Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [pki]

Public Key Infrastructure is a cryptography system based on X.509 digital certificates, commonly used for encrypted communication and authentication.

0
votes
0answers
19 views

NGINX Reverse Proxy Pass Client Certificate to IIS Client Auth

So I am using Nginx as a reverse proxy to pass a client certificate (from a smart card) to an IIS server that requires client certificates. I am able to get Nginx to prompt for the client certificate ...
0
votes
0answers
16 views

PKI issue: OCSP failing

I have a Server 2016 install, with OCSP and ADCS installed. I have been fighting with OCSP for about two months now, and cannot get it to show green in Enterprise PKI; the ocsp directory itself is ...
2
votes
1answer
57 views

SSH authentication sequence and key files : explain

As a background to troubleshooting various problems using SSH and rsync with key pairs, I wanted a straightforward overview of the sequence of events that takes place during SSH authentication, and ...
1
vote
1answer
33 views

Migrate to two-tier PKI (Microsoft)

Currently, I have one online enterprise root-ca (and issuing certificates - default templates) that installed on DC (yes, yes I know - worst case scenario). I set another offline not joined to a ...
2
votes
1answer
67 views

OpenVPN - trying to validate CRL on client certificate

I'm running OpenVPN on a hardware router running OpenWRT. Every time a client connects I get the following error in the logs: VERIFY WARNING: depth=0, unable to get certificate CRL I've got a 2 ...
0
votes
1answer
15 views

save openvpn PKI passphrase

I'm using two servers. VPN Server (A), and Client (B). They are both using Ubuntu. The VPN server was installed using PIVPN: curl -L https://install.pivpn.io | bash How do you save the OpenVPN PKI ...
0
votes
1answer
34 views

How to view signatures fulfilling the “Authroized Signatures” option in a Smart Card Logon certificate from a Windows CA

I'm playing with the Windows Server CA role and Smart Card logons. We have a working PKI setup and smart card issuance/logon working. What I'm curious about is the "Require this number of authorized ...
1
vote
2answers
35 views

HKPK Public Key Pinning - Auto add bash script

I recently started using HKPK Public Key Pinning. I have an automated script that generates my csr, certificate, and installs into apache2 on opensuse leap 42.3 I'm looking for a way to add spki ...
0
votes
1answer
74 views

StrongswanPKI - Adding status_request or MustStaple TLS extension to certificate?

Using PKI tool from strongswan to setup a CA. Trying to setup the OCSP side of things have run into many issues as per another thread I posted (Strongswan PKI - ED25519 Certifcates - OCSP Responder ...
1
vote
1answer
43 views

Word document signing - extremely long wait verifying signatures

Our users all have Office 2016 (365 subscription version). We have our own internal MS certificate authority with signing certificates issued to each user. I have a document in Word with 2 signature ...
0
votes
1answer
157 views

Strongswan PKI - ED25519 Certifcates - OCSP Responder having issues

I am trying to setup an ocsp for the certificates generated out of strongswan PKI - using it as a CA. If I try to use openssl it just throws out Can't open index.txt.attr for reading, No such file or ...
0
votes
0answers
34 views

Push CA cert to Mac clients

I have a large group of Mac clients I need to push an internal CA cert out to. How can I do this without going to each one? They are all linked to Active Directory; would pushing a cert out to them ...
4
votes
1answer
209 views

JRE fails to establish LDAPS connection with AD after RootCA cert imported to cacerts truststore

LDAPS is working through ldp.exe and through a number of other programs on windows and linux systems that do not appear to require the Root Cert. at all. Some programs which use JSSE fail to connect ...
0
votes
0answers
16 views

VPN S2S + PKI + AD + EFS

I got the task of joining two company branches in VPN Site-To-Site, implementing PKI, EFS and AD (commissioned by the company's headquarters). At the moment I have an idea for such implementation: ...
1
vote
0answers
229 views

SSH Gateway Pass-through Authentication

We are looking to configure a 'transparent' SSH gateway that passes authentication on to an upstream SSH server based upon the username in the SSH request. All users will be using public key ...
0
votes
2answers
234 views

Certificate with SubjectAlternativeName (SAN) gives ERR_CONNECTION_RESET in Google Chrome

There is a non-public-facing application. I am trying to make sure that there are no HTTPS-related warnings/errors. The error I receive after putting the certificate with SAN field (signed by a ...
0
votes
1answer
434 views

What's “COMODO DCV” is looking for on my server?

Setup: Apache 2.4 Webmin/Virtualmin I'm getting my SSL certificate with Let's encrypt, using also auto renewal. Several hosts with SSL certificate has been created but delete since several months(~...
0
votes
0answers
88 views

How to use public / private x.509 for user authentication with nginx

I have a small nginx web server setup at my house, and access to a CAC and reader. the CAC already has public/private x.509 certificates loaded on it. I can export the certificates no problem. I'm ...
2
votes
1answer
264 views

Disable SSH Public Key Login for a user when her Active Directory account is disabled

I have many users in my environment who deploy their public keys on the linux servers for password-less and secure login via SSH. All these users have accounts on our Active Directory, however, when ...
3
votes
0answers
164 views

PKI Authentication in HTTPD using Active Directory (LDAP)

In my environment, an external entity provides a Root CA & Intermediate CA(s). They issue thousands of smartcards with PKI certificates for authentication. They provide the Client Authentication ...
2
votes
2answers
308 views

How to create cross certificates (or bridge CAs) in ADCS?

I'm trying to set up a trust between 2 untrusting forests, and I'd like to use either a cross-certificate or Bridge CA solution (not using AD trusts or CEP). I've found loads of advice saying that ...
0
votes
1answer
109 views

Renewing SubCA Certificate Issue after Renewing Root CA on W2k3

I'm facing an issue to renew SubCA certificate on Windows 2003. I keep getting this error (see images). I've looked for many solutions and one of them is to copy CLR from rootCA (which is a standalone ...
1
vote
1answer
41 views

CA certificate name contrains issue with regard to Common Name (CN=)

Can someone please confirm (or better still tell me a why I can achieve the following if it is at all possible) my understanding/issue I use a Microsoft CA (Domain Joined) from what I have read here ...
-1
votes
2answers
29 views

I'm not sure which files I should generate from the bundle certificate, anyone knows?

I've bought a new wildcard certificate and got a zip file which contains the follow files: star.domain.com.crt star.domain.com.ca-bundle star.domain.com.p7b The service provider which requires the ...
0
votes
1answer
2k views

Group security permissions for certificate template not working

I have a certificate template published on my domain-joined Server 2016 Enterprise CA - I'm trying to set up certificate autoenrollment for our internal webservers. When the template has read/enroll/...
0
votes
1answer
642 views

How should I configure a CAA DNS record for use with the AWS Certificate Manager

AWS Route 53 now allows the creation of CAA records to restrict the certificate authorities that may issue a certificate for a domain. I'd like to use an issue directive to restrict the issue of ...
0
votes
1answer
845 views

Certificate Chain (Self-signed root CA)

I am creating a self-signed Root CA for internal usage, I have decided to use an intermediate certificate. However, I am having issues with Chromium and Firefox 54.0 not trusting the certificate chain....
4
votes
0answers
483 views

Active Directory Certificate Services cannot publish revocation list after renewal with new private Key

In summary: I had a working offline root CA and an AD integrated CA working fine I renewed the certificate with the same private key and all was good I then renewed the certificate with a new ...
1
vote
0answers
827 views

Issue certificate to IP address in AD CS

We're trying to get a Sophos XG 210 to connect via LDAPS to an Active Directory Domain Services (AD DS) / Domain Controller (DC) server but doing so fails with the following two errors: Device - AD ...
0
votes
2answers
351 views

What's the benefit of having a two-tier PKI heirarchy?

According to the way I read the literature, a two-tier PKI heirarchy with an offline root CA provides redundancy and an extra layer of security in case your subordinate CA's private key gets ...
0
votes
1answer
200 views

ADCS PKI - Cross-Certification or Bridge CA?

Our company is being acquired by another company and we are curious on the requirements needed to create a cross-certification / bridge CA solution. Cross-Certification is issuing a Cross ...
1
vote
1answer
134 views

Limiting power of a trusted certificate

I am creating a site with my own CA and signing client certs with it. The clients will need to add my CA as a trusted source, but for security reasons I don't want them to blindly trust everything ...
2
votes
1answer
2k views

Windows - Logging changes to Certificate Store

In Windows there is a Certificate Store, where users and admins (depending on the setup) can make their changes: add root CA, modify CRL, etc. It seems to be quite a critical place in system security. ...
0
votes
1answer
87 views

Continuity247 and Sophos TLS errors

Two on-premises Continuity247 (rebadged R1Soft which is Ubuntu-based) servers were on two different LANs which used a Cyberoam CR50iNG and a Sophos XG 85. Both worked absolutely worked fine. The ...
1
vote
1answer
786 views

How can I make OpenVPN use my CA's CRL Distribution Points when verifying certificates?

I have an existing PKI into which I am trying to integrate an OpenVPN server. I have included CRL Distribution Points into each CA certificate in my chain and I publish the CRLs at a location that is ...
3
votes
0answers
262 views

Enroll on-behalf-of certificate using existing CSR file

Good day, I have a CSR (certificate signing request) file, which was generated on some remote non-domain station. I have created some AD user account. I have Enrollment Agent certificate signed for ...
0
votes
1answer
196 views

Replace decommissioned root CA

Backstory Long ago, an MSP: Originally, setup Windows SBS 2003 which was probably the DC and root CA. Presumably much later, setup Windows Server 2008 R2 as a DC and decommissioned Windows SBS 2003 ...
0
votes
1answer
345 views

Icinga2 rejects new pki certs

I have one Icinga2 master (mon-master) and one Icinga2 client (cl0). Both are Icinga2 v2.6.3. Today I successfully ran 'icinga2 node wizard' on cl0 but there seems to be something wrong with the certs....
1
vote
1answer
142 views

Block Subject Alternative Names in ADCS

I am managing a Windows 2008 ADCS CA and have been aware of the security risks in issuing certificates with SANs. So I tested issuing a PKCS10 file with SANs in the request and it issued the ...
0
votes
1answer
607 views

Active Directory Certificate Services CEP/CES won't show templates added to CA

I am running this on Server 2016, domain is 2012r2, client computers are Win10 and Win7. I have a two-tier PKI infrastructure (offline root) that I recently set up, and I have had no issues with most ...
4
votes
2answers
317 views

Can I restrict an intermediate CA to only sign client certificates?

I want to use SCEP to give out client certificates, probably using ADCS. We already have an internal offline root CA in place (securely in a safe, only used for signing and revoking intermediate ...
2
votes
2answers
106 views

Can I find local ssh private key from remote fingerprint? [duplicate]

Possibly I am missing something obvious but after getting fed up with 5 key limitation of ssh-agent I start looking for ways for a better ssh key management. If I create a new ssh key pair using ssh-...
0
votes
1answer
203 views

certmonger save chained certificate for nginx

We use certmonger to issue certs for backend systems, this works fine for apache but with nginx I must specify a chained cert. getcert request -f /etc/pki/tls/certs/$(hostname).crt -k /etc/pki/tls/...
1
vote
1answer
429 views

DirectAccess and renewing SSL with new PKI?

We have deployed DirectAccess in our network for our Windows 7/10 clients which works great. The issue is, the DA server/client certificates are based on a internal PKI we are retiring; we have build ...
0
votes
1answer
453 views

Parallel PKI hierarchy Setup With ADCS

I am very new to ADCS, and have a challenge to migrate our old Tire-2 PKI to SHA-256. As we were suggested to setup a parallel SHA-2 CA, I am not greeting any idea, how to go ahead with it, I can ...
0
votes
1answer
546 views

How do i use pspki cmdlets without installing the Module components?

i want to use the powershell pspki module cmdlets without installing the module components on my CA. is this possible?
0
votes
1answer
434 views

Apache doesn't accept the key for a certificate when that certificate is bundled with its issuer

I am setting up a Certificate Authority for an intranet. There is a root certificate which will be installed on all the network machines, an intermediate certificate signed by the root, and a http ...
2
votes
0answers
530 views

Why might a ssl certificate fail to validate after the root certificate was installed?

I am building an openssl Certificate Authority for an intranet. I have root.crt, intermediate.crt which is signed by the root, and server.crt which is signed by the intermediate. I can validate the ...
3
votes
2answers
5k views

How do I issue multiple certificates for the same Common Name?

I am creating a Certificate Authority for an intranet. I have generated a root and intermediate CA and successfully signed a server certificate using the intermediate CA. The server certificate has ...
1
vote
0answers
96 views

Unable to generate and import user certificate from ADCS in Chrome

We are using Certificate Based Authentication using ADCS. So in order for user to access an internal website, they need their own signed certificate. With ADCS, the user gets their signed certificate ...