CDP and DeltaCRL locations expiring on Issuing CA

This has been a crash course in PKI and I am taking over for a previous sysadmin which has made it even more interesting. I'm hoping that you smart folks can help me
to better understand my configuration so that I can correct an issue with expiring/expired locations. Otherwise, I fear I might bugger it up even more.
Overview:
Offline Root CA - 2008 R2 SP1 - Not joined to the domain.
Online Issuing CA #1 - 2003 R2 SP2 - Joined to the domain (was supposed to be retired, I believe). I don't see any issues with this server.
Online Issuing CA #2 - 2007 R2 SP1 - Joined to the domain (was supposed to replace #1, I believe). This one has items that are expired/expiring.
I had a call that a user was receiving a certificate error when trying to connect to our MS Lync server, and when I checked the Online Issuing CA
#2 server, I notice a pile of expired/expiring locations. I did a bunch of searching/reading and came to the conclusion that I would have export a new Root CA cert from my offline Root CA (Right-click Revoked Certificates, All Tasks, Publish the .CRL), manually
copy it over to the online Issuing CA (C:\Windows\System32\CertSRV\CertEnroll), restart the ADCS service and then use the command Certutil -addstore -f CA cert.crl and
then update AD with Certutil -f -dspublish cert.crl.
That seemed to clear the expiry notices for the "Issuing CA 2 (V0.0)", but the following scrubbed screen shots are what I'm left with.
On the first, when the Root CA branch is selected, you can see "CDP Location #2 Expired". It expired last month. This is a HTTP location
(one of 2 HTTP locations that are present):
In the second, when the "Issuing CA (V7.0)" branch is selected, you can see a bunch of items expiring:
The AIA locations and CA Certs themselves won't expire for 19 more years.
I'm uncertain as to why we have 2 Issuing CA branches under the Root CA (V0.0 and V7.0?), and very curious as to what I am missing or what I may have
done incorrectly to have expired/expiring items remaining. I realize that the MMC snapin isn't totally reliable, so I'm looking for ways to verify the integrity of PKI across the domain and be sure that I haven't messed anything up. I would also like
to retire the old CA, but want to make sure I decommission it in such a way that there is no impact to the production environment.
Any insight would be more than appreciated.

Can you check again which physical directory is associated specifically with CDP #2 and if you copied the new CRLs there? Any directory could theoretically be used as a CDP - so you need to check the virtual dir in pkiview.msc or the Issuing CA's cert.,
and then find the corresponding dir in IIS Manager.
One thing to note: A CA creates more than one CRL if it had been renewed once with a new key. I f you run certutil -crl at the Root more than one file is created in the local CertEnroll directory (CA.crl, CA(1).crl etc.) How many
CRL files have been created at the same time are in the Root's CertEnroll directory?
You need to publish all those files to all CDPs (also holds for ldap). In case you copied a single CRL file to the web server - is one of the others maybe missing? Compare the file suffix of local files and the URL referred to in pkiview.msc
- is it CA.crl, CA(1).crl in both cases?
If it is really the same web server and same file and OK in the local directory but expired when retrieved over HTTP I can only imagine it is an odd DNS / caching / proxy etc. issue.

Similar Messages

My MacBook Retina has been shutting off multiple times per day. It is beginning to happen more frequently. What can I do to locate the exact issue? My warranty has expired so I would like to get to the bottom of it without taking it in to an apple store.

It is beginning to shutdown with no warning more frequently. What can I do to locate the exact issue? My warranty has expired so I would like to get to the bottom of it without taking it in to an apple store.
I am currently learning how to do diagnostics on mac hardware but I am not a native mac user. It is unlikely that this is a software issue. Please, any input will be helpful.

Try these in order testing your system after each to see if it's back to normal:
1. a. Resetting your Mac's PRAM and NVRAM
    b. Intel-based Macs: Resetting the System Management Controller (SMC)
2. Restart the computer in Safe Mode, then restart again, normally. If this doesn't help, then:
     Boot to the Recovery HD: Restart the computer and after the chime press and hold down the
     COMMAND and R keys until the Utilities menu screen appears. Alternatively, restart the computer and
     after the chime press and hold down the OPTION key until the boot manager screen appears.
     Select the Recovery HD and click on the downward pointing arrow button.
3. Repair the Hard Drive and Permissions: Upon startup select Disk Utility from the Utilities menu. Repair the Hard Drive and Permissions as follows.
When the recovery menu appears select Disk Utility. After DU loads select your hard drive entry (mfgr.'s ID and drive size) from the the left side list. In the DU status area you will see an entry for the S.M.A.R.T. status of the hard drive. If it does not say "Verified" then the hard drive is failing or failed. (SMART status is not reported on external Firewire or USB drives.) If the drive is "Verified" then select your OS X volume from the list on the left (sub-entry below the drive entry,) click on the First Aid tab, then click on the Repair Disk button. If DU reports any errors that have been fixed, then re-run Repair Disk until no errors are reported. If no errors are reported click on the Repair Permissions button. Wait until the operation completes, then quit DU and return to the main menu. Select Restart from the Apple menu.
     Reinstall the 10.9.2 update: OS X Mavericks 10.9.2 Update (Combo).
4. Reinstall Lion/Mountain Lion, Mavericks: Reboot from the Recovery HD. Select Reinstall Lion/Mountain Lion, Mavericks from the Utilities menu, and click on the Continue button.
Note: You will need an active Internet connection. I suggest using Ethernet if possible because it is three times faster than wireless.
Reinstall the 10.9.2 update: OS X Mavericks 10.9.2 Update (Combo).

I got an iphone from apple store US and am located in egypt , the device has hardware issues and need swap as stated by apple stor belfast when i was in ireland but they cannot swap it in EU as it is purchased from US , please advice

I got an iphone from apple store US and am located in egypt , the device has hardware issues and need swap as stated by apple stor belfast when i was in ireland but they cannot swap it in EU as it is purchased from US , please advice how i can get this swapped without any extra cost on me , this is really frustrating

The warranty is valid in the original country of purchase:
http://www.apple.com/legal/warranty/products/iphone-english.html
Note:
IMPORTANT RESTRICTION
Apple may restrict warranty service to the country where Apple or its Authorized Distributors originally sold the Apple Product.
You will either need to find a local repair shop and pay for it. Or you will need to ship the phone to someone you know in the US and have them take it to Apple for evaluation and then have it shipped back to you. All this will be at your expense. Also note that Apple do not accept direct shipments.

PKI - Add LDAP path to CDP and AIA extensions?

Another question for our new PKI design.
Most of the issued certificates will be used by domain clients and users. However, we will also use certificates for DirectAccess, which means CRL and AIA checking must also work for internet clients.
As far I understand the documentation, the URL's defined for CDP and AIA checking are checked in order. Let's say a I configure the following CDP's paths, and enable the option "Include in CDP extension of issued certificates":
1. HTTP
2. LDAP
Is it true that all clients (internal and external) will use option 1 first, and do a fallback to option 2? Basically this means that domain clients will never check LDAP (well at least as URL 1 is accessible)?
When I change the order to LDAP first, so:
1. LDAP
2. HTTP
Will this mean the CRL and AIA checking for internet clients will take a lot of extra time? First it tries to access the LDAP path, and after some time it falls back to HTTP? Or are internet clients smart enough to skip the LDAP path?
Another thing I don't like of publish in the AD, is that your AD configuration comes back in every issued certificate.

On Fri, 24 Oct 2014 07:52:52 +0000, MD_1977 wrote:
Most of the issued certificates will be used by domain clients and users. However, we will also use certificates for DirectAccess, which means CRL and AIA checking must also work for internet clients.
As far I understand the documentation, the URL's defined for CDP and AIA checking are checked in order. Let's say a I configure the following CDP's paths, and enable the option "Include in CDP extension of issued certificates":
1. HTTP
2. LDAP
Is it true that all clients (internal and external) will use option 1 first, and do a fallback to option 2? Basically this means that domain clients will never check LDAP (well at least as URL 1 is accessible)?
Correct.
When I change the order to LDAP first, so:
1. LDAP
2. HTTP
Will this mean the CRL and AIA checking for internet clients will take a lot of extra time? First it tries to access the LDAP path, and after some time it falls back to HTTP? Or are internet clients smart enough to skip the LDAP path?
I wouldn't say a lot of extra time. For details check out this whitepaper
and search for "timeout" -
http://technet.microsoft.com/en-us/library/ee619754%28v=ws.10%29.aspx
Another thing I don't like of publish in the AD, is that your AD configuration comes back in every issued certificate.
There isn't a lot that a bad guy can really do with that information. The
current recommendation and best practice calls for only using HTTP URLs in
any event. This works much better in a number of scenarios including CRL
checking over the Internet, non-domain joined devices and clients,
non-Windows clients, etc. Just make sure that the HTTP CDP/AIA location is
highly available and is accessible both internally and externally.
Paul Adare - FIM CM MVP
MCSE: Microsoft Certified Shutdown Engineer -- Tomi Sarvela

I upgraded my 3rd generation ipad to ios 6.0.1 and now am experiencing various issues. Neither Pages or Numbers will open. I just see a gray screen that says Pages or Numbers at the top and all of my documents are gone.

I upgraded my "new ipad" (the 3rd generation I think) to ios 6.0.1 and now am experiencing various issues.
1- Neither Pages or Numbers will open. I just see a gray screen that says Pages or Numbers at the top and all of my documents are gone. The icon that allows me to create a new document also does not appear. I went to icloud.com to see whether my documents still existed, which brings me to the 2nd problem.
2- It appears that all of my Pages documents are still on icloud, but all of my Numbers documents are gone. There were only about 10, but I access 2 of them nearly every day, so this is a big issue for me.
I went into Settings and all of the icloud information is correct and it "Documents & Data" is on. When I look at the storage, I see the Pages documents but not the Numbers ones. The next thing I did was turn my ipad off and back on, but this didn't fix anything. Since my Pages documents are still on icloud, I then tried to delete the Pages app from the ipad so that I could reinstall it, which resulted in the 3rd problem.
3- I cannot delete any apps. I can get all of the icons to shake and the small x IS available, but everything freezes when I click it. I can't do anything at that point except reset the ipad or wait until it eventually restarts itself. I've tried this with Pages as well as multiple other apps, all with the same result. I've also tried downloading a new app (which worked fine) and then deleting that one, but I got the same result.
3a- A small related issue to this that I am far less concerned about is that when the ipad restarts itself, it comes back on and the screen is really dark and I can barely make out what appears on the screen. If I enter my password right away, it stays that way until I go into Settings - Brightness & Wallpaper and touch the brightness setting (although I'm not actually changing the setting because it already shows that the brightness is turned up a little over halfway). If I don't enter my password right away and let it go completely dark, then click the home button, the brightness is fine.
So now I'm stuck. My guess is that I will need to restore it, but wanted to check before I take that step. Unfortunately, my laptop is on its deathbed so I haven't been synching my ipad to it and I fear my Numbers documents are gone forever. I'd like to try everything I can to fix these issues before doing the restore in hopes that I can get the Numbers documents back.
Any suggestions for any or all of these problems?

Purplehiddledog wrote:
I do backup with iCloud. I can't wait until the new iMac is available so that I can once again have my files in more than 1 location without needing to rely solely on the cloud.
I also rely on iTunes and my MacBook and Time Machine as well as backing up to iCloud. I know many users know have gone totally PC free, but I chose to use iCloud merely as my third backup.
I assume that the restore would result in my ability to open Pages and Numbers and fix the problem with deleting apps, but this would also mean that if my Numbers documents still exist solely within the app and are just not on iCloud for some reason that they would be gone forever. Is that right?
In a word, yes. In a little more detail.... When you restore from an iCloud backup, you must erase the device and start all over again. There is no other way to access the backup in iCloud without erasing the device. Consequently, you are starting all over again. Therefore, it would also be my assumption that Pages and Numbers will work again and that the deleting apps issues would be fixed as well.
If the documents are not in the backup, and you do not have a backup elsewhere, the documents could be gone forever.

Stock report in BW (valuated stock and Storage Location level)

Dear All,
            Regards.We got an situation here,
Case 1: R3 (MB5B) (Both "Storage loc" and "Valuated stock" shows the same Stock Qty)
1).The BW Stock Report shows values the Correct Values for "Receipt Qty" and "Issue Qty" with the Correct "Quantity total Stock" aswell.
Case 2 :   R3 (MB5B) (Stock is different between "Storage Loc" and "Valuated Stock")
1).The BW Stock Report shows the "Quantity Total Stock according to VALUATED STOCK Level(MB5B),but the "Receipt Qty" and "Issue Qty" according to STORAGE LOCATION Level(MB5B) .
We followed the "How to Handle Inventory "Doc with the proper sequence of Loading of Infosources and Compression.The data is sitting fine at the cube level.
It would be great if someone can throw some Light on this issue,on how the Query shows a COMBO of both Valuated stock and Storage Location stock....Held up with this issue for quite sometime..Had a look at the   Oss Note (589024)...........
Manythanks
Arun

HI,
In Inventory we have two quantity fields given to satisfy the requirement.
Valuated stock Qty - 0VALSTCKQTY
Storage Location qty - 0TOTALSTCK
You can make use of them based on your requirement. Hope this helps for you.
Thanks,
Arun

Using Office 2013 group policy template to define Trusted Locations and Template Locations doesn't work

User Configuration/Policies/Administrative Templates
- Using Office 2013 group policy template to define Trusted Locations and Template Locations doesn't work
Microsoft Word 2013/Word Options/Security/Trust Center/Trusted Locations
- Allow Trusted Locations on the network:
Enabled
- Trusted Location #1:
Enabled
Path: //server/sharedfoldername [Edit: Path:
\\server\sharedfoldername]
Date: June 10, 2013
Description: Trusted Location
Allow sub folders: Enabled
The policy appears to apply to the client correctly by adding the following registry key and values:
HKEY_CURRENT_USER\Software\Policies\Microsoft\office\15.0\word\security\trusted locations\location1
allowsubfolders: 1
date: June 10, 2013
Description: Trusted Location
Path: //server/sharedfoldername [Edit: Path:
\\server\sharedfoldername]
However, when you open Word Options/Trust Centre/Trust Centre Settings…/Trusted Locations
There are no trusted locations listed under ‘Policy Locations’
I have tried setting similar settings for setting the Shared Templates folder location and just like the trusted locations policy, the registry keys are created properly in HKEY_CURRENT_USER\Software\Policies however word doesn’t
seem to recognize these either.
This used to work flawlessly using the administrative templates for Word 2007 and 2010. Has anyone been able to get these policies to apply successfully, or know why office doesn’t recognize these settings from the Policies registry
Key?

This would have been an easy solution to the issue. Unfortunately it isn't the problem. This question was originally posted on another Microsoft site and
was transferred here and when it was transferred the path's changed from the original post:
\\server\sharedfodlername to //server/sharedfoldername. (I will edit the question to show up as it did in the original post) Not sure how that happened. This
is still an issue that I haven't been able to get working correctly.
As it turns out the 'New from Template' interface Word 2013 has developed is very bulky with large thumbnails and is not very customizable nor practical for an office
that has a large number of templates. Because I am unsatisfied with the display and performance of the 'New' template chooser I sought after a solution to change the way word creates a document from a template in another thread:
http://answers.microsoft.com/en-us/office/forum/office_2013_release-word/how-can-you-change-the-display-of-templates-in/d49194b9-a6b4-4768-8502-7d7b50e9dd65 working through this issue with Jay we were able to develop
some VB script with handles a very large number of templates in a list view and it works much faster than the built-in Word interface. The above thread is how I've worked around trying to define a shared template location and I am quite happy with it.

Plant and Storage Location determination at Item level during Copy control

Hello Freinds,
We are experiencing issues within Sales Order creation when the line item is referencing a contract. The plant and storage location is being determined from the contract - this should not be done, we have an enhancement in place for sales order plant/storage location determination which is how these values should be determined.
Kindly suggest, if it can be achieved through configuration setting at Copy control level, to avoid the Plant and Storage location determination from Contract in to Sales Order.
Thanks,
Anup Bansal

Hello
You can mention the additional logic of redetermining Plant and storage location whenever copied from contract.
In a sale order, i think you are maintaining a enhancement in prog MV45AFZB & user exit userexit_source_determination.
YOu can maintain the coding at same place.
thank you
Anirudh

MB5B Movment type and storage location is reset

When I run the report MB5B with radio button "valuated Stock" active for a specific Plant and Movement Type, I get a Message "Movement Type is reset" and then the entered Movement Type disappears from the selection criteria.
However the report does not give me this message when the radio button "Storage Location/ Batch Stock" is active.
Also, When I run the report MB5B with radio button "valuated Stock" active for a specific Plant and Storage Location, I get a Message "Storage Location is reset" and then the entered Storage Location disappears from the selection criteria.
However the report does not give me this message when the radio button "Storage Location/ Batch Stock" is active.
Please tell me why does this happen when the radio button "valuated Stock" is active ?

Dear All,
I am facing the problem as said in the thread.
My two queries are as follows:
Query 1: In MB5B report When we select the valuated stock option ,We are unable to use movement type , storage location in the selection criteria nad getting the below messages.
M7284 - Storage location is reset.
M7298 - Movement type is reset .
Query 2 :In MB5B report total receipts and total issues is showing incorrect values.
Here say for example I prepared the grn, cancelled the grn and again made the grn. Here total receipts is considering in such a way that all the grn quantities are considered. and cancelled documents are considered as issues.
ie have received material = 100 Nos 01-12-2009
cancelled grn:100 Nos
Redo grn:100 Nos
Done transfer posting 415 Q = 10 nOS = 02-12-2009
Issued = 10 nos = 02-12-2009
In mB5B 01-12-2009 to 02-12-2009
We are getting Opening stock= 0 which is correct
Total receipts = 100(GRN IST TIME)+100(GR SECOND TIME) +10(TRANSFER POSTING)=210
Total issues = 100(CANCEL GRN)10(TRANSFER POSTING)10(GOODS ISSUE) =120
Closing stock = 90(CORRECT)
Here actual recipt: should be 100
actual issue should be 10
Here though the closing stock is correct , 415 transfer posting is considered as issue and receipt.Becoz of this total issues quantity report is going wrong.
Please give your valuable suggestions to the above two problems seperately.
Regards,

Default Plant and storage location for components in MFBF

Hi,
I have 2 plants 1000-procurement plant and 2000- production plant. I am using special procurement key 70( Withdrawal from alternative plant from 1000 to 2000) for components in Plant 2000. The requirements for the components are transferred from 2000 plant to 1000 plant. The 1000 plant run MRP for the dependent requirements and procure the materials and transferred to the production storage location in Plant 2000.The raw materials are purchased in plant 1000 and transferred to Plant 2000 production storage location based on the manual reservations created with movement type 301. This is fine.
But when I do backflush in MFBF the plant and storage location for the components issue are displayed as plant 1000 which is the procurement plant and the production storage location in plant 2000-production plant location. In the BOM the production storage location is production storage location of plant 2000. Since we use the special procurement key system defaults the plant as 1000(procurement plant) insteadd of 2000(production plant). can we make this plant default to the production plant 2000 as default in the MFBF goods issue screen.
thanks and regards
Murugesan

Hi MURUGESAN !
      Can you give me some information more in Special Procument Configure in plant 2000 like:
          - Procurement type (maybe F)
          - Special procurement (Maybe U)
          - Plant (Maybe 1000).
          - Issuing plant (maybe 2000)
       We will check together.
       Regards,
      Tony

Creating material in multiple plants and storage locations

Hi Gurus,
I am wondering if someone could help me out in this issue,
I frequently get 1's and 2 materials creation requirement , is there any simple way , while creating material in MM01 , I could create/extend to all plants and storage locations.
I know we can use LSMW , but this is not bulk requirement,it is frequent but in 1or 2 nos.
Any help highly appriciated and rewared.
Thanks.

Hi,
To my knowledge I doubt if both MM17 & MM50 can meet your need, as MM17 is to mass change the values already existing in the MMR, while MM50 is to extend the views in a given plant & not to extend across plants.
A suggestion would be to use the BAPI's -
BAPI_MATERIAL_SAVEDATA Create and Change Material Master Data
BAPI_MATERIAL_SAVEREPLICA BAPI for Mass Maintenance of Material Data
Give your requirement to your abaper & inform him / her to use the above BAPI's. I am sure your abaper can write a simple & user friendly program to meet your exact need.
Regards,
Vivek

How do I locate expiration date on iTunes gift card?

How do I locate expiration date on iTunes gift card?

There isn't any expiration date on an iTunes gift card as far as I know. Once you redeem the card, it is added to your balance and it is good until the balance is depleted.
http://store.apple.com/us_smb_78313/question/answers/product/MD623LL/A/how-long- after-i-purchase-the-gift-card-will-it-expire/QUU449TT27DT4YY74

Expired Password issue

Any update on the issues with expired passwords? We have seen the same
issue other users have reported - and anxiously await some kind of real fix.
Jim

James,
It appears that in the past few days you have not received a response to your
posting. That concerns us, and has triggered this automated reply.
Has your problem been resolved? If not, you might try one of the following options:
- Do a search of our knowledgebase at http://support.novell.com/search/kb_index.jsp
- Check all of the other support tools and options available at
http://support.novell.com.
- You could also try posting your message again. Make sure it is posted in the
correct newsgroup. (http://support.novell.com/forums)
Be sure to read the forum FAQ about what to expect in the way of responses:
http://support.novell.com/forums/faq_general.html
If this is a reply to a duplicate posting, please ignore and accept our apologies
and rest assured we will issue a stern reprimand to our posting bot.
Good luck!
Your Novell Product Support Forums Team
http://support.novell.com/forums/

I have a question, why is it I can't purchase a app at App Store it says "Your payment method is not valid in this store" and I've got a Visa card and my location is in the Philippines. Please help me, what can I do?

I have a question, why is it I can't purchase a app at App Store it says "Your payment method is not valid in this store" and I've got a Visa card and my location is in the Philippines. Please help me, what can I do?

Your visa card is a credit card, not debit card? Do you meet the requirements as below, interpreted strictly?
Philippines - http://www.apple.com/legal/itunes/ph/terms.html - "The iTunes Store, Mac App Store, App Store, and iBookstore services (the "Stores") accept credit cards issued by banks in the Philippines or Content Codes as forms of payment."

I have two location one is Delhi(IP-192.168.100.*) and another is Mumbai(IP-192.168.1.*) and both are connected by MPLS line and ping with each other. We have one DC in Delhi location and domain name is CAPLDC and Delhi location all PC is member of this

I have two location one is Delhi(IP-192.168.100.*) and another is Mumbai(IP-192.168.1.*) and both are connected by MPLS line and ping with each other.
We have one DC in Delhi location and domain name is CAPLDC and Delhi location all PC is member of this domain and working properly.
now i am trying join the Mumbai location PC with my Domain(CAPLDC) but they are not join with my DC and generate the error.
I have chek the DNS and nslookup all are correct but this is generate error.
Is this possible Mumbai location join with this Domain(CAPLDC)???
One more thing when i have created another DC with this name (papldc.com) then Mumbai location is joined properly.
Pls find the error message below and also find the attachment.
Note: This information is intended for a network administrator. If you are not your network's administrator, notify the administrator that you received this information, which has been recorded in the file C:\Windows\debug\dcdiag.txt.
The domain name "capldc" might be a NetBIOS domain name. If this is the case, verify that the domain name is properly registered with WINS.
If you are certain that the name is not a NetBIOS domain name, then the following information can help you troubleshoot your DNS configuration.
DNS was successfully queried for the service location (SRV) resource record used to locate a domain controller for domain "capldc":
The query was for the SRV record for _ldap._tcp.dc._msdcs.capldc
The following domain controllers were identified by the query:
capldcserver.capldc
win-dyfq2poc88q.capldc
However no domain controllers could be contacted.
Common causes of this error include:
- Host (A) or (AAAA) records that map the names of the domain controllers to their IP addresses are missing or contain incorrect addresses.
- Domain controllers registered in DNS are not connected to the network or are not running.
Pankaj Kumar

Why are you using a single labeled domain? I would recommend renaming the domain name to be something like domain.com.
Please refer to the articles below to fix your current issue:
http://www.wincert.net/tips/networking/1614-cant-join-pc-to-a-domain-with-single-label.html
http://www.itgeared.com/articles/1128-using-single-label-dns-names-for-active/
This posting is provided AS IS with no warranties or guarantees , and confers no rights.
Ahmed MALEK
My Website Link
My Linkedin Profile
My MVP Profile

CDP and DeltaCRL locations expiring on Issuing CA

Similar Messages

Maybe you are looking for