Skip to main content

Questions tagged [pki]

Public Key Infrastructure is a cryptography system based on X.509 digital certificates, commonly used for encrypted communication and authentication.

Filter by
Sorted by
Tagged with
0 votes
0 answers
81 views

How to create manually a KSP container object in "SafeNet Key Storage Provider"

I've a Windows PKI system running with Luna Network HSM 7 and need to use a certificate which its private key resides in the HSM and not exportable by design of the system. This cert was generated ...
Metin Ozkan's user avatar
1 vote
3 answers
148 views

What is the role of Subject Name (SN) / Subject Alternative Name (SAN) in Microsoft Public Key Infrastructure (PKI)?

What is the Subject Names / Subject alternative names and how do they differ from each other? Specially the template below "subject name" tab. What does that change in the normal certificate ...
kambm's user avatar
  • 53
1 vote
2 answers
64 views

Why does Active Directory Certificate Services require Remote Registry Service?

I'm setting up a two-tier certificate authority using Active Directory Certificate Services. The offline air-gapped root certificate authority was easy to set up and get going. The intermediate ...
threehundredvolts's user avatar
0 votes
0 answers
53 views

OpenXPKI import existing certificates

We have installed OpenXPKI-3.24 on FreeBSD-13.2p9 (running in a jail). We have completed the setup and installed the issuing CA key and certificate. User access is configured using the suggested ...
James B. Byrne's user avatar
1 vote
2 answers
330 views

Certificate chains on server and client

I have OpenSSL Certificate Authority, and I have generated Root certificate (self-signed), Intermediate certificate (signed by Root certificate), Server certificate (signed by Intermediate certificate)...
John's user avatar
  • 115
0 votes
1 answer
223 views

Reissuing AD certificate breaks Always On VPN

Reissuing AD certificate breaks Always On VPN. We needed to update our AD CA to have a longer key length and an improved signing algorithm. This works fine and we are able to issue new certificates ...
The_hydorah's user avatar
0 votes
0 answers
125 views

Multiple certificate chains in a single file

My company has a Windows-based PKI with a single standalone root CA and several subordinate CAs for different audiences/purposes (e.g. two subordinate CAs for user/machine auto-enrollment, an ...
Paulo1205's user avatar
  • 101
1 vote
1 answer
510 views

Implementing PKI on an Active Directory domain

I would like to implement a two-tier PKI in a relatively small Windows environment: about 35 users and five virtual servers. Although I have little experience with Linux, I am trying to use XCA on a ...
coprolaliant's user avatar
1 vote
1 answer
2k views

keytool error: java.security.cert.CertificateParsingException: signed fields invalid

I have a X509 certificate pem file I got from Mongo Atlas. I'm trying to import it into the keystore like so: keytool -importcert -file X509-cert.pem -alias myalias -keystore mykeystore.p12 -storetype ...
ritratt's user avatar
  • 139
1 vote
1 answer
1k views

What determines the CRL expiration date and validity in PKI?

I'm working with Microsoft's Public Key Infrastructure (PKI) and I'm interested to know more about how the expiration date of a CRL is determined and how it can be adjusted in a Microsoft PKI ...
kambm's user avatar
  • 53
0 votes
1 answer
724 views

Attributes Windows CA templates

Windows Enterprise CA. I have been requested that in the certificates appear the following attributes: OU, C (country) and O (organization). I have seen that in the certificate template in the "...
Santyuste's user avatar
0 votes
0 answers
194 views

NPS Certificate

I am changing a CA in the domain to a new one. The old CA will be deactivated. I have an NPS server configured with the certificate of the old CA in "Network Policies -> Policy1 -> ...
Santyuste's user avatar
0 votes
1 answer
402 views

CA Offline Standard publish Active Directory

I have a hierarchy of one offline CA (standard) and 2 subCAs (enterprise). The offline CA is not published in Active Directory and the 2 SubCa's are published in AD. Can the offline CA be modified to ...
Santyuste's user avatar
0 votes
0 answers
39 views

CA template Windows

In a Windows CA, I have mistakenly removed permissions from a template and now I can't modify it. How do I modify or delete this template to create it again? Thanks
Santyuste's user avatar
0 votes
0 answers
49 views

Request Certificate CA

I have a Windows server configured as a Certificate Authority (CA). When requesting a certificate via https://server/certServ and choosing the template to request (Request Certificate->Advance ...
Santyuste's user avatar
0 votes
1 answer
435 views

Best Practices for Setting Up Multiple OpenVPN Instances for Different Clients

I'm working on a project where I need to set up OpenVPN instances to connect IoT devices from various customers to a central server. Each client should have its own isolated VPN connection. I'm ...
Mat's user avatar
  • 3
0 votes
1 answer
6k views

How to force Domain Controller to get new certificate from PKI Server

I bluntly created a PKI Server (AD CS) that sits inside the Domain. My Domain Controllers got a DomainController Certificate from it. After that I thought that it would be better, to create a Root CA ...
SimonS's user avatar
  • 787
0 votes
1 answer
147 views

CA: Certificate User for VPN

From a subordinate Enterprise CA I want to generate a user certificate that serves as an authentication method for VPN connections. I want to install this certificate with autoenroll on the domain ...
Santyuste's user avatar
1 vote
1 answer
233 views

SubCA certificate of trust

I have deployed a PKI infrastructure with a Stand-Alone Root CA (which will be kept off) and 4 Enterprise SubCA's which depends on this Root CA. To make the computers trust the Root CA, I am going to ...
Santyuste's user avatar
0 votes
0 answers
55 views

How to integrate .Net application to ADCS using API

We have to integrate own app to MS ADCS environment for autoenrollment digital certificates. Is there any guide to integrate our app to MS Certificate Authority using API?
Ivan Diniz's user avatar
1 vote
1 answer
144 views

Is it possible to specify Active Directory PKI key size throuth CSR

When I request certificate from Letsencrypt, put key and fullchain.cer in nginx config - everything works fine. The same for Active Directory is not working. -I generate key (tried rsa 2048 or 4096 ...
Oleg Gritsak's user avatar
1 vote
1 answer
222 views

High available PKI related questions with regards to CA/OCSP and NDES

I have some specific questions with regards a high available PKI based on ADCS. The questions are as follows. Please see the detailed info below to get more info on the casus. -------------------------...
MyPkiProblems's user avatar
0 votes
2 answers
372 views

Change certificate issuer

Is it possible to change the "issuer" value in a CA so that when a new certificate is issued, the new "issuer" value appears? In the case of having several SubCa, is it possible to ...
Santyuste's user avatar
1 vote
1 answer
1k views

PKI hierarchy. Root CA CAand subordinate

I have to deploy a new PKI hierarchy I have one domain and several subdomains I had thought about having a Root CA and a Sub CA. What are the advantages of this option over having a root CA only? Do ...
Santyuste's user avatar
0 votes
1 answer
473 views

Windows Server 2019 ADCS. CA subordinate

I have a "CA1" server with Windows 2019 that has the CA root Enterprise service. Additionally I have another server "CA-Subordinate" with Windows 2019 with the CA subordinate ...
Santyuste's user avatar
0 votes
2 answers
251 views

How to get a google issued certificate for my service behind l4 load balancer

I am running a mqtt broker behind gke LoadBalancer type service. The lb type service is a l4 load balancer and I need to handle the tls termination at my service/broker level. I have associated an A ...
java_doctor_101's user avatar
1 vote
1 answer
1k views

Windows AD cert renewal implementation vs cert copying

Windows PKI policy has a setting for what I think is automated renewal of AD template issued certificates when they expire. It must be also enabled on the certificate authority (CA) side. Question - ...
Seva Alekseyev's user avatar
0 votes
1 answer
740 views

Trouble setting up CES and CEP PKI in a trusted forest scenario

I have two AD domains with a two-way forest trust. I want computer accounts in DomainB to enroll for computer client auth certificates from the two-tier Windows CA in DomainA. I configured a ...
corndog's user avatar
1 vote
0 answers
283 views

Fedora Server 37 CA certificate store most equivalent to LocalMachine\root

Fedora Server 37 CA certificate store most equivalent to LocalMachine\root in a Windows environment? Background notes: I have plenty of experience in the Windows area for certificate management, but ...
jcolebrand's user avatar
0 votes
1 answer
1k views

Publish Root CA CRL to network drive

I am currently "prototyping" a Windows PKI with AD CS Role. I have two-tier hierarchy (Root Offline CA -> Enterprise Sub-CA -> Digital Certs). Furthermore, I am trying to publish the ...
isuckatservers69's user avatar
0 votes
0 answers
33 views

2 Issuing CAs are Effected by Subnet Region

We are working to set up a 2-tier pki with 2 issuing CAs in different regions/subnets. We were able to get everything looking right on pkiview.msc. We are still having trouble though with the second ...
Woogi's user avatar
  • 1
0 votes
1 answer
1k views

Having trouble issuing the 2nd enterprise CA on the same offline Root CA as the 1st. Windows Server 2016

I am running into an issue and hoping someone can help me. We were asked to set up a new Root CA and 2 subordinate (issuing) CAs under it (the request includes using Azure and placing each VM in a ...
Woogi's user avatar
  • 1
2 votes
1 answer
223 views

Changing the OU for a Windows Subordinate CA

We have a Subordinate CA that is servicing our AD domain. For reasons of tidiness, we want to change the OU that the Sub CA is in. I know that you can't do things like change the name of the Sub CA or ...
northshorefiend's user avatar
2 votes
1 answer
2k views

openssl - cross sign certificate

I want to cross-sign a third-party root ca (third-party-ca) with my own root ca (r1). (Background: restricting usage) To do this, I use openssl x509-in third-party-ca.crt -CA /etc/pki/r1/ca.crt -CAkey ...
Zulakis's user avatar
  • 4,283
0 votes
0 answers
185 views

1 ICA and CRL serving 2 different domain

I have 1 ICA and 1 CRL and I would like it to serve 2 different domain in my setup. Is that possible? I'm running Windows Server 2019. Note, I'm not able to set a trust relationship between the 2 ...
tosei's user avatar
  • 1
0 votes
1 answer
978 views

Windows doesn't create assign "Key Container" when adding cert tied to Cavium (AWS CloudHSMv2)

I've got two windows systems tied to the AWS CloudHSM v2 (the cavium HSM). On one, I generated the CSR, and accepts/added the cert purchased with that CSR. I can sign and the private key is pulled ...
Peter Kahn's user avatar
0 votes
1 answer
729 views

CDP container in Active Directory required if not part of AD?

We have a Microsoft Active Directory Certificate Services Enterprise CA. After installing the service, an AD container is created within CN=CDP,CN=Public Key Services,CN=Services,CN=Configuration,DC=...
Daniel's user avatar
  • 7,059
1 vote
1 answer
2k views

FreeRadius with mixed CAs

Is it possible to run FreeRadius (version 3.0.13) with two different CAs? So that I have a server certificate from one CA and the client certificates come from a different CA? Our current setup in /...
Thomas's user avatar
  • 145
0 votes
1 answer
902 views

Target specific Enterprise CA for auto-enrollment?

We have two intermediate Enterprise CAs (Windows AD CS) in our AD domain. Both CAs only have the Certification Authority role enabled. CA1 is responsible for issuing certificates to workstations and ...
Daniel's user avatar
  • 7,059
0 votes
2 answers
2k views

Auto-Enrollment with manager approval, but auto-approval for re-enrollment

I have a certificate template (auto-enrolled) that must require manager approval. To achieve this, I checked the CA certificate manager approval checkbox in the Issuance Requirements tab. The ...
Daniel's user avatar
  • 7,059
1 vote
1 answer
677 views

How to import a CSR on a root CA into the Pending Requests queue and viewing the applied policy on the command line?

I have a standalone root CA base on Windows Server 2019 Core. I know that with certutil.exe -dump certificate.req I can inspect the CSR, but the root CA's policies may override the requested extension ...
Daniel's user avatar
  • 7,059
1 vote
1 answer
869 views

Standalone Root CA does not enforce KeyUsage settings from CAPolicy.inf when issuing certificates

I have a standalone root CA (RootCA) and an enterprise subordinate CA (SubCA). Both Windows Server 2019. The RootCA seems to ignore the CAPolicy.inf file configuration settings, when attempting to ...
Daniel's user avatar
  • 7,059
0 votes
1 answer
2k views

Create new SubCA certificate fails with NTE_PROV_TYPE_NOT_DEF

I am trying to manually create a key and CSR for a new Windows AD CS Enterprise Subordinate CA (Windows Server 2019). I'd like to store the key in the modern Microsoft Software Key Storage Provider. ...
Daniel's user avatar
  • 7,059
0 votes
1 answer
654 views

Microsoft ADCS: change Subject in existing CSR

Suppose I have a CSR in which some Subject fields were not created according to X.509 - there are forbidden characters in Subject, or Country was provided as "England". Is there any way to ...
StanTastic's user avatar
1 vote
1 answer
6k views

hashicorp vault - load pre-existing CA certificate into PKI engine

I'm looking to migrate a process that generates client certificates from a custom root CA into hashicorp vault. The root is already trusted by a lot of applications, so I'd like to import it (or an ...
André Fernandes's user avatar
0 votes
1 answer
2k views

Ldap service not running on Windows Server 2019

I have 2 windows server 2019. e.g. server1 and server2. server1 is the domain controller. server1 has below roles installed: ADDS, ADCS, DNS, FILE STORAGE, IIS. server2 is connected to that domain ...
Ghansham's user avatar
  • 101
3 votes
1 answer
3k views

Do I need Active Directory Certificate Services

I have an AD setup that apparently has a vulnerability related to the Certificate Services feature. Thinking back through the MS Server courses I've sat, I don't remember anything on it, so I dug ...
The ITea Guy's user avatar
0 votes
1 answer
630 views

PKI trust in Active Directory

Assuming that the certificate of the ADCS CAs joined to a given domain are signed by an offline root CA which is then trusted by all systems in the domain/forest. If that offline root was then used to ...
5y5tem5's user avatar
  • 51
0 votes
2 answers
3k views

Retire internal Windows root CA

A former colleague created an internal root CA named CA1 with server2008. During migration to a newer OS version a Server CA2 was created and CA1 turned off. Now my problem is, all systems still think ...
404_username_not_found's user avatar
2 votes
1 answer
3k views

Finding out if a certificate is due for renewal without triggering the actual renewal with Certbot

I am trying to use Certbot to allow for semi-automated certificate updates. I don't want fully-automated updates to avoid automatic certificate replacements that could interrupt business and ensure ...
aef's user avatar
  • 1,785

1
2 3 4 5