Certificate Authority chain issue

Hello,
I have a problem with using root and sub Certificates in our PKI environment. Specifically, I have a problem with the way the Java implementation of certificates is working in our environment.
We use Entrust as our external Certificatation Authority. We are a predominantly Microsoft environment and have implemented PKI for user accounts and Smartcard logons across our domain. Our certificates are generated under Entrusts certificatation authority and we have added their DCOMROOTCA and DCOMSUBCA (Root and Subordinate) certificates to our trusted root certification Authorities store for all MS clients. Entrust have recently reissued their DCOMROOTCA and DCOMSUBCA certificates and we have included those new certificates in our trusted root certification Authorities store. The old Entrust certificates are still valid and dont expire for another 2 years. Our PKI environment and authentication continues to work as normal in an MS environment.
In a Windows environment which is using Microsofts implementation of certificates, a smart card which was issued under Entrusts old root certificate will successfully authenticate with a certificate issued under Entrustss new root certificate.
I am having a problem with VMWare View. VMWare View is a Web interface broker server which uses Javas implementation of certificate security, ie uses keytool.exe and cacerts as its trusted certificate store. I have secured the web interface with a certificate issued under Entrusts new root certificate. I am trying to authenticate with a smart card which has been issued with a certificate under Entrusts old root certificate. This has not been successful. I have imported the old DCOMROOT and DCOMSUB certificates and the new DCOMROOT and DCOMSUB certificates into the cacerts file. The client (a Wyse Terminal) also has the old and new DCOMROOT and DCOMSUB certificates in its trusted store. When I attempt to logon I get the following event in the logs on the Web interface broker server:
16:54:18,789 DEBUG <pool-1-thread-17> PooledProcessor SSL handshake exception from /10.42.2.138:2867, error was: sun.security.validator.ValidatorException: Certificate signature validation failed
If I reissue the Smartcard with a new certificate which has been generated under Entrust's new root and sub certificates I am able to successfully authenticate.
The conclusion I can draw from this is that Java certification (at least in the way I have set it up) breaks if a new issuing certificate is being used to generate a certificate to secure the Web interface and an old issuing certificate is being used on a smart card / client.
Does this sound correct? Is this a known issue or have I not imported or setup up the certificate chains correctly?
Any advice would be most welcome.
Many thanks,
Ben

Hi,
thanks for your reply.
Here is some more from the log. The log has some VMWare specific entries.
10:44:41,337 DEBUG <pool-1-thread-7> [PooledProcessor] SSL handshake exception from /10.42.2.134:1104, error was: sun.security.validator.ValidatorException: Certificate signature validation failed
10:44:41,462 DEBUG <VirtualCenterDriver-81804728-d329-4022-8d84-74dfa92516d0> [VirtualCenterDriver] (RePropagate cn=gb_off,ou=server groups,dc=vdi,dc=vmware,dc=int) Determine actions for cn=gb_off,ou=server groups,dc=vdi,dc=vmware,dc=int: totalVMs=11, availableVMs=11, zombieVMs=0, busyVMs=0, poweredOffVMs=0, suspendedVMs=0, vmMaximumCount=20, vmMinimumCount=10, vmHeadroomCount=5, customizingVMs=0
10:44:41,462 DEBUG <VirtualCenterDriver-81804728-d329-4022-8d84-74dfa92516d0> [VirtualCenterDriver] (RePropagate cn=gb_off,ou=server groups,dc=vdi,dc=vmware,dc=int) cn=gb_off,ou=server groups,dc=vdi,dc=vmware,dc=int::Control path is vmHeadroomCount-stop as availableVMs(11) > vmHeadroomCount(5)
10:44:41,478 DEBUG <VirtualCenterDriver-81804728-d329-4022-8d84-74dfa92516d0> [VirtualCenterDriver] (RePropagate cn=gb_off,ou=server groups,dc=vdi,dc=vmware,dc=int) Not stopping VMs as policy is ALWAYSON, REMAINON or DELETEONUSE
10:44:41,478 DEBUG <VirtualCenterDriver-81804728-d329-4022-8d84-74dfa92516d0> [VirtualCenterDriver] (RePropagate cn=gb_sco,ou=server groups,dc=vdi,dc=vmware,dc=int) onMachineEvent: null in pool: cn=gb_sco,ou=server groups,dc=vdi,dc=vmware,dc=int
10:44:41,963 DEBUG <VirtualCenterDriver-81804728-d329-4022-8d84-74dfa92516d0> [VirtualCenterDriver] (RePropagate cn=gb_sco,ou=server groups,dc=vdi,dc=vmware,dc=int) Determine actions for cn=gb_sco,ou=server groups,dc=vdi,dc=vmware,dc=int: totalVMs=10, availableVMs=9, zombieVMs=0, busyVMs=1, poweredOffVMs=0, suspendedVMs=0, vmMaximumCount=20, vmMinimumCount=10, vmHeadroomCount=5, customizingVMs=0
10:44:41,994 DEBUG <VirtualCenterDriver-81804728-d329-4022-8d84-74dfa92516d0> [VirtualCenterDriver] (RePropagate cn=gb_sco,ou=server groups,dc=vdi,dc=vmware,dc=int) cn=gb_sco,ou=server groups,dc=vdi,dc=vmware,dc=int::Control path is vmHeadroomCount-stop as availableVMs(9) > vmHeadroomCount(5)
10:44:41,994 DEBUG <VirtualCenterDriver-81804728-d329-4022-8d84-74dfa92516d0> [VirtualCenterDriver] (RePropagate cn=gb_sco,ou=server groups,dc=vdi,dc=vmware,dc=int) Not stopping VMs as policy is ALWAYSON, REMAINON or DELETEONUSE
10:44:41,994 DEBUG <VirtualCenterDriver-81804728-d329-4022-8d84-74dfa92516d0> [VirtualCenterDriver] (RePropagate cn=gb_dev,ou=server groups,dc=vdi,dc=vmware,dc=int) onMachineEvent: null in pool: cn=gb_dev,ou=server groups,dc=vdi,dc=vmware,dc=int
10:44:41,994 DEBUG <VirtualCenterDriver-81804728-d329-4022-8d84-74dfa92516d0> [VirtualCenterDriver] (RePropagate cn=gb_dev,ou=server groups,dc=vdi,dc=vmware,dc=int) Determine actions for cn=gb_dev,ou=server groups,dc=vdi,dc=vmware,dc=int: totalVMs=6, availableVMs=6, zombieVMs=0, busyVMs=0, poweredOffVMs=0, suspendedVMs=0, vmMaximumCount=0, vmMinimumCount=0, vmHeadroomCount=0, customizingVMs=0
10:44:42,713 DEBUG <HandshakeCompletedNotify-Thread> [PooledProcessor] Peer unverified
10:44:42,713 DEBUG <Thread-19> [SimpleAJPService] (Request128) SimpleAJPService request: /broker/xml
10:44:42,728 DEBUG <TP-Processor3> [XmlAuthFilter] (SESSION:6823E6F359BCD4ECC852D07F57268B1E) In doFilter
10:44:42,744 DEBUG <TP-Processor3> [XmlRequestProcessor] (SESSION:6823E6F359BCD4ECC852D07F57268B1E) read XML input
10:44:42,744 DEBUG <TP-Processor3> [XmlRequestProcessor] (SESSION:6823E6F359BCD4ECC852D07F57268B1E) added: configuration
10:44:42,759 DEBUG <TP-Processor3> [ProperoAuthFilter] (SESSION:6823E6F359BCD4ECC852D07F57268B1E) In doFilter for disclaimer
10:44:42,759 DEBUG <TP-Processor3> [ProperoAuthFilter] (SESSION:6823E6F359BCD4ECC852D07F57268B1E) Checking if authentication chain has been stopped
10:44:42,759 DEBUG <TP-Processor3> [ProperoAuthFilter] (SESSION:6823E6F359BCD4ECC852D07F57268B1E) In doFilter for SecurID
10:44:42,759 DEBUG <TP-Processor3> [ProperoAuthFilter] (SESSION:6823E6F359BCD4ECC852D07F57268B1E) Checking if authentication chain has been stopped
10:44:42,759 DEBUG <TP-Processor3> [ProperoAuthFilter] (SESSION:6823E6F359BCD4ECC852D07F57268B1E) In doFilter for gssapi
10:44:42,759 DEBUG <TP-Processor3> [ProperoAuthFilter] (SESSION:6823E6F359BCD4ECC852D07F57268B1E) Checking if authentication chain has been stopped
10:44:42,759 DEBUG <TP-Processor3> [ProperoAuthFilter] (SESSION:6823E6F359BCD4ECC852D07F57268B1E) Attempting to authenticate against gssapi
10:44:42,759 DEBUG <TP-Processor3> [ProperoAuthFilter] (SESSION:6823E6F359BCD4ECC852D07F57268B1E) In doFilter for cert-auth
10:44:42,775 DEBUG <TP-Processor3> [ProperoAuthFilter] (SESSION:6823E6F359BCD4ECC852D07F57268B1E) Checking if authentication chain has been stopped
10:44:42,775 DEBUG <TP-Processor3> [ProperoAuthFilter] (SESSION:6823E6F359BCD4ECC852D07F57268B1E) Attempting to authenticate against cert-auth
10:44:42,775 DEBUG <TP-Processor3> [CertificateAuthFilter] (SESSION:6823E6F359BCD4ECC852D07F57268B1E) Client did not use Certificate Authentication, skipping or failing
10:44:42,775 DEBUG <TP-Processor3> [CertificateAuthFilter] (SESSION:6823E6F359BCD4ECC852D07F57268B1E) Failing Certificate authentication, bypassing for OPTIONAL mode
10:44:42,775 DEBUG <TP-Processor3> [ProperoAuthFilter] (SESSION:6823E6F359BCD4ECC852D07F57268B1E) In doFilter for windows-password
10:44:42,775 DEBUG <TP-Processor3> [ProperoAuthFilter] (SESSION:6823E6F359BCD4ECC852D07F57268B1E) Checking if authentication chain has been stopped
10:44:42,775 DEBUG <TP-Processor3> [ProperoAuthFilter] (SESSION:6823E6F359BCD4ECC852D07F57268B1E) Attempting to authenticate against windows-password
10:44:42,775 DEBUG <TP-Processor3> [WinAuthFilter] (SESSION:6823E6F359BCD4ECC852D07F57268B1E) Attempting authentication against AD
10:44:42,775 DEBUG <TP-Processor3> [ProperoAuthFilter] (SESSION:6823E6F359BCD4ECC852D07F57268B1E) Not authenticated, requesting login page for windows-password
10:44:42,791 DEBUG <TP-Processor3> [ProperoAuthFilter] (SESSION:6823E6F359BCD4ECC852D07F57268B1E) AuthorizationFilter: XML Authorization Filter in doFilter()
10:44:42,791 DEBUG <TP-Processor3> [ProperoAuthFilter] (SESSION:6823E6F359BCD4ECC852D07F57268B1E) paeCtx == null, forwarding to login page: /broker/xml
10:44:42,791 DEBUG <TP-Processor3> [XmlServlet] (SESSION:6823E6F359BCD4ECC852D07F57268B1E) Start processing: configuration
10:44:42,791 DEBUG <TP-Processor3> [XmlServlet] (SESSION:6823E6F359BCD4ECC852D07F57268B1E) Processing: configuration
10:44:42,791 DEBUG <TP-Processor3> [XmlServlet] (SESSION:6823E6F359BCD4ECC852D07F57268B1E) Finished processing: configuration, Result: ok
10:44:42,806 DEBUG <TP-Processor3> [XmlServlet] (SESSION:6823E6F359BCD4ECC852D07F57268B1E) End processing: configuration
Many thanks again,
Ben

Similar Messages

HT5437 where is the credentials tab and where do you import the certificate authority chain from ?

How can I get apple tv to hook up to my WPA?WPA@ enterprise using apple configure?

Same here. With "Keychain Access" I've tried to cut/paste certificates as well as keys. Tried also to import items. Nothing seems to work. On my Mac I can see the items from my iPhone though.
There is very limited information from Apple about iCloud Keychain, and it seems to be limited to the activation and authorization procedures. All toubleshooting is related to these activities too.

Untrusted server cert chain & does not recognize the certificate authority

I have java code that makes an ssl connection to an HTTPS server.
The code workes fine when I connect to a server that has a
certificate that was issued by a recognizable authority.
But when I try to connect to our test HTTPS server which has a
certificate that was created by ourselves for debug, I get this
java exception: "untrusted server cert chain".
When I connect to our test HTTPS server with a browser, I get
this message from the browser in a popup window:
"www.xyz.com is a web site that uses a security certifcate to
identify itself. However netscape 6 does not recognize the
certificate authority that issued this certificate."
At this point I am able to accept the certificate in the popup
window and continue.
Question: In my java code how can I accept a certificate
that was signed by an unrecognizable authority just like the
browser can. Or during debug, how can I set an override
to accept ALL certs no matter what.
Thanks.....Paul

You will have to import your server test certificate into your client machine keystore. By default the keystore will be the 'cacerts' file in JAVA_HOME/jre/lib/security, get your server certificate in .pem format and use keytool to import it to the client.
keytool -import -alias <anything> -file <full path of .pem file> -keystore <full path of cacerts file>
The keystore password is 'changeit' by default, keytool comes with the JDK.
The reasoning behind this is to prevent the misuse of test certificates, the client has to consciously import an untrusted certificate. When you install a real certificate on your server the client will be automatically validated if bought from a trusted CA (Thawte, Verisign).
Take a look at the java.security.KeyStore class, you can use it to view your certificate chain.
Ronny.

CWMS Certificate Authority issue

Hi Everyone,
I've an issue with my CWMS Certificate Authority (CA),
I can't login into my CWMS from IPad (public),
error message is "This Certificate is not from a trusted authority".
I can login and join webex meeting from laptop (local and public),
everything is fine if I use laptop,
Error message from IPad attached.
Please advise
Ovindo

Hi Ovindo,
Are you using SSL certificate issued by a public/official Certification Authority or self-signed certs? If you are using SSL certs by a public CA, ensure you uploaded intermediate certs to CWMS as well. Please, take a look at this article for more info: http://www.cisco.com/en/US/docs/collaboration/CWMS/1_5/Troubleshooting_Guide_chapter_01.html#reference_EA8E3F4F2B12484F8433FB7FC4EF018F
I hope this helps.
Dejan

Certificate Authority - How to issue Certificates without extensions?

We are operating a Windows 2012 Server PKI with an Enterprise Subordinate Certificate Authority that is issuing Certificates through an AD Certificate Template, however there are certain certificate extensions that need
to be excluded.
We are following the procedure defined in ;
http: //blogs.technet.com/b/pki/archive/2007/01/03/how-to-exclude-the-certificate-template-name-from-certificates-to-be-issued.aspx
certutil -setreg policy\DisableExtensionList +1.3.6.1.4.1.311.20.2
certutil -setreg policy\DisableExtensionList +1.3.6.1.4.1.311.21.7
net stop certsvc
net start certsvc
This does not have any effect as issued certificates continue to have the extensions in them after the change.

Can you confirm that this command contains EDITF_DISABLEEXTENSIONLIST flag enabled:
certutil -getreg policy\editflags
if not, then you should enable it:
certutil -setreg policy\editflags +EDITF_DISABLEEXTENSIONLIST
and restart CA service.
My weblog: en-us.sysadmins.lv
PowerShell PKI Module: pspki.codeplex.com
PowerShell Cmdlet Help Editor pscmdlethelpeditor.codeplex.com
Check out new: SSL Certificate Verifier
Check out new:
PowerShell FCIV tool.

Certificate Authority certificate issued with incorrect hash algorithm

Hi all,
We have a certificate authority which was migrated from Server 2003 to 2008R2, the issue is that after running this command:
certutil -setreg ca\csp\CNGHashAlgorithm sha256
to upgrade the CA to SHA256, we renewed the CA certificate but the certificate still renewed using SHA1. The cryptographic settings in the CA properties dialog box says SHA256 however the certificate is issued using SHA1. Here is the image:
Any pointers to how we can reissue CA certificate with SHA256 algorithm?
Thanks,
Ojas

[Puneet Singh] What i feel is that your initial key which was generated was CAPI based that might be the reason you might be facing the problem.
Try to do the things in below sequence.
certification authority’s system, you will need to run the following commands from an elevated command line window:
certutil -setreg ca\csp\CNGHashAlgorithm SHA256
net stop certsvc
net start certsvc
Make sure you are using a Key Storage Provider that supports SHA256 – for example the Microsoft Key Storage Provider -
and then renew the certification authority’s certificate.
if you have the CAPI provider or you are CAPI based key then you have to convert it to CNG key and use certutil
repair so that it does start using the CNG key.
Puneet Singh

Certificate Authority Issue, Please help...

I'm writing a program using Java Security APIs and other third party APIs, such as IBM's XSS4J.
The client program do the digital signature on a XML file using a java keytool generated self signed "private DSA key".
The server side program receives the XML and then tries to verify the the digital signature.
The program works fine. However, I've got a question about the Certificate Authority, like Verisign. Because I want to get a more formal private DSA key for doing digital signature instead of using the self-signed key. Does anyone have the experience with that? I checked Verisign's website, and have no idea which of their "product" to choose. Basically, I just need Verisign to sign on my keytool generated private key.
Please tell me how. Thanks a million.

Thanks for correcting me. Actually I want ot send the certificate to Verisign and get it signed there. But how to do that? I checked the code signing, that is for digital signing your program that for other people to download. Not for the XML signing.
I used the command to generate the Digital Signature Key.
keytool -genkey -alias myTourOperatorCertificate -keyalg DSA -dname "CN=Bilal Siddiqui, OU=HotelBookings, O=myTourOperator, C=PK" -keypass myKeyPass -keystore tourOperatorCertificate -storepass myKeyStorePass

Certificate Authority Windows 2008 to 2012 R2 - Clean up and Migration

Hello,
    I'm currently dealing with the following scenario:
1. I've inherited the current infrastructure setup and the plan is to clean things up and setup a new certificate infrastructure using Windows 2012 R2.
2. The current setup:
    a. Domain Controller, Windows 2008 R2, is/was a Certificate Authority. It hasn't issued any new certificates (based on the information in Certificate Effective Date) for quite some time. It also has an expired certificate for
itself - issued by the domain's issuing CA - and attempts to renew it via MMC give a "Server execution failed" and STATUS: Failed when looking in Certificate enrollment for Domain Controller. We'll call the server, DC1.
    b. Certificate Authority Server, we'll call it CERT1. When booting up the machine and/or attempting to restart certificate services on the server, the following errors are in the event log:
EVENT 7024: Description: The Active Directory Certificate Services service terminated with service-specific error %%-2146885613.
EVENT 100: Active Directory Certificate Services did not start: Could not load or verify the current CA certificate. Domainlocal Issuing CA The revocation function was unable to check revocation because the revocation server was offline. 0x80092013
(-2146885613).
EVENT 48: Description: Revocation status for a certificate in the chain for CA certificate 0 for Domain.local Issuing CA could not be verified because a server is currently unavailable. The revocation function was unable to check revocation because
the revocation server was offline. 0x80092013 (-2146885613).
Note: The server's computer certificate has expired and it was issued by the Domain Controller mentioned in point A. Attempts to renew it fail.
(The issue on CERT1 is like the one mentioned in this article: https://support.microsoft.com/kb/825061?wa=wsignin1.0 however an upgrade wasn't done and it's not old versions of Windows.)
c. There is a certificate authority machine - part of what was created for a PKI infrastructure - that was kept shutdown. I've powered it up and the machine is not part of the domain.
Any thoughts or feedback on easily repairing the current situation so that I can upgrade everything to a new Windows 2012 R2 Certificate infrastructure would be appreciated.
Thanks!

Hi Vadims,
    Basically using certificates in the following manner:
1. User / Computer enrollment in the AD domain.
2. Any hardware / web services (internal) that need a certificates. This is usually hardware that has some form of GUI that is accessed via URL, printers accessed via URL and/or that communicate via LDAP to AD, internal UC (Lync is an example), that
sort of thing.
    A number of machines currently show certificate errors (ie.. certificate has expired) however that hasn't stopped things from working just functioning differently. I'm going already on the assumption that if I remove the entire CA
infrastructure and re-install a new one and have everything point to that new CA server that I should be ok but I'm not 100% certain hence why I asked on this forum.
Also, you're correct is that there is one more CA. That CA was the server that was turned off/offline that I powered on. It is not part of the AD domain that the domain controller and the other CA belong to. (It is standalone.) I'm
currently patching the standalone CA since it's been off for what looks like almost 1.5 years.

How to load the certificate authority into the keystore for the weblogic8.1

how to load the certificate authority into the keystore for the weblogic8.1
==================================================
Getting the message below when trying to improt the certificate to the weblogic 8.1 web server. Received this certificate from our internal IT certificate authority. Trying to import the certificate to our test sytem.
===================================================
keytool error: java.lang.Exception: Failed to establish chain from reply
Import failed. Verify that the Certificate Authority that signed 'certi.pem'
has been loaded into your keystore 'keystore\pskey'
To view keystore contents issue 'PSkeymanager -list -keystore keystore\pskey [-v
To preview a certificate file issue 'PSkeymanager -previewfilecert -file certi.pem'

You need to populate that field using cmod code. Find out from which table that field is and go to transaction cmod then enter project name and select component radio button then display.
Now select the FM EXIT_SAPLRSAP_001 if your datasource is transactional dataource
EXIT_SAPLRSAP_002 for master data attibute
EXIT_SAPLRSAP_003 for Hierarchies
EXIT_SAPLRSAP_004 for text
then populate code .
After your code then delete data from ods then reinit to populate the enhanced field.
Hope it helps..

UCS Manager and using Microsoft Certificate Authority

Has anybody gone through the process of setting up UCS Manager with a certificate issued from a Microsoft Certificate Authority? If so I would appreciate some assistance. I was able to successfully create a request and have generated the certificate, but I see no way of being able to put the request and the certificate chain back into UCS Manager.

First you have to create a trusted point (under the Admin Tab -> Key Management). In the new trusted point, paste the public cert in base64 format of your root certificate authority. If you have a subordinate CA that's issuing then add that CA's cert too. If you have a whole tree of CAs, then you need to create a trusted point with all the CAs in the chain from the issueing CA up to the root. Paste one cert after the other, in order, up the chain, all in the same trusted point. If they're not in the right order or if you're missing the root, then the TP won't accept the cert.
Once you have a trusted point you can accept the certificate you generated. In the KeyRing you used to generate the request, choose the new Trusted Point, and paste the new certificate in Base64 format into the Certificate field.
Once that's done, you can go to Communication Management -> Communication Services, and for the HTTPS protocol, choose the new Key Ring. It might not take effect immediately, but after a few minutes your UCSM web site should start responding with the new certificate.
I hope that helps.
Note: There's a bug in UCS currently issue number CSCth62582. If your fabric interconnects fail over, the SSL cert will revert to the default self signed cert. You have to go back into Communication services and set it to default, save, then set it back to the new Key Ring.

How do I set up my own certificate authority

I tried google on the above question, and the most recent thing I found was 7 years old. replacing the phrase used generates a lot of hits with a very poor signal to noise ratio.
I have OpenSSL (in the cygwin distribution), which is quite recent, but frankly its documentation leaves just about everything to be desired. I found pyca, but it has no documentation at all (and it is a couple years old).
I tried the steps appended below, but invariably the attempt to sign the certificates fails with an obscure error message about OpenSSL not finding one thing or another.
At this stage, I just don't care whether I do this using something in the J2SDK such as keytool or OpenSSL, as long as I can get it done. Or if there is some other opensource software tool I can use, terrific. This is primarily for the purpose of securing communications within an Intranet, and secondarily for signing applets and applications distributed through WebStart. If I am not mistaken, I'll need a certificate for each of my servers. Right?
If you know of an URL where this is well explained and illustrated, great. Give that to me.
Otherwise, a simple illustration (or a correction of what I've appended below) would be appreciated. I believe I understand what ought to be happening. It ought to be rather simple to do, but there are these irritating and frustrating minor details getting in the way. For example, the steps I show below seem simple, but everything appears to get messed up by some of the contents of openssl.cnf in 'usr/ssl', in the cygwin directory, and there is no explanation of how to set things up for the first time you use OpenSSL within Cygwin (or on unix for that matter).
Any assistance would be appreciated.
Thanks,
Ted
========failed attempt=====================
# Generation of Certificate Authority(CA)
openssl req -new -x509 -keyout cakey.pem -out cacert.pem -config /usr/ssl/openssl.cnf
# Create server request and key
openssl req -new -keyout server-key.pem -out server-req.pem -days 36502 -config /usr/ssl/openssl.cnf
# Remove the passphrase from the key
openssl rsa -in server-key.pem -out server-key.pem
# Sign server cert
openssl ca -policy policy_anything -out server-cert.pem -infiles server-req.pem -config /usr/ssl/openssl.cnf
# Create client request and key
openssl req -new -keyout client-key.pem -out client-req.pem -days 36502 -config /usr/ssl/openssl.cnf
# Remove a passphrase from the key
openssl rsa -in client-key.pem -out client-key.pem
# Sign client cert
openssl ca -policy policy_anything -out client-cert.pem -infiles client-req.pem -config /usr/ssl/openssl.cnf

The following works for me:
NB: Some of the output has been removed in the interests of privacy (this will not affect the outcome)
1. Create CA key and certificate
1.1 Create a new file called "serial" containing the value "01".
1.2 Create an empty file "index.txt"
1.3 Create a subdirectory "newcerts"
1.4 Execute.... create a key for your CA
[ben@localhost ca]$ openssl genrsa -out ca.key 2048
Generating RSA private key, 2048 bit long modulus
.....................................+++
..........................................................+++
e is 65537 (0x10001)
1.5 Execute... create a certificate for your own CA
[ben@localhost ca]$ openssl req -config ./openssl.cnf -new -x509 -key ca.key -out cacert.pem -days 365
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
Country Name (2 letter code) [GB]:
County or State (full name) []:
City or town (eg, Hitchin) []:
Organization Name (eg, company) []:
Organizational Unit Name (eg, section) []:
Common Name (eg, your name or your server's hostname) []:
Email Address []:
2. Create PK key and .csr
2.1 Execute...
[ben@localhost ca]$ keytool -genkey -alias PK
Enter keystore password: password
What is your first and last name?
[Unknown]:
What is the name of your organizational unit?
[Unknown]:
What is the name of your organization?
[Unknown]:
What is the name of your City or Locality?
[Unknown]:
What is the name of your State or Province?
[Unknown]:
What is the two-letter country code for this unit?
[Unknown]:
Is CN=, OU=, O=, L=, ST=, C=GB correct?
[no]: yes
Enter key password for <PK>
(RETURN if same as keystore password):
2.2 Create .csr
[ben@localhost ca]$ keytool -certreq -alias PK -file PK.csr
Enter keystore password: password
3. Sign PK with CA cert
[ben@localhost ca]$ openssl ca -config ./openssl.cnf -in PK.csr -out PK.pem -keyfile ca.key -days 365
Using configuration from ./openssl.cnf
Check that the request matches the signature
Signature ok
Certificate Details:
Serial Number: 0 (0x0)
Validity
Not Before: Jan 5 19:48:33 2006 GMT
Not After : Jan 5 19:48:33 2007 GMT
Subject:
countryName = GB
stateOrProvinceName =
organizationName =
organizationalUnitName =
commonName =
X509v3 extensions:
X509v3 Basic Constraints:
CA:FALSE
Netscape Comment:
OpenSSL Generated Certificate
X509v3 Subject Key Identifier:
D6:2D:7E:71:77:9E:1A:BB:54:69:98:63:6A:6A:E2:BA:12:C4:D7:DD
X509v3 Authority Key Identifier:
keyid:92:7C:33:7C:EC:1D:76:C5:B8:F0:30:6D:10:12:40:E5:E7:EA:24:31
DirName:/C=GB/ST=/L=/O=/OU=/CN=/emailAddress=
serial:F0:D1:38:36:65:6D:71:D5
Certificate is to be certified until Jan 5 19:48:33 2007 GMT (365 days)
Sign the certificate? [y/n]:y
1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated
4. Convert PK certificate into DER format
[ben@localhost ca]$ openssl x509 -in PK.pem -out PK.der -outform DER
5. Import CA certificate into keystores
[ben@localhost ca]$ keytool -import -alias ca -file cacert.pem
Enter keystore password: password
Owner: EMAILADDRESS=, CN=, OU=, O=, L=, ST=, C=GB
Issuer: EMAILADDRESS=, CN=, OU=, O=, L=, ST=, C=GB
Serial number: f0d13836656d71d5
Valid from: Thu Jan 05 19:41:09 GMT 2006 until: Fri Jan 05 19:41:09 GMT 2007
Certificate fingerprints:
MD5: AF:3D:8E:25:12:24:04:1F:40:70:BC:A0:9E:0E:44:84
SHA1: B8:E8:0B:A5:86:33:21:0C:B5:3C:6E:F2:DE:7B:31:0F:59:AE:21:E4
Trust this certificate? [no]: yes
Certificate was added to keystore
6. Import signed PK into keystore
[ben@localhost ca]$ keytool -import -alias pk -file PK.der
Enter keystore password: password
Certificate reply was installed in keystore
REF:
http://www.yorku.ca/dkha/docs/jsse_cert/jsse_cert.htm
http://httpd.apache.org/docs/2.2/ssl/ssl_faq.html#ownca
http://www.openssl.org/docs/apps/ca.html#
openssl.cnf:#
# OpenSSL example configuration file.
# This is mostly being used for generation of certificate requests.
# This definition stops the following lines choking if HOME isn't
# defined.
HOME               = .
RANDFILE          = $ENV::HOME/.rnd
# Extra OBJECT IDENTIFIER info:
#oid_file          = $ENV::HOME/.oid
oid_section          = new_oids
# To use this configuration file with the "-extfile" option of the
# "openssl x509" utility, name here the section containing the
# X.509v3 extensions to use:
# extensions          =
# (Alternatively, use a configuration file that has only
# X.509v3 extensions in its main [= default] section.)
[ new_oids ]
# We can add new OIDs in here for use by 'ca' and 'req'.
# Add a simple OID like this:
# testoid1=1.2.3.4
# Or use config file substitution like this:
# testoid2=${testoid1}.5.6
[ ca ]
default_ca     = CA_default          # The default ca section
[ CA_default ]
dir          = .               # Where everything is kept
certs          = $dir/certs          # Where the issued certs are kept
crl_dir          = $dir/crl          # Where the issued crl are kept
database     = $dir/index.txt     # database index file.
#unique_subject     = no               # Set to 'no' to allow creation of
                         # several ctificates with same subject.
new_certs_dir     = $dir/newcerts          # default place for new certs.
certificate     = $dir/cacert.pem      # The CA certificate
serial          = $dir/serial           # The current serial number
#crlnumber     = $dir/crlnumber     # the current crl number must be
                         # commented out to leave a V1 CRL
crl          = $dir/crl.pem           # The current CRL
private_key     = $dir/private/cakey.pem# The private key
RANDFILE     = $dir/private/.rand     # private random number file
x509_extensions     = usr_cert          # The extentions to add to the cert
# Comment out the following two lines for the "traditional"
# (and highly broken) format.
name_opt      = ca_default          # Subject Name options
cert_opt      = ca_default          # Certificate field options
# Extension copying option: use with caution.
# copy_extensions = copy
# Extensions to add to a CRL. Note: Netscape communicator chokes on V2 CRLs
# so this is commented out by default to leave a V1 CRL.
# crlnumber must also be commented out to leave a V1 CRL.
# crl_extensions     = crl_ext
default_days     = 365               # how long to certify for
default_crl_days= 30               # how long before next CRL
default_md     = md5               # which md to use.
preserve     = no               # keep passed DN ordering
# A few difference way of specifying how similar the request should look
# For type CA, the listed attributes must be the same, and the optional
# and supplied fields are just that :-)
policy          = policy_match
# For the CA policy
[ policy_match ]
countryName          = match
stateOrProvinceName     = match
organizationName     = match
organizationalUnitName     = optional
commonName          = supplied
emailAddress          = optional
# For the 'anything' policy
# At this point in time, you must list all acceptable 'object'
# types.
[ policy_anything ]
countryName          = optional
stateOrProvinceName     = optional
localityName          = optional
organizationName     = optional
organizationalUnitName     = optional
commonName          = supplied
emailAddress          = optional
[ req ]
default_bits          = 1024
default_keyfile      = privkey.pem
distinguished_name     = req_distinguished_name
attributes          = req_attributes
x509_extensions     = v3_ca     # The extentions to add to the self signed cert
# Passwords for private keys if not present they will be prompted for
# input_password = secret
# output_password = secret
# This sets a mask for permitted string types. There are several options.
# default: PrintableString, T61String, BMPString.
# pkix      : PrintableString, BMPString.
# utf8only: only UTF8Strings.
# nombstr : PrintableString, T61String (no BMPStrings or UTF8Strings).
# MASK:XXXX a literal mask value.
# WARNING: current versions of Netscape crash on BMPStrings or UTF8Strings
# so use this option with caution!
# we use PrintableString+UTF8String mask so if pure ASCII texts are used
# the resulting certificates are compatible with Netscape
string_mask = MASK:0x2002
# req_extensions = v3_req # The extensions to add to a certificate request
[ req_distinguished_name ]
countryName               = Country Name (2 letter code)
countryName_default          = GB
countryName_min               = 2
countryName_max               = 2
stateOrProvinceName          = County or State (full name)
stateOrProvinceName_default     =
localityName               = City or town (eg, Hitchin)
localityName_default          =
0.organizationName          = Organization Name (eg, company)
0.organizationName_default     =
# we can do this but it is not needed normally :-)
#1.organizationName          = Second Organization Name (eg, company)
#1.organizationName_default     = World Wide Web Pty Ltd
organizationalUnitName          = Organizational Unit Name (eg, section)
organizationalUnitName_default     =
commonName               = Common Name (eg, your name or your server\'s hostname)
commonName_max               = 64
emailAddress               = Email Address
emailAddress_max          = 64
# SET-ex3               = SET extension number 3
[ req_attributes ]
challengePassword          = A challenge password
challengePassword_min          = 4
challengePassword_max          = 20
unstructuredName          = An optional company name
[ usr_cert ]
# These extensions are added when 'ca' signs a request.
# This goes against PKIX guidelines but some CAs do it and some software
# requires this to avoid interpreting an end user certificate as a CA.
basicConstraints=CA:FALSE
# Here are some examples of the usage of nsCertType. If it is omitted
# the certificate can be used for anything *except* object signing.
# This is OK for an SSL server.
# nsCertType               = server
# For an object signing certificate this would be used.
# nsCertType = objsign
# For normal client use this is typical
# nsCertType = client, email
# and for everything including object signing:
# nsCertType = client, email, objsign
# This is typical in keyUsage for a client certificate.
# keyUsage = nonRepudiation, digitalSignature, keyEncipherment
# This will be displayed in Netscape's comment listbox.
nsComment               = "OpenSSL Generated Certificate"
# PKIX recommendations harmless if included in all certificates.
subjectKeyIdentifier=hash
authorityKeyIdentifier=keyid,issuer:always
# This stuff is for subjectAltName and issuerAltname.
# Import the email address.
# subjectAltName=email:copy
# An alternative to produce certificates that aren't
# deprecated according to PKIX.
# subjectAltName=email:move
# Copy subject details
# issuerAltName=issuer:copy
#nsCaRevocationUrl          = http://www.domain.dom/ca-crl.pem
#nsBaseUrl
#nsRevocationUrl
#nsRenewalUrl
#nsCaPolicyUrl
#nsSslServerName
[ v3_req ]
# Extensions to add to a certificate request
basicConstraints = CA:FALSE
keyUsage = nonRepudiation, digitalSignature, keyEncipherment
[ v3_ca ]
# Extensions for a typical CA
# PKIX recommendation.
subjectKeyIdentifier=hash
authorityKeyIdentifier=keyid:always,issuer:always
# This is what PKIX recommends but some broken software chokes on critical
# extensions.
#basicConstraints = critical,CA:true
# So we do this instead.
basicConstraints = CA:true
# Key usage: this is typical for a CA certificate. However since it will
# prevent it being used as an test self-signed certificate it is best
# left out by default.
# keyUsage = cRLSign, keyCertSign
# Some might want this also
# nsCertType = sslCA, emailCA
# Include email address in subject alt name: another PKIX recommendation
# subjectAltName=email:copy
# Copy issuer details
# issuerAltName=issuer:copy
# DER hex encoding of an extension: beware experts only!
# obj=DER:02:03
# Where 'obj' is a standard or added object
# You can even override a supported extension:
# basicConstraints= critical, DER:30:03:01:01:FF
[ crl_ext ]
# CRL extensions.
# Only issuerAltName and authorityKeyIdentifier make any sense in a CRL.
# issuerAltName=issuer:copy
authorityKeyIdentifier=keyid:always,issuer:always

Windows Server 2008 R2 Standard "Certificate Authority Service" / Exchange Server 2010 EMC not starting and no AD connectivity for authentication.

Hello,
I am a new IT Manager at this company and need assistance big time. Their environment looks as follows:
Server 1. Domain Controller Server (Windows Server 2008 R2 Standard) running active directory.
Server 2. Email Server (Windows Server 2008 R2 Standard) running Exchange Server 2010 .
* Note. No back ups to work with aside from whats mentioned below.
DC had a virus infection causing a lot of issues on the shared network drives 2 days ago locking up all the files with a crypto ransom virus. Running Avast suppressed the infection. Had to recover the file shares which luckily had a back up.
The issue is that the Exchange Server 2 post this lost connectivity with the AD Server 1. Exchange Server 2 when launching EMC could not launch the console stating the following:
"No Exchange servers are available in any Active Directory sites. You can’t connect to remote
Powershell on a computer that only has the Management Tools role installed."
Shortly after I found that it is possible the EMC launcher was corrupt and needed to be reinstalled following another blog post. I deleted the exchange management console.msc per instructions only to discover I couldnt relaunch it because there was
no way how. So I copied another msc file that happened to be on the DC Server 1 back to Exchange Server 2 and got it to launch again.
Another post said that it might be an issue with the Domain Account for the Computer, so to delete it in the AD Server 1 only to find that rejoining it from Exchange Server 2 using Computer>Properties> Chage Settings > Change is greyed out because
it is using the Certificate Authority Service.
I tried manually re-adding the computer in AD and modeling permissions after another server in group settings but no go. After this I was unable to login to the Exchange Server 2 with domain accounts but only local admin, receiving the following Alert:
"The Trust Relationship between this workstation and primary domain failed."
I tried running the Power Shell tools on Exchange Server 2 to rejoing and to reset passwords for domain accounts as noted in some other blogs but no luck as the Server 2 could not make the connection with Server1 or other errors it kept spitting out.
I also during the investigation found the DNS settings were all altered on both the Server 1 and Server 2 which I luckily was able to change back to original because of inventorying it in the beginning when I started.
I need help figuring out if I need to rejoin the Exchange Server 2 manually by disabling the Certificate Authority Service (or removing the CA as listed here:
https://social.technet.microsoft.com/Forums/exchange/en-US/fb23deab-0a12-410d-946c-517d5aea7fae/windows-server-2008-r2-with-certificate-authority-service-to-rejoin-domain?forum=winserversecurity
and getting exchange server to launch again. (Mind you I am relatively fresh to server managing) Please help E-Mail has been down for a whole day now!
Marty

I recommend that you open a ticket with Microsoft Support before you break things more.
Ed Crowley MVP "There are seldom good technological solutions to behavioral problems."

How to filter certificate templates in Certificate Authority snap-in with the correct values

How to filter certificate templates in Certificate Authority snap-in with the correct values
I have a 2012 R2 server running Microsoft Certificate Authority snap-in.
I want to do a filter on a specific Certificate Template which i know exists in the 'Issued Certificates' folder.
All the documentation i can find seems to suggest i copy the certificate name and use this in the View Filter.
1). I add the 'Certificate Template' option into the Field drop-down.
2). I leave the Operation as the '=' symbol
3). I paste in just the name of the template in question. for example: 'my computers'
The search results always come back blank 'There are no items to show in this view.' even when i know there are many instances of this template. I've tried on a win 2008 server and same issue.
Is there a correct value to enter for the Certificate Template name?
Can this be done easier using certutil commands?
When i run the certutil tool i can confirm i have several issued templates. Certutil -catemplates -v > c:\mytemplate_log.csv
Anybody know what i'm doing wrong?
I seem to be getting nowhere with this one.

> But its important you are using the template name, not the display name
this is incorrect. OIDs are mapped to *display name*, not common name (it is true for all templates except Machine template). That is, in order to translate template name to a corresponding OID, you need to use certificate template's display name. And, IIRC,
template name in the filter can be used only for V1 templates. For V2 and higher, OID must be used.
My weblog: en-us.sysadmins.lv
PowerShell PKI Module: pspki.codeplex.com
PowerShell Cmdlet Help Editor pscmdlethelpeditor.codeplex.com
Check out new: SSL Certificate Verifier
Check out new:
PowerShell FCIV tool.

How to accept certificate authority in HP PPM

How can we accept the Certificate Authority (similar to VeriSign) of any organization specific instead of just accepting the individual certificate in HP PPM.This enables to be able to accept any cert from that organization specific instead of having to import the Certificate each year

Hi FahadKhan,
Welcome to the HP Forums, I hope you enjoy your experience! To help you get the most out of the HP Forums I would like to direct your attention to the HP Forums Guide First Time Here? Learn How to Post and More.
I am sorry, but to get your issue more exposure, I would suggest posting it in the commercial forums, since this is a commercial product. You can do this at
http://h30499.www3.hp.com/t5/Operations-Management/ct-p/operations-management
I hope this helps!
Regards
MechPilot
I work on behalf of HP
Please click “Accept as Solution ” if you feel my post solved your issue, it will help others find the solution.
Click the “Kudos, Thumbs Up" on the right to say “Thanks” for helping!

How to import a Root Certificate Authority for signing

How can I import a Root Certificate Authority in order to use it with Certificate Assistant as a CA to sign other certs?
I have the CA cert imported in keychain along with it's associated private key (from a .p12), it's got the gold icon and is recognized as a Root certificate authority, yet Certificate Assistant will not list it as an available Root CA in the "Set Default CA" action dialog, the "Add..." dialog seems only interested in a ".certAuthorityConfig" plist file.
Do I have to generate a certAuthorityConfig for the CA? I can't seem to find a way to do that. No clues from certtool & security CLI utils even.
Any info/leads on how to get this to work would be much appreciated.
Regards,
-david

Hi Alex,
From ACE perspective, it doesn't make differences if you are using certificates issued by your local or a "well known" CA. Moreover, if not mistaken, you have to configure authentication group whatever you are doing client or server authentication.
http://www.cisco.com/en/US/partner/docs/app_ntwk_services/data_center_app_services/ace_appliances/vA4_1_0/configuration/ssl/guide/certkeys.html#wp1043643
Thanks,
Olivier

Certificate Authority chain issue

Similar Messages

Maybe you are looking for