ACS SE - Public Cert from RapidSSL

I am attempting to authentication wireless clients via WLC6 via ACS SE 4.2 and this forum has provided me more information than Cisco Documentation.
In trying to obtains a 30day free trial cert from RapidSSL.com, When I submit my CSR, Rapidfire tells my that my common name is not a FQDN, I am using "acs-se.domainname.loc". Is it the .LOC that is causing my problems? Is there a way around that? I have tried downloading a cert my windows primary DC, had issues with my CRL and CTL. Basically I could not get the ACS SE to trust my Windows Cert. I am finding PEAP and EAP-FAST to be more difficult than it really should be.
Thanks
Charlie

JG,
Thanks for your response. RapidSSL would not allow a Private FQDN that ends in .LOC such as mine.
I ended up following this procedure that covers 95% of what you need for a Private Cert from my MS DCs.
http://www.cisco.com/en/US/products/sw/secursw/ps5338/products_configuration_example09186a008020a45c.shtml
My Wireless supplicants can now successfully authenticate using PEAP without monkeying around with CERTs on the client side.
Thanks
Charlie

Similar Messages

Move mailboxes and public folders from exchange 2007 to Exchange 2013

1. How do i move mailboxes from exchange 2007 to exchange 2013. I have more than 1000 mailboxes.
What is the correct way to migrate. do i need to move a single mailbox. During migration do the mailboxes get corrupted
2. I want to move public folders from Exchange 2007 to Exchange 2013.
I ran powershell commands and got these results please do guide me how to move to exchange 2013.and what are the shell commands
Get-publicfolder
Name Parent Path
IPM_SUBTREE
Get-publicfolder | select AdminDisplayName,FolderPath
AdminDisplayName FolderPath
Get-PublicFolderStatistics | select AdminDisplayName,FolderPath
AdminDisplayName FolderPath
exchangeV1 schema-root\microsoft\exchangeV1
Internet Newsgroups Internet Newsgroups
Get-PublicFolder -Recurse | fl name,replicas > c:\publicfolder.txt
Name : IPM_SUBTREE
Replicas : {}
Name : Internet Newsgroups
Replicas : {MAIL\Public Folder Storage\Public Folder Database}

I have started moving mailboxes , i have tried moving few individual mailboxes to see how things go
MAIL is my exchange 2007 and MAIL1 is my exchange 2013, please do refer the below result
PS] C:\Windows\system32>Get-MailboxDatabase -server mail
Name                           Server          Recovery
ReplicationType
Mailbox Database               MAIL            False           None
[PS] C:\Windows\system32>Get-MailboxDatabase -server mail1
Name                           Server          Recovery
ReplicationType
Mailbox Database 1460777952    MAIL1           False           None
[PS] C:\Windows\system32>New-MoveRequest -Identity '[email protected]' -TargetDatabase "Mailbox Database 1460777952"
DisplayName               StatusDetail              TotalMailboxSize
TotalArchiveSize         PercentComplete
[email protected]          Queued                    363.6 MB (381,217,115 ...
0

Public folders from exchange 2007 to exchange 2013

HI I am new to exchange, i am planning to do the migration of Exchange 2007SP3 UR10 to Exchange 2013 CU7, I want to move public folders from exchange 2007 to exchange 2013. wht is the procedure to move and wht are the commands to know how many public folders
i have.I just want to be aware before the installation so that later i can avoid issues.please do guide me

Hi Quiett,
please find how to move public folders on ttp://www.msexchange.org/articles-tutorials/exchange-server-2013/migration-deployment/migrating-public-folders-exchange-2013-part1.html
You can replace your servers names and follow exactly the proedure that is shown there. I strongly suggest to read also the 2nd page (replication) before you start. Please be aware of
Set-OrganizationConfig –PublicFoldersLockedForMigration $True , so you cannot change the source side whle migrating.
Regards,
Martin

Move SSL Cert from one device to another on Cisco ASA

Hello Everyone,
Is it possible to move SSL certificate + Key from one cisco asa to another ? I hope its possible and if someone can guide me towards correct documentation that would be perfect.
thank you
Manish

We have an ASA5550 running 8.2(5) that we're using as a VPN terminator; it died yesterday when we had a power glitch in the data center, and we're temporarily installing a spare 5510 (we don't have a spare 5550) until it's replaced. But the RSA keys on the spare don't match the ones on the old firewall, so when we try to install the old cert it fails:
ERROR: Keypair cannot be found for trustpoint UMVPN3-INCOMMON-MAY2020.
The old ASA is dead, so we can't do a straight export/import - all we have to work with is what's in yesterday's config backup...
I gather there's no way to extract the original keys from this; is there any way to recover in this case? Or must we export the certs from the ASAs with a "crypto ca export" and save copies of these in a secure location?

How to prevent public users from creating and saving Word Documents

I have two public computers available for the public to view legal case documents. The program used uses the Word shell to save, view and print documents within the program. The clerk has stated that she does not want attorneys or others to
be able to create and save word documents on these computers. Is there a way to prevent a user on the public computers from opening word, creating a document and saving it?

Instead of installing Word on the public computer (or at least instead of making it available on the public account), you could install the free Word Viewer:
https://www.microsoft.com/en-us/download/details.aspx?id=4 and make that available for the public account. Alternatively, if you want to ensure the document retains its originally
formatting regardless of what printer may or may not be attached to the public computer, you could keep only PDF copies of the file where the public can access them and install the free Adobe Acrobat Reader for viewing:
https://get.adobe.com/reader/.
Cheers
Paul Edstein
[MS MVP - Word]

Move a single Public Folder from one server to another cross-domain

Hi, I need to move specific Public Folders from a database on Exch2007 to a database on Exch2010. These are 2 separate domains and are already set up with their respective Public folder databases. I have a customer requirement to move from one domain to
the other. All mailboxes are moved, I just need to move their Public Folders. What is the easiest way to carry out this?
Thanks in advance.

Hi,
You can take PST of public folder from source forest and import PST on target forest from Outlook client.
Then you can use ExFolders to export and import PF permissions.
Best regards,
Belinda
Belinda Ma
TechNet Community Support

Is there any API to add and remove certs from acrobat trusted identities?

Is there any API to add and remove certs from acrobat trusted identities? if this is not possible any work around for this. Please help me

No, there is not – that would be a security concern.

How to pull in a 'Public Function' from the database.

Hi,
We're using OWB 11.1.0.7.
I'm trying to import a public function into OWB from our database.
When I go to the Global Explorer and right click on 'Functions' all I get are 'New' and 'Add/Remove Experts Here'.
When I select 'Add/Remove Experts Here'. It just gives e an option to select the Public Project object.
When I do, nothing happens.
Selecting 'New' just wants me to create a function from scratch, which is not what I want.
I just want to import a function into the 'Custom Functions' under 'Public Transformations' from my database.
Anybody?

Since function in your DB is specific to DB schema you need to import that function in OWB into module that is defined for that schema. After that you can copy/paste that function in Global Explorer custom functions.

Getting list of cert from browser

Hello,
I would like to get the list of certificate in the different stores of my web browser (internet explorer, firefox, ...). I know how to get the list of certs from a java keystore, but I have no idea about getting list of cert from browser.
Please help!
Thanks

A little tough.
On Windows, you can use Windows-MY and Windows-Root storetypes to access those 2 stores in IE.
For Firefox keystores, you can use the PKCS11 storetype to access the NSS keystore.
Google yourself for details.

ISE and 802.1x - Retrieve User Cert from AD for Auth without it being in the Personal Store?

Hello,
We are implementing 802.1x EAP-TLS wired at the moment with Cisco ISE, and wireless is to come after that, along with our internal PKI. I set up the PKI, and our network engineer is setting up the ISE. We currently have it set to first authenticate the computers with a computer certificate (allowing access to AD, among some other things), and then further authenticate the users with user certificates.
I don't have much knowledge of Cisco ISE, and plan to learn as we go, but I'm wondering:
Is it possible to authenticate the computer via the computer certificate, getting access to AD, and then have the ISE check AD for the User certificate INSTEAD of the User certificate being in the local Personal store of the client computer? We have autoenrollment going for user certificates, but it seems to be cumbersome (in thought) that once 802.1x is enabled, a new computer/employee coming on the network has to first go to an unauthenticated port to be able to download the User certificate in the Personal store, before then being able to use an 802.1x port?
I guess that makes two questions:
1) Can ISE pull the user cert from AD, without needing it in the local Personal store?
2) What's the easiest way to handle new computers/users that don't already have the User cert in their local Personal store once 802.1x is enabled?

1)No
2)Use EAP-Chaining with EAP-TLS and PEAP
For this scenario, i would go with Cisco AnyConnect NAM, and then use EAP-Chaining, with EAP-TLS for machine auth, and then PEAP for user authentication. This way you can make sure that both the machine and the user is authenticated, and more importantly, that a user can not get on the network with their user identity only and no machine identity. Using windows own supplicant for this, gives no garantee that the user has logged in from an authenticated machine. The feature that used to be used for this before EAP-Chaining was introduced, is called MAR, and has many problems, making it almost useless in a corporate environment. Security wise, the PEAP-MSCHAPV2 is tunneled in EAP-FAST and does not have the same security issues as regular PEAP.

Manually Move Public Folders from Exchange 2010 to 2013

Hi all,
I have a issue to finishing my migration from Exchange 2010 to Exchange 2013, I have been trying to migrate my Public folders but always after a couple hours, the migration state is failed.
The final error is the following:
FailureCode                      : -2146233088
FailureType                      : SourceMailboxAlreadyBeingMovedPermanentException
FailureSide                      :
Message                          : Error: Couldn't switch the mailbox into Sync Source mode.
                                   This could be because of one of the following reasons:
                                     Another administrator is currently moving
the mailbox.
                                     The mailbox is locked.
                                     The Microsoft Exchange Mailbox Replication
service (MRS) doesn't have the correct
                                   permissions.
                                     Network errors are preventing MRS from cleanly
closing its session with the
                                   Mailbox server. If this is the case, MRS may continue
to encounter this error for
                                   up to 2 hours - this duration is controlled by the TCP
KeepAlive settings on the
                                   Mailbox server.
                                   Wait for the mailbox to be released before attempting
to move this mailbox again.
So, after seeing this I started to monitoring all process and I realized that after creating hierarchy the process start to fail and keep in StalledDueMailboxlock status, and the error is:
FailureCode                      :
FailureType                      :
FailureSide                      :
Message                          : Informational: The request has been temporarily postponed because the mailbox is
                                   locked. The Microsoft Exchange Mailbox Replication service
will attempt to continue
                                   processing the request after 2/14/2015 12:38:20 PM.
Finally, digging more into reports of migration I found this:
MapiExceptionNetworkError: MapiExceptionNetworkError: Unable to open entry ID. (hr=0x80040115, ec=6)_x000A_Diagnostic context:_x000A_ Lid: 40487 EMSMDBMT.EcDoRpcExt2 called [length=73]_x000A_ Lid: 44583 EMSMDBMT.EcDoRpcExt2
exception [rpc_status=0x6][latency=0]_x000A_ Lid: 62184 _x000A_ Lid: 16280 dwParam: 0x0 Msg: EEInfo: ComputerName: n/a_x000A_ Lid: 8600 dwParam: 0x0 Msg: EEInfo: ProcessID: 51452_x000A_ Lid: 12696 dwParam: 0x0 Msg: EEInfo: Generation Time: 0415-02-14T14:25:40.9210000Z_x000A_
Lid: 10648 dwParam: 0x0 Msg: EEInfo: Generating component: 2_x000A_ Lid: 14744 dwParam: 0x0 Msg: EEInfo: Status: 6_x000A_ Lid: 9624 dwParam: 0x0 Msg: EEInfo: Detection location: 1741_x000A_ Lid: 13720 dwParam: 0x0 Msg: EEInfo: Flags: 0_x000A_ Lid: 11672 dwParam:
0x0 Msg: EEInfo: NumberOfParameters: 0_x000A_ Lid: 23260 Win32Error: 0x6_x000A_ Lid: 61553 StoreEc: 0x80040115_x000A_ Lid: 52176 ClientVersion: 15.0.1044.25_x000A_ Lid: 50032 ServerVersion: 14.3.181.6_x000A_ Lid: 50128 _x000A_ Lid: 50288 _x000A_ Lid: 23354
StoreEc: 0x80040115_x000A_ Lid: 25913 _x000A_ Lid: 21817 ROP Failure: 0x80040115_x000A_ Lid: 22894 _x000A_ Lid: 24942 StoreEc: 0x80040115
So, would like to know if exist any procedure to migrate/move my Public Folders from Exchange 2010 to 2013 manually, something like Export/Import.
Regards!

What script and process you are running to migrate the Public Folders?
And what do you mean by Manually?
Cheers,
Gulab Prasad
Technology Consultant
Blog:
http://www.exchangeranger.comTwitter:
LinkedIn:
Check out CodeTwo’s tools for Exchange admins
Note: Posts are provided “AS IS” without warranty of any kind, either expressed or implied, including but not limited to the implied warranties of merchantability and/or fitness for a particular purpose.

Remove trusted cert from cert store

Hi,
actually I think about a problem with a signed applet that contained a flaw. Of course the users have most probably already set the certificate to "always grant" when they first used the applet.
I know that I can remove the cert from the store with the Java Plug-in Control Panel and that the users will then be asked again. And that the cert ends up in a user file called trusted.certs.
(e.g. under WinXP in the user-path ...\Application Data\Sun\Java\Deployment\security\)
So this is what I need to do BUT: As I have many users I would strongly prefer a programmatic way to remove the cert without deleting the whole file (as it may also contain other certs).
Any ideas?

http://java.sun.com/j2se/1.5.0/docs/guide/security/jsse/JSSERefGuide.html#Customization

Automate generation and installation of certs from AD CS over the web?

We have an environment where there are dozens of separate AD forests, none of which have (or can have) any trust relationships.
We also have an Active Directory Certificate Server that we use for generating internal certs. This AD CS server is available to all of the servers via the web console (https://some.url/certsrv), but there is no other connectivity to the AD CS other than
port 443.
The question is, are there any methods we can use to automate the generation and installation of certs from the AD CS server? Specifically, suppose I am sitting on SERVERX and I am running a script, is it possible to have that script generate and submit
a cert request to https://some.url/certsrv, then retrieve and install the cert into the machine store?
The research I have done so far shows that this is typically possible if the CA is part of the same AD forest and is reachable over more ports than just 443.
Today we do an awkward launch of iexplore and some screen scraping, but it requires manual intervention to get it to work, and we'd like to fully automate the process.

You should consider to use a certificate enrollment web services (which are intended for such scenarios):
http://technet.microsoft.com/en-us/library/dd759209.aspx
My weblog: en-us.sysadmins.lv
PowerShell PKI Module: pspki.codeplex.com
PowerShell Cmdlet Help Editor pscmdlethelpeditor.codeplex.com
Check out new: SSL Certificate Verifier
Check out new:
PowerShell FCIV tool.

I would like to buy a developer license to use on a mac at a public library from a flash drive any issue with this?

I would like to buy a developer license to use on a mac at a public library from a flash drive any issue with this? Very new to this

The license is for the Developer not the machine it is run on However there could be soma issues with trying to develop on a public machine.
The biggest is does the library machine have or will they let you install and run Xcode and if you are developing for IOS will they let you plug in your devices?
In addition will they allow you the hours needed on the machine? Most public machines have a time limit especially if there are others waiting to use it.
All-in-all in can be done but it won;t be an easy situation.
good luck

Export server certs from 5.2

Can someone tell me how to export Server certs from Sun One Directory Server 5.2 P6. There are options for Details, renew request, install and delete. But i dont find one for exporting the certificate. Any help on this would be greatly appreciated.
Thanks!

Outside of the tools you'd have with a 5.2 instance, including certutil (certutil -L -d /your/cert/path cert-alias) you can also use openssl to get the cert from any server. You'd run openssl s_client -connect yourhostname.domain.com:636 and it would make a connection to the server on the LDAPS port and returned in the output would be they SSL cert in ascii format you could then move somewhere else or just have it around for safe keeping. Hope that helps.

ACS SE - Public Cert from RapidSSL

Similar Messages

Maybe you are looking for