Questions tagged [pki]

Public Key Infrastructure is a cryptography system based on X.509 digital certificates, commonly used for encrypted communication and authentication.

Filter by
Sorted by
Tagged with
0
votes
0answers
46 views

Submit SPKAC with subject to standalone ADCS

Microsoft's documentation suggests that it's possible to include a subject with a SPKAC CSR - https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-wcce/f88ecd9a-26bb-4b74-a471-4c46e773f75b. ...
0
votes
1answer
51 views

RDP and GPO setting Server Authentication certificate template (Microsoft Windows Server 2016)

We want to force Remote Desktop to use a certificate based on a particular named template rather than using a self-signed certificate. This works in forests with a Certificate Authority server, but ...
0
votes
0answers
62 views

Enabling SSL on Tomcat 9

There are a few questions I have regarding setting up SSL on Tomcat 9 as some of the things I've read have some inconsistencies and I'm also new to PKI. Ultimately, there are two things I'm trying to ...
0
votes
2answers
48 views

Windows Certificate Templates CSP certificate with Exportable Private Key

I recently created a certificate for a developer using a certificate template. The template was based from an existing one which I believe is based on CNG.I was able to export the private key, but the ...
1
vote
0answers
29 views

How to get the issuing certificate authority from an apple push notification certificate

I want to import the Apple push notification certificate into AWS ACM. So first, I had to convert it to pem. Using openssl pkcs12, I was able to get the Certificate and the Private Key. But when ...
0
votes
1answer
56 views

What is the best method for adding RSA Key Fingerprints to known_hosts upon provisioning each server?

This question was inspired by this thread The hypothetical scenario, for context is as follows: SSH servers, whether they be routers, firewalls etc. are all firstly provisioned within a private + ...
0
votes
1answer
62 views

I have an internal PKI with a shared root CA, and multiple intermediate CAs, how do I make anything issued by any intermediate CA to trust everything?

Situation: I have an internal PKI with a shared root CA, and multiple intermediate CAs. I want anything issued by any intermediate CA to all trust each other. Is there a way to do this that most ...
0
votes
0answers
55 views

Using NJS scripting in NGINX to convert $ssl_client_escaped_cert into X509 certificate

How can I use NJS modules in NGINX to convert ssl_client_escaped_cert variable into an actual X509 certificate? I am trying to read Subject alternative name from the user certificate. Which is not ...
0
votes
1answer
69 views

number of crl certificate(s) or pem certificate(s) present in p7s file

Q. How can we find out the number of CRL files or number of PEM files that can be generated from a P7S file? I understand ( from here ) that the data that is contained in a P7S file is nothing but the ...
0
votes
0answers
18 views

are der wallet still supported or used?

we can see different types of wallet format ( .pem, .der, .cert ) reference - What is a Pem file and how does it differ from other OpenSSL Generated Key File Formats? query is anyone still using cert....
1
vote
1answer
605 views

NGINX unable to get issuer certificate

I am using NGINX web server. Configured my site with a setting where user will be challenged to present his certificate when he makes first request to the site by using following setting: ...
1
vote
1answer
103 views

install additional Enterprise Subordinate CA

I have already set up a working two tier Active Directory Certificate Services PKI hierarchy with an offline standalone Root CA (ROOT-CA) and one online Enterprise Subordinate CA (ISSUING-CA). For ...
3
votes
2answers
1k views

How to bundle intermediate certs into one file

I manage an apache web server for a government site. The SSL cert will expired in a few weeks so they sent me a zip file with 3 intermediate certs and the ssl certificate (I have the private key from ...
0
votes
1answer
36 views

I have to take rdp session into two different servers in succession before I can take rdp to the PKI server - Automate this? [closed]

Is it possible to write a powershell script that executes on my laptop and copy data from pki server back to my laptop.? If yes How would one proceed to do so? Right now all this is done manually. ...
0
votes
0answers
50 views

Enterprise Issuing CA denied bind by domain controller

I am setting up a test environment and have a standalone Root CA and an Enterprise Intermediate CA as my issuing. On a third server, I set up an OCSP responder. The OCSP server and the Issuing CA are ...
0
votes
1answer
93 views

vsftp has a bug with Fedora 32 - how do I report it: 500 OOPS: SSL: cannot load RSA private key vsftpd

Just to be clear, this is as of Fedora 32, and vsftpd-3.0.3-36.fc32.x86_64 for vsftpd. This is NOT the same problem as previously was reported here, but it has the same outward appearance and, indeed, ...
0
votes
0answers
583 views

Cannot reach HTTPS page with self-signed server certificate and DoD CA certificates

I'm attempting to create a local web server using Flask, a Python microframework, that uses the PKIs on a DoD CAC. I've created the self-signed root CA and server certificate and key following this ...
0
votes
0answers
545 views

Intermediate CA Certificate Renewal for Direct Access

Background: We have DA, single site config. Enterprise PKI with Offline Root and online Intermediate CA (Intermediate CA used to issue Computer Certs to clients for DA). The Intermediate CA's cert is ...
1
vote
1answer
52 views

802.1X Chicken or the Egg?

I'm reading about 802.1X and WPA-2 Enterprise and how to set up it. I've read briefly about the different EAPs and understand that EAP-TLS is the better method of authentication due to the use of ...
1
vote
0answers
401 views

Vault invalid certificate or no client certificate supplied - cert auth method

I have created a CA in Vault to handle my certificate creation. I've followed this guide here: https://learn.hashicorp.com/vault/secrets-management/sm-pki-engine I am trying to generate a client ...
0
votes
0answers
171 views

This computer can't connect to the remote computer. Unknown key usage (1.3.6.1.4.1.311.54.1.2)

I'm unable to RDP to a server on our child domain after adding a Remote desktop certificate that is signed by one of our Certificate authorities. We have intentionally removed the self-signed RDP ...
2
votes
1answer
1k views

Certbot: Issuing a certfiicate for internal IP address with my own PKI?

I am running my own ACME CA server that allows issuing of certificates to IP addresses. I have installed the root certificate into all the devices in my LAN. Let's say that I am running the server at ...
0
votes
0answers
101 views

ADCS Change AIA information from existing certificate

We have built a tier 2 PKI. Recently we decided to start hosting our CDP & AIA on a seperate webserver. However this was not originally in the design, so now we have problems with the certificate ...
1
vote
1answer
286 views

How to constrain ADCS Certificate template to user or computer type

How do I differentiate between a User or Computer certificate in my certificate templates? I currently have a template designed for a webserver SSL certificate, however, both users and computers can ...
1
vote
1answer
340 views

How to properly generate an x509 certificate with restricted usage

I'm putting certificates into a repository that will not allow a successive certificate with more limited usage than the previous one. I need an initial dummy cert/key/chain to bootstrap the process ...
0
votes
0answers
340 views

Icinga PKI Agent-Satellite-Master

According to the documentation on https://icinga.com/docs/icinga2/latest/doc/06-distributed-monitoring/, all nodes in an Icinga Monitoring need to have one CA which is on the master node. But I think, ...
1
vote
2answers
445 views

Algo VPN strongSwan client “no issuer certificate found”

I set up an Algo VPN instance on AWS Lightsail using the official Ansible playbook. I can establish the VPN connection using Wireguard, however I cannot get it to work with strongSwan. I configured ...
0
votes
2answers
514 views

FreeIPA Installation Failing During CA Restart

I'm trying to set up a simple vagrant box for testing with FreeIPA. I'm using the CentOS 7 image, and installing minimal extra things to the box, and using a very simple FreeIPA definition to start ...
0
votes
0answers
42 views

Windows CA Migration - Testing the Backup

I need to migrate our Certificate Services from one server to a new one. I am following a guide and there is the stage where you backup the old CA. How do you test that backup? I want to be able to ...
1
vote
1answer
1k views

Windows Server 2019 ADCS - Unable to Install Subordinate CA Certificate

I am setting up a two tier Active Directory Certificate Services PKI hierarchy with an offline standalone Root CA (Server 2019) and an online Enterprise Subordinate CA (also Server 2019). I've ...
0
votes
1answer
110 views

Ubuntu requires subordinate CA as well as Root CA

I have an environment with a root CA and a subordinate CA. my environment is mixed. I have both windows and Linux (Ubuntu 18) servers. On the windows machines it is enough to add the root CA to the ...
0
votes
1answer
217 views

Incorrect Subject field in Certificate

I used the certreq command utility (certreq -new) to generate a csr from an .inf file which I sent to an intermediate CA to be signed, using certreq -submit. For some reason the "Issued to" field ...
1
vote
1answer
201 views

Add certificate from Microsoft Azure Key Vault for LDAP/S

The only method I can seem to find to add a certificate for secure LDAP (LDAP/S) for Azure Active Directory Domain Services is to upload the certificate from my local computer. This seems like a very ...
1
vote
0answers
178 views

How can I purchase a document signing certificate to sign/certify PDFs on AWS? [closed]

I'm working a service that fills/generates/signs PDF documents. Users will draw their signature (or type their name) on a web interface, and then my servers will generate the signed PDF. I would like ...
1
vote
1answer
469 views

Why do I have to distribute my CA signed code signing certificate with GPO?

I have an enterprise PKI. My issuing CA is part of my Active Directory. For the Windows Package Publisher I issued a code signing certificate, which should normally be valid inside my whole AD ...
1
vote
1answer
69 views

ADCS PKI - AIA Location when using OCSP

My question is wheter or not I still need to configure the following AIA location on my subordinate CA when I'm using OCSP: http://SERVERFQN/DIRECTORY/<Serverdnsname>_<Caname><...
2
votes
0answers
1k views

Automatically renew certificate: Old cert gets archived, but no new one is issued

We are using Active Directory Certificate Services (AD CS) to issue certificates for internal web applications. We can manually request a certificate from the CA and it gets issued without problems. ...
0
votes
1answer
114 views

2 Tier ADCS PKI what's different when using HSM's?

In the near future I will be tasked with building a Tier 2 ADCS PKI that uses HSM's, can anyone tell me what I have to do differently when building the PKI, and how the HSM fits into the whole PKI? (...
1
vote
1answer
2k views

OCSP Location error in pkiview.msc. But OCSP responders seem to work

I am currently setting up a new internal Windows PKI infrastructure in our organisation, to replace an old setup. Things are mostly fine, but the OCSP location has the status "Error" in the pkiview ...
0
votes
1answer
53 views

In a production Environment, how does Kubernetes manage TLS Certificates

I've put in place a master and some slaves, I've also generated some TLS certificates manually, and trusted those certificates all around the system. Now, I've installed an open source PKI, and I'd ...
0
votes
1answer
402 views

OCSP client certificate validation

For a home automation project I have created an API (written in ASP.NET so hosted in IIS) and written my own Android app to communicate with this API. To prevent people from accessing specific ...
0
votes
2answers
584 views

AD CS - OID for root and issuing CAs

I am willing to install a Root CA and an Issuing CA with AD CS for my private environment (test purpose). Do I need to obtain public OIDs (i.e. from IANA) or can I skip this requirement since my CAs ...
1
vote
0answers
517 views

Optional TPM Key Attestation in AD Certificate Services

We have a range of Windows 10 computers in our estate - some with no TPM chip, some with TPM 1.2, and some with TPM 2.0. I want to configure a certificate template to optionally perform TPM Key ...
2
votes
2answers
5k views

Explanation of new line in htaccess file: RewriteCond %{REQUEST_URI} !^/\.well-known/pki-validation/(?:\ Ballot169)?

Recently I noticed that a new line was added in the htaccess file in several locations throughout the file. RewriteCond %{REQUEST_URI} !^/\.well-known/pki-validation/(?:\ Ballot169)? I don't ...
1
vote
2answers
77 views

Digital Signatures Using Entreprise PKI

We are a global entreprise with thousands of employees worldwide. We have our own PKI infrastructure which is trusted internally by our systems but unknown externally. We sign contrats with our ...
3
votes
1answer
403 views

Template issues certificate with longer validity than CA Certiicate, what happens? [duplicate]

I am wonder what will happen as a certificate template with a 2 years validity period (for example) will issue a certificate when the CA certificate expires in 1 year. I can think of 2 things that ...
3
votes
3answers
617 views

Server ssh certificate chain against MITM attacks?

During first contact with a server via ssh, the server's public key of the chosen key algorithm is presented to the user to validate it. After validation, the result is usually saved into the ~/.ssh/...
3
votes
1answer
69 views

Smart Card removal behavior and card renewal

My customer is planning to introduce new Policy regarding smart card removal in their Windows Environment, most probably session break since it's a Citrix environment. Microsoft documentation on the ...
1
vote
1answer
90 views

How to distribute RDP certificates from ADCS to non-domain members?

I have a few hundred systems that are not AD-joined, for which I'd like to issue RDP certificates from an internal hierarchy (built with ADCS). I can do it manually, by generating CSRs, then signing ...
4
votes
1answer
2k views

SSH authentication sequence and key files : explain

As a background to troubleshooting various problems using SSH and rsync with key pairs, I wanted a straightforward overview of the sequence of events that takes place during SSH authentication, and ...