Questions tagged [pki]
Public Key Infrastructure is a cryptography system based on X.509 digital certificates, commonly used for encrypted communication and authentication.
250 questions
0
votes
0
answers
104
views
xmlsec1 - KEY-NOT-FOUND
I wan't to add a batch script to verify xml signatures.
The keys are in x509 certificates (all.pem). All 3 certificates are in the pem file: signing, ca and root - in that order. I also have an <ds:...
- 1
0
votes
1
answer
502
views
Replacing a certificate with another certificate / template - superseded templates and RSA key length
I have two certificates on my Domain Controllers:
Name: Kerberos Authentication
Validity: 1 year
Key length: RSA 2048
Hash: SHA-256
Name: Domain Controller Authentication
Validity: 5 years
Key ...
- 465
6
votes
3
answers
796
views
How do you upgrade workplace Certificate Authority from 2048-bit to 4096-bit
I am an Infrastructure Engineer for an organization. We have one Root Certificate Authority(RootCA) and one Subordinate Certificate Authority(SubCA). The RootCA is kept in an offline/disconnected ...
- 61
0
votes
1
answer
105
views
Renewing LDAPS certificate for apps & appliances
There are applications and/or appliances that work with LDAPS. Here, the Kerberos Authentication template period is 1 year.
Normally, it is automatically renewed with auto-enrollment.
Will there be an ...
- 465
0
votes
1
answer
86
views
Migrate to Kerberos Authentication template without downtime
I have Kerberos Authentication already.
Kerberos Authentication template - validity periods : 1 years
Domain Controller Authentication - validity periods : 5 years
I want to remove Domain Controller ...
- 465
4
votes
1
answer
462
views
LDAP and HTTP CDP locations work, but UNC network locations fail
I'm setting up CDP and AIA on a Windows Server certificate authority. It works with HTTP and LDAP locations, but it fails to obtain CRLs from a UNC network path like \\<server name>\CRL$\<...&...
- 73
0
votes
1
answer
413
views
Two-tier AD Certificate Services Setup, issues with missing certificate on CA service startup
I'm attempting to setup a two-tier level Certificate Authority Service using AD CS (all VPS are running Windows Server 2022) with an offline root CA and Enterprise Subordinate CA.
My architecture ...
- 1
1
vote
0
answers
322
views
Revoked Certificates are not removed from computer store
Need some help with PKI issue.
I have PKI in our domain and auto-enrollment policy is configured.
All domain computers succesfully obtain personal cert. So no problem with it.
Now I need to revoke ...
- 23
0
votes
0
answers
298
views
Domain Controllers not (Auto-)Renewing Certificates from new Certificate Authority
I've built a new 2022 PKI hierarchy in our environment that I would like to start issuing Domain Controller Certificates from (Kerberos Auth, DirectoryEmailReplication templates). The problem is that ...
- 11
1
vote
1
answer
228
views
Replacement CESCEP picking up old CESCEP CA's templates
We are replacing our Windows Server 2012 Certificate Enrollment Service/ Certificate Enrollment Policy (CESCEP) IIS server with two new IIS servers configured in HA, using an internal DNS that will ...
- 11
0
votes
0
answers
111
views
Command line tool that allows deletion of certificate containers on a SmartCards as non-admin
I am aware that one may use graphical tools to use one's PIN authenticate to one's SmartCard and afterwards delete a certain container on it. However, I would like to do that in a script, and all that ...
1
vote
0
answers
1k
views
How to utilize client certificates now that cURL has removed support for NSS
We recently upgraded from RHEL7 to RHEL8 and one of this issues that wasn't straight forward to handle is how to utilize cURL with client certificates after cURL removed support for NSS?
Previously, ...
- 111
1
vote
2
answers
4k
views
Renew FreeIPA certs when existing cert already expired
I have FreeIPA on Rocky 8. I installed custom certs from LetsEncrypt using the command
ipa-cacert-manage -p DM_PASSWORD -n NICKNAME -t C,, install ca.crt
ipa-certupdate
ipa-server-certinstall -w -d /...
- 623
0
votes
0
answers
464
views
How to create manually a KSP container object in "SafeNet Key Storage Provider"
I've a Windows PKI system running with Luna Network HSM 7 and need to use a certificate which
its private key resides in the HSM and not exportable by design of the system. This cert was generated ...
2
votes
3
answers
4k
views
What is the role of Subject Name (SN) / Subject Alternative Name (SAN) in Microsoft Public Key Infrastructure (PKI)?
What is the Subject Names / Subject alternative names and how do they differ from each other?
Specially the template below "subject name" tab. What does that change in the normal certificate ...
- 63