1
answer
876
views
RDP and GPO setting Server Authentication certificate template (Microsoft Windows Server 2016)
We want to force Remote Desktop to use a certificate based on a particular named template rather than using a self-signed certificate. This works in forests with a Certificate Authority server, but ...
1
vote
0
answers
2k
views
Enabling SSL on Tomcat 9
There are a few questions I have regarding setting up SSL on Tomcat 9 as some of the things I've read have some inconsistencies and I'm also new to PKI. Ultimately, there are two things I'm trying to ...
- 25
0
votes
2
answers
236
views
Windows Certificate Templates CSP certificate with Exportable Private Key
I recently created a certificate for a developer using a certificate template. The template was based from an existing one which I believe is based on CNG.I was able to export the private key, but the ...
- 595
1
vote
0
answers
85
views
How to get the issuing certificate authority from an apple push notification certificate
I want to import the Apple push notification certificate into AWS ACM. So first, I had to convert it to pem. Using openssl pkcs12, I was able to get the Certificate and the Private Key. But when ...
- 11
0
votes
1
answer
490
views
What is the best method for adding RSA Key Fingerprints to known_hosts upon provisioning each server?
This question was inspired by this thread
The hypothetical scenario, for context is as follows:
SSH servers, whether they be routers, firewalls etc. are all firstly provisioned within a private + ...
- 103
0
votes
1
answer
399
views
I have an internal PKI with a shared root CA, and multiple intermediate CAs, how do I make anything issued by any intermediate CA to trust everything?
Situation: I have an internal PKI with a shared root CA, and multiple intermediate CAs. I want anything issued by any intermediate CA to all trust each other. Is there a way to do this that most ...
- 51
0
votes
1
answer
535
views
number of crl certificate(s) or pem certificate(s) present in p7s file
Q. How can we find out the number of CRL files or number of PEM files that can be generated from a P7S file?
I understand ( from here ) that the data that is contained in a P7S file is nothing but the ...
- 125
2
votes
1
answer
4k
views
NGINX unable to get issuer certificate
I am using NGINX web server. Configured my site with a setting where user will be challenged to present his certificate when he makes first request to the site by using following setting:
...
- 121
1
vote
1
answer
552
views
install additional Enterprise Subordinate CA
I have already set up a working two tier Active Directory Certificate Services PKI hierarchy with an offline standalone Root CA (ROOT-CA) and one online Enterprise Subordinate CA (ISSUING-CA). For ...
- 23
6
votes
2
answers
9k
views
How to bundle intermediate certs into one file
I manage an apache web server for a government site. The SSL cert will expired in a few weeks so they sent me a zip file with 3 intermediate certs and the ssl certificate (I have the private key from ...
- 293
0
votes
1
answer
50
views
I have to take rdp session into two different servers in succession before I can take rdp to the PKI server - Automate this? [closed]
Is it possible to write a powershell script that executes on my laptop and copy data from pki server back to my laptop.?
If yes How would one proceed to do so? Right now all this is done manually. ...
- 13
0
votes
1
answer
260
views
vsftp has a bug with Fedora 32 - how do I report it: 500 OOPS: SSL: cannot load RSA private key vsftpd
Just to be clear, this is as of Fedora 32, and vsftpd-3.0.3-36.fc32.x86_64 for vsftpd.
This is NOT the same problem as previously was reported here, but it has the same outward appearance and, indeed, ...
- 1,212
0
votes
0
answers
742
views
Cannot reach HTTPS page with self-signed server certificate and DoD CA certificates
I'm attempting to create a local web server using Flask, a Python microframework, that uses the PKIs on a DoD CAC.
I've created the self-signed root CA and server certificate and key following this ...
- 111
1
vote
1
answer
147
views
802.1X Chicken or the Egg?
I'm reading about 802.1X and WPA-2 Enterprise and how to set up it. I've read briefly about the different EAPs and understand that EAP-TLS is the better method of authentication due to the use of ...
2
votes
0
answers
1k
views
Vault invalid certificate or no client certificate supplied - cert auth method
I have created a CA in Vault to handle my certificate creation. I've followed this guide here: https://learn.hashicorp.com/vault/secrets-management/sm-pki-engine
I am trying to generate a client ...
- 21
0
votes
0
answers
446
views
This computer can't connect to the remote computer. Unknown key usage (1.3.6.1.4.1.311.54.1.2)
I'm unable to RDP to a server on our child domain after adding a Remote desktop certificate that is signed by one of our Certificate authorities. We have intentionally removed the self-signed RDP ...
2
votes
1
answer
6k
views
Certbot: Issuing a certfiicate for internal IP address with my own PKI?
I am running my own ACME CA server that allows issuing of certificates to IP addresses. I have installed the root certificate into all the devices in my LAN. Let's say that I am running the server at ...
- 213