Last call to make your voice heard! Our 2022 Developer Survey closes in less than a week. Take survey.

Questions tagged [pki]

Public Key Infrastructure is a cryptography system based on X.509 digital certificates, commonly used for encrypted communication and authentication.

Filter by
Sorted by
Tagged with
0 votes
0 answers
17 views

1 ICA and CRL serving 2 different domain

I have 1 ICA and 1 CRL and I would like it to serve 2 different domain in my setup. Is that possible? I'm running Windows Server 2019. Note, I'm not able to set a trust relationship between the 2 ...
user avatar
  • 1
0 votes
0 answers
29 views

How to replace SCVMM_CERTIFICATE_KEY_CONTAINER SCVMM SSL certificate?

I need to replace SCVMM_CERTIFICATE_KEY_CONTAINER certificate on my SCVMM server and Hyper-V Hosts. How can this be done?
user avatar
0 votes
1 answer
67 views

Windows doesn't create assign "Key Container" when adding cert tied to Cavium (AWS CloudHSMv2)

I've got two windows systems tied to the AWS CloudHSM v2 (the cavium HSM). On one, I generated the CSR, and accepts/added the cert purchased with that CSR. I can sign and the private key is pulled ...
user avatar
0 votes
1 answer
66 views

CDP container in Active Directory required if not part of AD?

We have a Microsoft Active Directory Certificate Services Enterprise CA. After installing the service, an AD container is created within CN=CDP,CN=Public Key Services,CN=Services,CN=Configuration,DC=...
user avatar
  • 6,663
0 votes
0 answers
76 views

FreeRadius with mixed CAs

Is it possible to run FreeRadius (version 3.0.13) with two different CAs? So that I have a server certificate from one CA and the client certificates come from a different CA? Our current setup in /...
user avatar
  • 135
0 votes
1 answer
29 views

Target specific Enterprise CA for auto-enrollment?

We have two intermediate Enterprise CAs (Windows AD CS) in our AD domain. Both CAs only have the Certification Authority role enabled. CA1 is responsible for issuing certificates to workstations and ...
user avatar
  • 6,663
0 votes
1 answer
93 views

Auto-Enrollment with manager approval, but auto-approval for re-enrollment

I have a certificate template (auto-enrolled) that must require manager approval. To achieve this, I checked the CA certificate manager approval checkbox in the Issuance Requirements tab. The ...
user avatar
  • 6,663
1 vote
1 answer
29 views

How to import a CSR on a root CA into the Pending Requests queue and viewing the applied policy on the command line?

I have a standalone root CA base on Windows Server 2019 Core. I know that with certutil.exe -dump certificate.req I can inspect the CSR, but the root CA's policies may override the requested extension ...
user avatar
  • 6,663
1 vote
1 answer
107 views

Standalone Root CA does not enforce KeyUsage settings from CAPolicy.inf when issuing certificates

I have a standalone root CA (RootCA) and an enterprise subordinate CA (SubCA). Both Windows Server 2019. The RootCA seems to ignore the CAPolicy.inf file configuration settings, when attempting to ...
user avatar
  • 6,663
0 votes
1 answer
158 views

Create new SubCA certificate fails with NTE_PROV_TYPE_NOT_DEF

I am trying to manually create a key and CSR for a new Windows AD CS Enterprise Subordinate CA (Windows Server 2019). I'd like to store the key in the modern Microsoft Software Key Storage Provider. ...
user avatar
  • 6,663
0 votes
1 answer
77 views

Microsoft ADCS: change Subject in existing CSR

Suppose I have a CSR in which some Subject fields were not created according to X.509 - there are forbidden characters in Subject, or Country was provided as "England". Is there any way to ...
user avatar
0 votes
0 answers
47 views

Effect of Disabling AutoCertificateRollover in ADFS after new certificates have already been generated?

New token-signing and token-decrypting certificates have been generated on my ADFS servers and are set as Secondary certificates. Right now, AutoCertificateRollover is set to true and ...
user avatar
1 vote
1 answer
960 views

hashicorp vault - load pre-existing CA certificate into PKI engine

I'm looking to migrate a process that generates client certificates from a custom root CA into hashicorp vault. The root is already trusted by a lot of applications, so I'd like to import it (or an ...
user avatar
0 votes
1 answer
148 views

Ldap service not running on Windows Server 2019

I have 2 windows server 2019. e.g. server1 and server2. server1 is the domain controller. server1 has below roles installed: ADDS, ADCS, DNS, FILE STORAGE, IIS. server2 is connected to that domain ...
user avatar
  • 101
0 votes
0 answers
284 views

Microsoft NPS auth failure with reason code 23: advice for advanced troubleshooting techniques?

In our enterprise, we have roughly 30 users that access our networks through a VPN connection. The topology, is as follows: Apple End User Device ( iOS, macOS ) <--> Juniper SRX Firewall <--&...
user avatar
  • 111
0 votes
0 answers
169 views

Generate CSR including certificate template information with OpenSSL/Keytool for submitting to Microsoft CA

i'm trying to generate a CSR which includes the microsoft template CA name. i have tried the below config file but didn't work...any clues ? i want to generate the x509v3 CSR oid_section = OIDs [ OIDs ...
user avatar
3 votes
1 answer
118 views

Do I need Active Directory Certificate Services

I have an AD setup that apparently has a vulnerability related to the Certificate Services feature. Thinking back through the MS Server courses I've sat, I don't remember anything on it, so I dug ...
user avatar
0 votes
1 answer
66 views

PKI trust in Active Directory

Assuming that the certificate of the ADCS CAs joined to a given domain are signed by an offline root CA which is then trusted by all systems in the domain/forest. If that offline root was then used to ...
user avatar
  • 51
0 votes
2 answers
274 views

Retire internal Windows root CA

A former colleague created an internal root CA named CA1 with server2008. During migration to a newer OS version a Server CA2 was created and CA1 turned off. Now my problem is, all systems still think ...
user avatar
2 votes
1 answer
260 views

Finding out if a certificate is due for renewal without triggering the actual renewal with Certbot

I am trying to use Certbot to allow for semi-automated certificate updates. I don't want fully-automated updates to avoid automatic certificate replacements that could interrupt business and ensure ...
user avatar
  • 1,675
0 votes
1 answer
55 views

Where is the data about certificate is stored when i run dspublish in a domain joined computer?

When is run the command certutil -f -dspublish "CA01_Fabrikam Root CA.crt" RootCA Output is ldap:///CN=Fabrikam Root CA,CN=Certification Authorities,CN=Public Key Services,CN=Services,CN=...
user avatar
0 votes
0 answers
19 views

I revoked a webserver certificate and published the CRL. But the IIS is still showing certificate status as OK

I checked the serial number in CRL and it matches fine. So I don't know why the certificate is still valid. I am using this certificate in a locally hosted IIS site with https binding.
user avatar
0 votes
1 answer
69 views

Root CA certificate missing from chain but only in IE, Chrome is fine

Does anyone have any idea why the root CA certificate is completely absent (not just present but untrusted) from the HTTPS chain but only in Internet Explorer? The certificate is installed as a ...
user avatar
0 votes
1 answer
440 views

RDP and GPO setting Server Authentication certificate template (Microsoft Windows Server 2016)

We want to force Remote Desktop to use a certificate based on a particular named template rather than using a self-signed certificate. This works in forests with a Certificate Authority server, but ...
user avatar
1 vote
0 answers
1k views

Enabling SSL on Tomcat 9

There are a few questions I have regarding setting up SSL on Tomcat 9 as some of the things I've read have some inconsistencies and I'm also new to PKI. Ultimately, there are two things I'm trying to ...
user avatar
0 votes
2 answers
124 views

Windows Certificate Templates CSP certificate with Exportable Private Key

I recently created a certificate for a developer using a certificate template. The template was based from an existing one which I believe is based on CNG.I was able to export the private key, but the ...
user avatar
1 vote
0 answers
57 views

How to get the issuing certificate authority from an apple push notification certificate

I want to import the Apple push notification certificate into AWS ACM. So first, I had to convert it to pem. Using openssl pkcs12, I was able to get the Certificate and the Private Key. But when ...
user avatar
  • 11
0 votes
1 answer
222 views

What is the best method for adding RSA Key Fingerprints to known_hosts upon provisioning each server?

This question was inspired by this thread The hypothetical scenario, for context is as follows: SSH servers, whether they be routers, firewalls etc. are all firstly provisioned within a private + ...
user avatar
0 votes
1 answer
245 views

I have an internal PKI with a shared root CA, and multiple intermediate CAs, how do I make anything issued by any intermediate CA to trust everything?

Situation: I have an internal PKI with a shared root CA, and multiple intermediate CAs. I want anything issued by any intermediate CA to all trust each other. Is there a way to do this that most ...
user avatar
0 votes
1 answer
221 views

number of crl certificate(s) or pem certificate(s) present in p7s file

Q. How can we find out the number of CRL files or number of PEM files that can be generated from a P7S file? I understand ( from here ) that the data that is contained in a P7S file is nothing but the ...
user avatar
  • 115
1 vote
1 answer
2k views

NGINX unable to get issuer certificate

I am using NGINX web server. Configured my site with a setting where user will be challenged to present his certificate when he makes first request to the site by using following setting: ...
user avatar
1 vote
1 answer
317 views

install additional Enterprise Subordinate CA

I have already set up a working two tier Active Directory Certificate Services PKI hierarchy with an offline standalone Root CA (ROOT-CA) and one online Enterprise Subordinate CA (ISSUING-CA). For ...
user avatar
  • 23
5 votes
2 answers
5k views

How to bundle intermediate certs into one file

I manage an apache web server for a government site. The SSL cert will expired in a few weeks so they sent me a zip file with 3 intermediate certs and the ssl certificate (I have the private key from ...
user avatar
  • 263
0 votes
1 answer
43 views

I have to take rdp session into two different servers in succession before I can take rdp to the PKI server - Automate this? [closed]

Is it possible to write a powershell script that executes on my laptop and copy data from pki server back to my laptop.? If yes How would one proceed to do so? Right now all this is done manually. ...
user avatar
0 votes
1 answer
180 views

vsftp has a bug with Fedora 32 - how do I report it: 500 OOPS: SSL: cannot load RSA private key vsftpd

Just to be clear, this is as of Fedora 32, and vsftpd-3.0.3-36.fc32.x86_64 for vsftpd. This is NOT the same problem as previously was reported here, but it has the same outward appearance and, indeed, ...
user avatar
  • 1,128
0 votes
0 answers
649 views

Cannot reach HTTPS page with self-signed server certificate and DoD CA certificates

I'm attempting to create a local web server using Flask, a Python microframework, that uses the PKIs on a DoD CAC. I've created the self-signed root CA and server certificate and key following this ...
user avatar
  • 111
1 vote
1 answer
102 views

802.1X Chicken or the Egg?

I'm reading about 802.1X and WPA-2 Enterprise and how to set up it. I've read briefly about the different EAPs and understand that EAP-TLS is the better method of authentication due to the use of ...
user avatar
1 vote
0 answers
705 views

Vault invalid certificate or no client certificate supplied - cert auth method

I have created a CA in Vault to handle my certificate creation. I've followed this guide here: https://learn.hashicorp.com/vault/secrets-management/sm-pki-engine I am trying to generate a client ...
user avatar
0 votes
0 answers
285 views

This computer can't connect to the remote computer. Unknown key usage (1.3.6.1.4.1.311.54.1.2)

I'm unable to RDP to a server on our child domain after adding a Remote desktop certificate that is signed by one of our Certificate authorities. We have intentionally removed the self-signed RDP ...
user avatar
2 votes
1 answer
3k views

Certbot: Issuing a certfiicate for internal IP address with my own PKI?

I am running my own ACME CA server that allows issuing of certificates to IP addresses. I have installed the root certificate into all the devices in my LAN. Let's say that I am running the server at ...
user avatar
  • 203
0 votes
0 answers
227 views

ADCS Change AIA information from existing certificate

We have built a tier 2 PKI. Recently we decided to start hosting our CDP & AIA on a seperate webserver. However this was not originally in the design, so now we have problems with the certificate ...
user avatar
1 vote
1 answer
586 views

How to constrain ADCS Certificate template to user or computer type

How do I differentiate between a User or Computer certificate in my certificate templates? I currently have a template designed for a webserver SSL certificate, however, both users and computers can ...
user avatar
1 vote
1 answer
862 views

How to properly generate an x509 certificate with restricted usage

I'm putting certificates into a repository that will not allow a successive certificate with more limited usage than the previous one. I need an initial dummy cert/key/chain to bootstrap the process ...
user avatar
0 votes
0 answers
589 views

Icinga PKI Agent-Satellite-Master

According to the documentation on https://icinga.com/docs/icinga2/latest/doc/06-distributed-monitoring/, all nodes in an Icinga Monitoring need to have one CA which is on the master node. But I think, ...
user avatar
  • 388
1 vote
2 answers
869 views

Algo VPN strongSwan client "no issuer certificate found"

I set up an Algo VPN instance on AWS Lightsail using the official Ansible playbook. I can establish the VPN connection using Wireguard, however I cannot get it to work with strongSwan. I configured ...
user avatar
  • 11
1 vote
2 answers
946 views

FreeIPA Installation Failing During CA Restart

I'm trying to set up a simple vagrant box for testing with FreeIPA. I'm using the CentOS 7 image, and installing minimal extra things to the box, and using a very simple FreeIPA definition to start ...
user avatar
0 votes
0 answers
63 views

Windows CA Migration - Testing the Backup

I need to migrate our Certificate Services from one server to a new one. I am following a guide and there is the stage where you backup the old CA. How do you test that backup? I want to be able to ...
user avatar
2 votes
1 answer
2k views

Windows Server 2019 ADCS - Unable to Install Subordinate CA Certificate

I am setting up a two tier Active Directory Certificate Services PKI hierarchy with an offline standalone Root CA (Server 2019) and an online Enterprise Subordinate CA (also Server 2019). I've ...
user avatar
0 votes
1 answer
233 views

Ubuntu requires subordinate CA as well as Root CA

I have an environment with a root CA and a subordinate CA. my environment is mixed. I have both windows and Linux (Ubuntu 18) servers. On the windows machines it is enough to add the root CA to the ...
user avatar
  • 385
0 votes
1 answer
466 views

Incorrect Subject field in Certificate

I used the certreq command utility (certreq -new) to generate a csr from an .inf file which I sent to an intermediate CA to be signed, using certreq -submit. For some reason the "Issued to" field ...
user avatar

1
2 3 4 5