You can configure crlDistributionPoints in TinyCA2. Just open your issuing CA. Choose Preferences / OpenSSL Configuration from the menu.
Go to "Server Certificate Settings" tab and add crlDistributionPoints.
You want to add this to "TrustedPublishers" as well as the "TrustedRoot"
certutil -addstore "TrustedPublishers" *.cer
channel 0: open failed: administratively prohibited: open failed
This issue happens when the server SSH gateway server has port forwarding disabled.
In your case, ssh.uswe2.example.com probably has the config for AllowTcpForwarding set to "no". You want to change that to "yes".
Also, you may need to allow GatewayPorts. For more, see the docs. https://linux....
Install the CA on its own server. You will not be able to change the name of the server once you install the CA and all future migrations of the CA will be required to have the same name.
When installing the Certificate Authority, planning is very important. Please review Server Certificate Deployment Planning Doc before installing the CA.
I don't think there is a way to communicate the desire "I want this hashed with SHA256 instead of with SHA1, please!" in the request itself. (And I've got no idea about this INF file method there.)
Instead you just configure the whole Microsoft CA (ADCS) to use SHA256.
Details here: https://blogs.technet.microsoft.com/pki/2013/09/19/upgrade-certification-...