Certificate Authority - pkiEnrollmentService and cerdat.inc missmatch
Hello,
This question has never been answered directly.
Q: Do the pkiEnrollmentService object field 'dNSHostName' and the value for 'sServerConfig' set in the certdat.inc file located in %windir%\system32\certsrv\ have to match all the time, or are there instance where they shouldn't match for good reason?
Example correct values as I understand them:
pkiEnrollmentService object field 'dNSHostName': CAhostname.domain.com (The FQDN of the CA server)
'sServerConfig' value in certdat.inc: CAhostname.domain.com\MyEvilCA (FQDN of the CA server \ The name of the CA as viewed in the Certificate Authority snap-in.)
Thanks,
Alex
If the now extinct CA had been uninstalled gracefully, the related Enrollment Services Object would have been deleted.
So if you are absolutely sure that this old CA will never come to live again you can delete its object under Enrollment Services. I would do this with pkiview.msc, Manage AD Containers though. adsiedit.msc typically does not break anything but pkiview is
the supported method.
But you must not delete the pkiEnrollment object for the new CA!
Every CA has its own Enrollment Services object so the productive CA should have another, distinct, Enrollment Services Object... and this one should show a dnsHostName that is equal to the host name in certdat.inc.
So how many Enrollment objects do you see now?
The only confusion that may arise that I can think of is: The CNs of pkiEnrollment objects are equal to the CN in the CA certificate. So if you
installed a new CA that has the same subject CN as the old one and it could not overwrite the existing object due to whatever reason then the only existing object shows the wrong dnsHostName. In this case I would test editing
dnsHostName but chances are there are still issues with permissions as this a peculiar object re speical permissions.
If enrollment does not work I would 1) backup the new CA (Databases, key, registry), 2) uninstall the new CA, 3) delete the "orphaned" pkiEnrollment object and 4) Restore the new CA. This will also re-create the pkiEnrollmen object properly.
Elke
Similar Messages
-
Oracle Certificate Authority OCA and SSL Immlementation
Hi
Is anybody can clear that:
1) Does OCA only work on intranet or it does work internet also.
2) What is the difference between OCA and Verisign or any other third party CA
3) What are the benifits for OCA
4) What are the advantages and disadvantages for both of them
5) what are the main steps invloved to implement OCA and SSL
I'll be very appraciated, if anybody give me the answers as soon as possible. Please gIve me the answers whichever you knows very well.
Thanks in Advance
Munir MuhammadCertificate authority and SSL are two completely different concepts. They can be related but are by no means similar.
SSL is a service or a feature, not a product. SSL is used to encrypt the traffic. Part of SSL is the use of certificates for authentication. A server or user would pass a certificate as part of an SSL transmission.
The certificates used for enrypted transmission(SSL), can be obtained from the Oracle Certificate Authority(OCA), or by a third party certificate authority. OCA is not required to use SSL.
To achieve a fully encrypted envrinment, you would need to use SSL at several layers. This would be done with or without the use of the Oracle certificate authority.
1. From the web browser to the middle tier
2. End user to database
3. from the middle tier to OID
4. from the middle tier to the database
5. From OID to active directory -
Certificate Authority - Custom Temp not showing up. W2k8R2ent
Hi Guys,
Couldn't see a forum for CA so I had to post it here. Hopefully its the right place.
(Server is test domain 1 single ad no replication. Running Win 2k8 r2 enterprise)
So here's the issue I am trying to create and export certificate for other users (eobo).
It works fine. But I want to do this throught certreq and in order to do that i have to creat custom cert which i did by duplicating User template.
The new template CopyOfUser i changed(of confirmed) following settings:-
General Tab = Publish Cert in Active Directory
Request Handling = Allow private key to be exported & Enroll subject without req any input
Security : I am logging as domain administrator and it has Read/Write/Enroll
Issurance Req: This number of authorized signature = 1
& Application Policy & Client Authentication.
Subject Name : Build from AD (Fully Distinguished name)
Selected boxes : Include email name / Email name / UPN
Now problem is i cannot see the custom template on Enable Certificate Templates.
I am very new to CA so I am sure i am missing something or doing something wrong.
Would love some help.Hi,
I’d suggest if the steps below doesn’t help to remove the CA. Make sure you are using Enterprise Edition (no upgrade from 2K3 or 2K9 standart) of windows
and install it again as Enterprise Root CA. Check and see if you still have the issue before tweaking the CA further:
Open ADUC and check navigate to [Buildin > users > properties > members] and make sure the fallowing security groups are present.
- Authenticated users
- Domain Users
- Interactive
Open ADSI Edit and navigate to
[Domain Naming context > DC=<DomainNAme>, DC=<DomainNAme> > CN=Users > CN=Cert Publishers > properties > security ]
and give [Read] and [write]
permissions to [Authenticated users] group
Restart the CA.
Check permissions on the CA:
Open the [Certificate Authority] console and right click on [properties > Security] and add the fallowing permissions:
[Authenticated Users]
[V] Request Certificates
[Domain Admins]
[V] Read
[V] Issue and Manager Certificates
[V] Manage CA
[V] Request Certificates
[Enterprise Admins]
[V] Issue and Manager Certificates
[V] Manage CA
[Administrators]
[V] Issue and Manager Certificates
[V] Manage CA
[V] Request Certificates
[Domain Controllers]
[V] Read
[V] Issue and Manager Certificates
[V] Manage CA
[V] Request Certificates
[Domain Computers]
[V] Read
[V] Request Certificates
Will appreciate if you give feedback if this has helped you. If yes please select “Mark
as answer”.
Best Regards,
Spas Kaloferov
MCITP: SA6 | EA6 | VA7 | EDA7 |DBA10 | DBD10 | BID10 | EMA14 | SPA14
NetShell Services & Solutions | “Design the future with simplicity and elegance”
Visit me at:
www.spaskaloferov.com
|
www: www.netshell-solutions.com -
Heartbleed: Remove Certificate Authority from iOS device
Hi,
I am in the process of changing SSL certificates after the Heartbleed bug. As I wasn't able to find a reliable cross platform way to revoke my internal certificates (e.g. Chrome doesn't check CRLs), I'm planning to reissue new certificates based on a new internal certificate authority (CA) and to remove the old CA from all systems. This should render all previous certificates as untrusted.
This is easy for Linux, Windows and OS X, but how can I do this for iOS 7 devices? I believe the CA certificate was originally deployed to the iOS devices through a configuration profile. However, when I go to Settings > General > Profiles, there is no such profile listed. The iOS Safari shows my internal HTTPs pages without certificate warnings, thus the device must somehow have remembered that CA as trustworthy.
Here are my questions:
How can I view and/or modify the trust settings of CAs on iOS 7 devices?
Where did the configuration profile with the CA go (I know that's a little weird to ask here) and why is the CA still active?
Why are internal Https pages still trusted even if there is no configuration profile for that?
This absolutely puzzles me! I always thought that for a custom CA to be active on a iOS device a configuration profile was required to be present. But that does not seem to be the case.
Thanks for your help!The workaround seems to be the following:
Go to the iPhone Configuration Utility
Install the profile (again)
Go to your iPhone and deinstall the profile that was just installed in Settings > General > Profiles
Certificates signed by that authority are not trusted anymore.
I consider this to be a major security problem in iOS if there is a way that profiles enable CAs and then get lost sometime later (maybe through an iOS upgrade?). -
Hello,
I am a new IT Manager at this company and need assistance big time. Their environment looks as follows:
Server 1. Domain Controller Server (Windows Server 2008 R2 Standard) running active directory.
Server 2. Email Server (Windows Server 2008 R2 Standard) running Exchange Server 2010 .
* Note. No back ups to work with aside from whats mentioned below.
DC had a virus infection causing a lot of issues on the shared network drives 2 days ago locking up all the files with a crypto ransom virus. Running Avast suppressed the infection. Had to recover the file shares which luckily had a back up.
The issue is that the Exchange Server 2 post this lost connectivity with the AD Server 1. Exchange Server 2 when launching EMC could not launch the console stating the following:
"No Exchange servers are available in any Active Directory sites. You can’t connect to remote
Powershell on a computer that only has the Management Tools role installed."
Shortly after I found that it is possible the EMC launcher was corrupt and needed to be reinstalled following another blog post. I deleted the exchange management console.msc per instructions only to discover I couldnt relaunch it because there was
no way how. So I copied another msc file that happened to be on the DC Server 1 back to Exchange Server 2 and got it to launch again.
Another post said that it might be an issue with the Domain Account for the Computer, so to delete it in the AD Server 1 only to find that rejoining it from Exchange Server 2 using Computer>Properties> Chage Settings > Change is greyed out because
it is using the Certificate Authority Service.
I tried manually re-adding the computer in AD and modeling permissions after another server in group settings but no go. After this I was unable to login to the Exchange Server 2 with domain accounts but only local admin, receiving the following Alert:
"The Trust Relationship between this workstation and primary domain failed."
I tried running the Power Shell tools on Exchange Server 2 to rejoing and to reset passwords for domain accounts as noted in some other blogs but no luck as the Server 2 could not make the connection with Server1 or other errors it kept spitting out.
I also during the investigation found the DNS settings were all altered on both the Server 1 and Server 2 which I luckily was able to change back to original because of inventorying it in the beginning when I started.
I need help figuring out if I need to rejoin the Exchange Server 2 manually by disabling the Certificate Authority Service (or removing the CA as listed here:
https://social.technet.microsoft.com/Forums/exchange/en-US/fb23deab-0a12-410d-946c-517d5aea7fae/windows-server-2008-r2-with-certificate-authority-service-to-rejoin-domain?forum=winserversecurity
and getting exchange server to launch again. (Mind you I am relatively fresh to server managing) Please help E-Mail has been down for a whole day now!
MartyI recommend that you open a ticket with Microsoft Support before you break things more.
Ed Crowley MVP "There are seldom good technological solutions to behavioral problems." -
SSL certificates and/ or Oracle Certificate Authority
Our Oracle infrastructure is as follows:
1.Database server
(a)Oracle 9i R2 database
(b) Oracle ApEx 2.2
2. Infrastructure server
(a) Oracle 10g (9.0.4.x.x) Infrastructure
(b) OID - configured as external authentication to Microsoft 2003 Active Directory LDAP version 3
(c) SSO - configured as Windows Native authentication
3. Application server
(a)Oracle 10g (9.0.4.x.x) Forms and reports server
Network traffic currently is not encrypted. All we need is to ensure that network traffic is encrypted between the the end-user PC and all servers (database or app server)
I was reading through Oracle Certificate Authority and Secure Sockets Layer.
1. Is there a difference between the two products?
2. Which product would be best to ensure the encryption (authentication is provided through MS LDAP)
Thanks,
MayuraCertificate authority and SSL are two completely different concepts. They can be related but are by no means similar.
SSL is a service or a feature, not a product. SSL is used to encrypt the traffic. Part of SSL is the use of certificates for authentication. A server or user would pass a certificate as part of an SSL transmission.
The certificates used for enrypted transmission(SSL), can be obtained from the Oracle Certificate Authority(OCA), or by a third party certificate authority. OCA is not required to use SSL.
To achieve a fully encrypted envrinment, you would need to use SSL at several layers. This would be done with or without the use of the Oracle certificate authority.
1. From the web browser to the middle tier
2. End user to database
3. from the middle tier to OID
4. from the middle tier to the database
5. From OID to active directory -
How to create certificate authority and configure it for IIS
Hi
I Install ADCS role in Server 2012 and configure it. but when i go to IIS and want to create domain certification , the select button is grey .i think i couldn't configure certificate authority correctly. how can fix this problem.
Whenever you see a helpful reply, click on Vote As Helpful & click on
Mark As Answer if a post answers your question.
LinkedIn:
Facebook:Thanks my problem was solved.
But there is a problem after install IIS and ADCS , i restarted both server but didn't work ,but now(6 hours after restart) it work fine.
another Question is after i select appropriate certificate authority ,when i click on finish it gives me the following error
"the certificate request was submitted to the online authority but was not issued the request was denied"
Whenever you see a helpful reply, click on Vote As Helpful & click on
Mark As Answer if a post answers your question.
LinkedIn:
Facebook: -
Certificate Authority Windows 2008 to 2012 R2 - Clean up and Migration
Hello,
I'm currently dealing with the following scenario:
1. I've inherited the current infrastructure setup and the plan is to clean things up and setup a new certificate infrastructure using Windows 2012 R2.
2. The current setup:
a. Domain Controller, Windows 2008 R2, is/was a Certificate Authority. It hasn't issued any new certificates (based on the information in Certificate Effective Date) for quite some time. It also has an expired certificate for
itself - issued by the domain's issuing CA - and attempts to renew it via MMC give a "Server execution failed" and STATUS: Failed when looking in Certificate enrollment for Domain Controller. We'll call the server, DC1.
b. Certificate Authority Server, we'll call it CERT1. When booting up the machine and/or attempting to restart certificate services on the server, the following errors are in the event log:
EVENT 7024: Description: The Active Directory Certificate Services service terminated with service-specific error %%-2146885613.
EVENT 100: Active Directory Certificate Services did not start: Could not load or verify the current CA certificate. Domainlocal Issuing CA The revocation function was unable to check revocation because the revocation server was offline. 0x80092013
(-2146885613).
EVENT 48: Description: Revocation status for a certificate in the chain for CA certificate 0 for Domain.local Issuing CA could not be verified because a server is currently unavailable. The revocation function was unable to check revocation because
the revocation server was offline. 0x80092013 (-2146885613).
Note: The server's computer certificate has expired and it was issued by the Domain Controller mentioned in point A. Attempts to renew it fail.
(The issue on CERT1 is like the one mentioned in this article: https://support.microsoft.com/kb/825061?wa=wsignin1.0 however an upgrade wasn't done and it's not old versions of Windows.)
c. There is a certificate authority machine - part of what was created for a PKI infrastructure - that was kept shutdown. I've powered it up and the machine is not part of the domain.
Any thoughts or feedback on easily repairing the current situation so that I can upgrade everything to a new Windows 2012 R2 Certificate infrastructure would be appreciated.
Thanks!Hi Vadims,
Basically using certificates in the following manner:
1. User / Computer enrollment in the AD domain.
2. Any hardware / web services (internal) that need a certificates. This is usually hardware that has some form of GUI that is accessed via URL, printers accessed via URL and/or that communicate via LDAP to AD, internal UC (Lync is an example), that
sort of thing.
A number of machines currently show certificate errors (ie.. certificate has expired) however that hasn't stopped things from working just functioning differently. I'm going already on the assumption that if I remove the entire CA
infrastructure and re-install a new one and have everything point to that new CA server that I should be ok but I'm not 100% certain hence why I asked on this forum.
Also, you're correct is that there is one more CA. That CA was the server that was turned off/offline that I powered on. It is not part of the AD domain that the domain controller and the other CA belong to. (It is standalone.) I'm
currently patching the standalone CA since it's been off for what looks like almost 1.5 years. -
Webaccess and External Certificate Authority
Hi.
We are currently running an OES Netware 6.5 server, sp8 with Groupwise and WebAccess 8, sp1 I believe. Webaccess is currently using a self-signed certificate and I want to purchase and switch this over to an external CA such as Digicert.
I have read through the digicert pages about creating a CSR file and then installing the new certificate into the tree and think I follow it fairly well.
Currently, with our self signed certificate, my users have always gotten a warning in internet explorer which they have simply bypassed. The warning lists two problems, the certificate is from an untrusted authority, which the new certificate should fix, and the name in the certificate does not match the website or something like that.
I would like to eliminate the "name in the certificate does not match the website" error. When I create the CSR do I need
This is the step that I am unsure about. I am thinking the second warning occurs because the certificate was created using an IP address instead of the website address.
Scott Schaffer
Network Admin
Olive Waller Zinkhan & Waller LLPScott,
It appears that in the past few days you have not received a response to your
posting. That concerns us, and has triggered this automated reply.
Has your problem been resolved? If not, you might try one of the following options:
- Visit http://support.novell.com and search the knowledgebase and/or check all
the other self support options and support programs available.
- You could also try posting your message again. Make sure it is posted in the
correct newsgroup. (http://forums.novell.com)
Be sure to read the forum FAQ about what to expect in the way of responses:
http://forums.novell.com/faq.php
If this is a reply to a duplicate posting, please ignore and accept our apologies
and rest assured we will issue a stern reprimand to our posting bot.
Good luck!
Your Novell Product Support Forums Team
http://forums.novell.com/ -
Mail and SMTP server settings of ASA Certificate Authority for cisco anyconnect VPN
Dear All,
i have the folloing case :
i am using ASA as Certificate authority for cisco anyconnect VPN users,the authentication happens based on the local database of the ASA,
i want to issue a new certificate every 72 hours for the users ,and i want to send the one time password via email to each user.
so what the setting of the mail and smtp server should be ,
was i understand i should put my smtp server ip address then i have to create the local users again under(Remte VPN VPN--Certificate management--Local certificate authority --Manage user Database) along with their email addresses to send the one time passsword to them via their emails.
i sent the email manually ,hwo can automate sending the OTP to our VPN users automatically vi their emails?
Best regards,Thanks Jennifer.
I did manage to configure LDAP attribute map to the specific group policy.
Nevertheless, I was thinking whether I can have fixed IP address tied to individual user.
Using legacy Cisco VPN Client, I can do it using IPSEC(IKEv1) Connection profile, where I set Pre-Shared Key and Client Address Pools. Each Client Address Pools has only 1 fix IP address.
Example: let say my username is LLH.
Connection Profile for me is : LLH-Connection-Profile, my profile is protected by preshared key.
Client Address Pool for me is : LLH-pool, and the IP is 172.16.1.11
Only me know the preshared key and only me can login with my Connection Profile.
Using AnyConnect, I have problem. User can use any connection profile because I cannot set preshared key for AnyConnect. In that case, I cannot control who can use my Connection Profile and pretend to be me.
Example:
AnyConnect Connection Profile for me is : LLH-Connection-Profile, without any password
Client Address Pool for me is : LLH-pool, IP is 172.16.1.11
Any body can use LLH-Connection-Profile, login with another user name, let say user-abc which is a valid user in LDAP server. In that case, ASA assign 172.16.1.11 to user-abc and this user-abc can access server which only allow my IP to access.
I hope above description can paint the scenario clearer.
Thanks in advance for all the help and comment given. -
UCS Manager and using Microsoft Certificate Authority
Has anybody gone through the process of setting up UCS Manager with a certificate issued from a Microsoft Certificate Authority? If so I would appreciate some assistance. I was able to successfully create a request and have generated the certificate, but I see no way of being able to put the request and the certificate chain back into UCS Manager.
First you have to create a trusted point (under the Admin Tab -> Key Management). In the new trusted point, paste the public cert in base64 format of your root certificate authority. If you have a subordinate CA that's issuing then add that CA's cert too. If you have a whole tree of CAs, then you need to create a trusted point with all the CAs in the chain from the issueing CA up to the root. Paste one cert after the other, in order, up the chain, all in the same trusted point. If they're not in the right order or if you're missing the root, then the TP won't accept the cert.
Once you have a trusted point you can accept the certificate you generated. In the KeyRing you used to generate the request, choose the new Trusted Point, and paste the new certificate in Base64 format into the Certificate field.
Once that's done, you can go to Communication Management -> Communication Services, and for the HTTPS protocol, choose the new Key Ring. It might not take effect immediately, but after a few minutes your UCSM web site should start responding with the new certificate.
I hope that helps.
Note: There's a bug in UCS currently issue number CSCth62582. If your fabric interconnects fail over, the SSL cert will revert to the default self signed cert. You have to go back into Communication services and set it to default, save, then set it back to the new Key Ring. -
Certificate authority and certificate.
Hi everybody
Please consider the following example:
R1------------------------CA---------------------------R2
We want R1 to get the certificate from Ca so R1 can use it to authenticate itself to R2. Similarly R2 wants to get its own certificate so it can authenticate itself to R1.
Both routers are configured to trust CA.
Before CA can issue certificates to R1 and R2 which they can use to authenticate each other, CA sends its own certificate which has its own (CA) public key, and CA signature. The video lecture I was watching says CA creates this signature , encrypts its own private key and attaches it to the certificate.
When R1 receives this certificate, R1 uses CA's public key to decrypt it.
In order for R1 to prove that certificate did come from CA not some impostor, It should know what was the signature before it was encrypted by CA using its private key and sending it to R1 ,so when R1 receives it and decrypts it with CA's public key it will be to compare and thus can be sure Certificate came from legit CA.
The question is how does R1 know the signature prior to receiving certificate from CA?
Thanks and have a great day.A certificate signature is created by applying a hash algorithm over the certificate contents , then encrypting the resulted hash. so for R1 to know and verify the signature, it computes the hash of the received certificate (by a hash algorithm mentioned in the cert) , decrypt the signature, then compares both computed hash and decrypted signature which must be equal.
Hope this helps.
Regards.
Mashal Alshboul -
How do I set up my own certificate authority
I tried google on the above question, and the most recent thing I found was 7 years old. replacing the phrase used generates a lot of hits with a very poor signal to noise ratio.
I have OpenSSL (in the cygwin distribution), which is quite recent, but frankly its documentation leaves just about everything to be desired. I found pyca, but it has no documentation at all (and it is a couple years old).
I tried the steps appended below, but invariably the attempt to sign the certificates fails with an obscure error message about OpenSSL not finding one thing or another.
At this stage, I just don't care whether I do this using something in the J2SDK such as keytool or OpenSSL, as long as I can get it done. Or if there is some other opensource software tool I can use, terrific. This is primarily for the purpose of securing communications within an Intranet, and secondarily for signing applets and applications distributed through WebStart. If I am not mistaken, I'll need a certificate for each of my servers. Right?
If you know of an URL where this is well explained and illustrated, great. Give that to me.
Otherwise, a simple illustration (or a correction of what I've appended below) would be appreciated. I believe I understand what ought to be happening. It ought to be rather simple to do, but there are these irritating and frustrating minor details getting in the way. For example, the steps I show below seem simple, but everything appears to get messed up by some of the contents of openssl.cnf in 'usr/ssl', in the cygwin directory, and there is no explanation of how to set things up for the first time you use OpenSSL within Cygwin (or on unix for that matter).
Any assistance would be appreciated.
Thanks,
Ted
========failed attempt=====================
# Generation of Certificate Authority(CA)
openssl req -new -x509 -keyout cakey.pem -out cacert.pem -config /usr/ssl/openssl.cnf
# Create server request and key
openssl req -new -keyout server-key.pem -out server-req.pem -days 36502 -config /usr/ssl/openssl.cnf
# Remove the passphrase from the key
openssl rsa -in server-key.pem -out server-key.pem
# Sign server cert
openssl ca -policy policy_anything -out server-cert.pem -infiles server-req.pem -config /usr/ssl/openssl.cnf
# Create client request and key
openssl req -new -keyout client-key.pem -out client-req.pem -days 36502 -config /usr/ssl/openssl.cnf
# Remove a passphrase from the key
openssl rsa -in client-key.pem -out client-key.pem
# Sign client cert
openssl ca -policy policy_anything -out client-cert.pem -infiles client-req.pem -config /usr/ssl/openssl.cnfThe following works for me:
NB: Some of the output has been removed in the interests of privacy (this will not affect the outcome)
1. Create CA key and certificate
1.1 Create a new file called "serial" containing the value "01".
1.2 Create an empty file "index.txt"
1.3 Create a subdirectory "newcerts"
1.4 Execute.... create a key for your CA
[ben@localhost ca]$ openssl genrsa -out ca.key 2048
Generating RSA private key, 2048 bit long modulus
.....................................+++
..........................................................+++
e is 65537 (0x10001)
1.5 Execute... create a certificate for your own CA
[ben@localhost ca]$ openssl req -config ./openssl.cnf -new -x509 -key ca.key -out cacert.pem -days 365
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
Country Name (2 letter code) [GB]:
County or State (full name) []:
City or town (eg, Hitchin) []:
Organization Name (eg, company) []:
Organizational Unit Name (eg, section) []:
Common Name (eg, your name or your server's hostname) []:
Email Address []:
2. Create PK key and .csr
2.1 Execute...
[ben@localhost ca]$ keytool -genkey -alias PK
Enter keystore password: password
What is your first and last name?
[Unknown]:
What is the name of your organizational unit?
[Unknown]:
What is the name of your organization?
[Unknown]:
What is the name of your City or Locality?
[Unknown]:
What is the name of your State or Province?
[Unknown]:
What is the two-letter country code for this unit?
[Unknown]:
Is CN=, OU=, O=, L=, ST=, C=GB correct?
[no]: yes
Enter key password for <PK>
(RETURN if same as keystore password):
2.2 Create .csr
[ben@localhost ca]$ keytool -certreq -alias PK -file PK.csr
Enter keystore password: password
3. Sign PK with CA cert
[ben@localhost ca]$ openssl ca -config ./openssl.cnf -in PK.csr -out PK.pem -keyfile ca.key -days 365
Using configuration from ./openssl.cnf
Check that the request matches the signature
Signature ok
Certificate Details:
Serial Number: 0 (0x0)
Validity
Not Before: Jan 5 19:48:33 2006 GMT
Not After : Jan 5 19:48:33 2007 GMT
Subject:
countryName = GB
stateOrProvinceName =
organizationName =
organizationalUnitName =
commonName =
X509v3 extensions:
X509v3 Basic Constraints:
CA:FALSE
Netscape Comment:
OpenSSL Generated Certificate
X509v3 Subject Key Identifier:
D6:2D:7E:71:77:9E:1A:BB:54:69:98:63:6A:6A:E2:BA:12:C4:D7:DD
X509v3 Authority Key Identifier:
keyid:92:7C:33:7C:EC:1D:76:C5:B8:F0:30:6D:10:12:40:E5:E7:EA:24:31
DirName:/C=GB/ST=/L=/O=/OU=/CN=/emailAddress=
serial:F0:D1:38:36:65:6D:71:D5
Certificate is to be certified until Jan 5 19:48:33 2007 GMT (365 days)
Sign the certificate? [y/n]:y
1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated
4. Convert PK certificate into DER format
[ben@localhost ca]$ openssl x509 -in PK.pem -out PK.der -outform DER
5. Import CA certificate into keystores
[ben@localhost ca]$ keytool -import -alias ca -file cacert.pem
Enter keystore password: password
Owner: EMAILADDRESS=, CN=, OU=, O=, L=, ST=, C=GB
Issuer: EMAILADDRESS=, CN=, OU=, O=, L=, ST=, C=GB
Serial number: f0d13836656d71d5
Valid from: Thu Jan 05 19:41:09 GMT 2006 until: Fri Jan 05 19:41:09 GMT 2007
Certificate fingerprints:
MD5: AF:3D:8E:25:12:24:04:1F:40:70:BC:A0:9E:0E:44:84
SHA1: B8:E8:0B:A5:86:33:21:0C:B5:3C:6E:F2:DE:7B:31:0F:59:AE:21:E4
Trust this certificate? [no]: yes
Certificate was added to keystore
6. Import signed PK into keystore
[ben@localhost ca]$ keytool -import -alias pk -file PK.der
Enter keystore password: password
Certificate reply was installed in keystore
REF:
http://www.yorku.ca/dkha/docs/jsse_cert/jsse_cert.htm
http://httpd.apache.org/docs/2.2/ssl/ssl_faq.html#ownca
http://www.openssl.org/docs/apps/ca.html#
openssl.cnf:#
# OpenSSL example configuration file.
# This is mostly being used for generation of certificate requests.
# This definition stops the following lines choking if HOME isn't
# defined.
HOME = .
RANDFILE = $ENV::HOME/.rnd
# Extra OBJECT IDENTIFIER info:
#oid_file = $ENV::HOME/.oid
oid_section = new_oids
# To use this configuration file with the "-extfile" option of the
# "openssl x509" utility, name here the section containing the
# X.509v3 extensions to use:
# extensions =
# (Alternatively, use a configuration file that has only
# X.509v3 extensions in its main [= default] section.)
[ new_oids ]
# We can add new OIDs in here for use by 'ca' and 'req'.
# Add a simple OID like this:
# testoid1=1.2.3.4
# Or use config file substitution like this:
# testoid2=${testoid1}.5.6
[ ca ]
default_ca = CA_default # The default ca section
[ CA_default ]
dir = . # Where everything is kept
certs = $dir/certs # Where the issued certs are kept
crl_dir = $dir/crl # Where the issued crl are kept
database = $dir/index.txt # database index file.
#unique_subject = no # Set to 'no' to allow creation of
# several ctificates with same subject.
new_certs_dir = $dir/newcerts # default place for new certs.
certificate = $dir/cacert.pem # The CA certificate
serial = $dir/serial # The current serial number
#crlnumber = $dir/crlnumber # the current crl number must be
# commented out to leave a V1 CRL
crl = $dir/crl.pem # The current CRL
private_key = $dir/private/cakey.pem# The private key
RANDFILE = $dir/private/.rand # private random number file
x509_extensions = usr_cert # The extentions to add to the cert
# Comment out the following two lines for the "traditional"
# (and highly broken) format.
name_opt = ca_default # Subject Name options
cert_opt = ca_default # Certificate field options
# Extension copying option: use with caution.
# copy_extensions = copy
# Extensions to add to a CRL. Note: Netscape communicator chokes on V2 CRLs
# so this is commented out by default to leave a V1 CRL.
# crlnumber must also be commented out to leave a V1 CRL.
# crl_extensions = crl_ext
default_days = 365 # how long to certify for
default_crl_days= 30 # how long before next CRL
default_md = md5 # which md to use.
preserve = no # keep passed DN ordering
# A few difference way of specifying how similar the request should look
# For type CA, the listed attributes must be the same, and the optional
# and supplied fields are just that :-)
policy = policy_match
# For the CA policy
[ policy_match ]
countryName = match
stateOrProvinceName = match
organizationName = match
organizationalUnitName = optional
commonName = supplied
emailAddress = optional
# For the 'anything' policy
# At this point in time, you must list all acceptable 'object'
# types.
[ policy_anything ]
countryName = optional
stateOrProvinceName = optional
localityName = optional
organizationName = optional
organizationalUnitName = optional
commonName = supplied
emailAddress = optional
[ req ]
default_bits = 1024
default_keyfile = privkey.pem
distinguished_name = req_distinguished_name
attributes = req_attributes
x509_extensions = v3_ca # The extentions to add to the self signed cert
# Passwords for private keys if not present they will be prompted for
# input_password = secret
# output_password = secret
# This sets a mask for permitted string types. There are several options.
# default: PrintableString, T61String, BMPString.
# pkix : PrintableString, BMPString.
# utf8only: only UTF8Strings.
# nombstr : PrintableString, T61String (no BMPStrings or UTF8Strings).
# MASK:XXXX a literal mask value.
# WARNING: current versions of Netscape crash on BMPStrings or UTF8Strings
# so use this option with caution!
# we use PrintableString+UTF8String mask so if pure ASCII texts are used
# the resulting certificates are compatible with Netscape
string_mask = MASK:0x2002
# req_extensions = v3_req # The extensions to add to a certificate request
[ req_distinguished_name ]
countryName = Country Name (2 letter code)
countryName_default = GB
countryName_min = 2
countryName_max = 2
stateOrProvinceName = County or State (full name)
stateOrProvinceName_default =
localityName = City or town (eg, Hitchin)
localityName_default =
0.organizationName = Organization Name (eg, company)
0.organizationName_default =
# we can do this but it is not needed normally :-)
#1.organizationName = Second Organization Name (eg, company)
#1.organizationName_default = World Wide Web Pty Ltd
organizationalUnitName = Organizational Unit Name (eg, section)
organizationalUnitName_default =
commonName = Common Name (eg, your name or your server\'s hostname)
commonName_max = 64
emailAddress = Email Address
emailAddress_max = 64
# SET-ex3 = SET extension number 3
[ req_attributes ]
challengePassword = A challenge password
challengePassword_min = 4
challengePassword_max = 20
unstructuredName = An optional company name
[ usr_cert ]
# These extensions are added when 'ca' signs a request.
# This goes against PKIX guidelines but some CAs do it and some software
# requires this to avoid interpreting an end user certificate as a CA.
basicConstraints=CA:FALSE
# Here are some examples of the usage of nsCertType. If it is omitted
# the certificate can be used for anything *except* object signing.
# This is OK for an SSL server.
# nsCertType = server
# For an object signing certificate this would be used.
# nsCertType = objsign
# For normal client use this is typical
# nsCertType = client, email
# and for everything including object signing:
# nsCertType = client, email, objsign
# This is typical in keyUsage for a client certificate.
# keyUsage = nonRepudiation, digitalSignature, keyEncipherment
# This will be displayed in Netscape's comment listbox.
nsComment = "OpenSSL Generated Certificate"
# PKIX recommendations harmless if included in all certificates.
subjectKeyIdentifier=hash
authorityKeyIdentifier=keyid,issuer:always
# This stuff is for subjectAltName and issuerAltname.
# Import the email address.
# subjectAltName=email:copy
# An alternative to produce certificates that aren't
# deprecated according to PKIX.
# subjectAltName=email:move
# Copy subject details
# issuerAltName=issuer:copy
#nsCaRevocationUrl = http://www.domain.dom/ca-crl.pem
#nsBaseUrl
#nsRevocationUrl
#nsRenewalUrl
#nsCaPolicyUrl
#nsSslServerName
[ v3_req ]
# Extensions to add to a certificate request
basicConstraints = CA:FALSE
keyUsage = nonRepudiation, digitalSignature, keyEncipherment
[ v3_ca ]
# Extensions for a typical CA
# PKIX recommendation.
subjectKeyIdentifier=hash
authorityKeyIdentifier=keyid:always,issuer:always
# This is what PKIX recommends but some broken software chokes on critical
# extensions.
#basicConstraints = critical,CA:true
# So we do this instead.
basicConstraints = CA:true
# Key usage: this is typical for a CA certificate. However since it will
# prevent it being used as an test self-signed certificate it is best
# left out by default.
# keyUsage = cRLSign, keyCertSign
# Some might want this also
# nsCertType = sslCA, emailCA
# Include email address in subject alt name: another PKIX recommendation
# subjectAltName=email:copy
# Copy issuer details
# issuerAltName=issuer:copy
# DER hex encoding of an extension: beware experts only!
# obj=DER:02:03
# Where 'obj' is a standard or added object
# You can even override a supported extension:
# basicConstraints= critical, DER:30:03:01:01:FF
[ crl_ext ]
# CRL extensions.
# Only issuerAltName and authorityKeyIdentifier make any sense in a CRL.
# issuerAltName=issuer:copy
authorityKeyIdentifier=keyid:always,issuer:always -
Certificate Authority is not being seen by windows server 2003 machines
Good Afternoon,
We recently installed a certificate authority using windows server 2008 r2. There was an old certificate authority that had went bad and the role could not be uninstalled on the bad server. The new certificate authority works with windows 2008 machines but
does not work with server 2003 machines. Mainly trying to get the domain controller certificate. At first it was stating that the rpc was unavailable for the CA. I tried to delete the remnants under the sites and services role of the old server. The error
now it states that it can not find a certificate authority. As stated above the newer machines (Server 2008) can see the certificate authority and request certificates but older machines cant. Any assistance on what to do next will be greatly appreciated.
Attached is the error I receive when trying to request a certificate through the CA mmc.
dmgIt is possible to change the hash algorithm a CA uses to support XP and 2003 "out of the box" without the hotfix.
But it would be better to have two CAs in parallel - one using a more modern algorithm and a CA supporting a "legacy" algorithm - and the latter should only be used as long as there are clients that aren't able to validate the other algorithms.
On the CA, start regedit and locate the following registry key:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\CertSvc\Configuration\<Your CA>\CSP
I am assuming that the Software CNG provider is used with SHA256 or higher (not with SHA1).
Change CNGHashAlgorithm to SHA1 and restart the CA service.
The setting can be reverted by changing the value back. All certificates and all CRLs signed by this CA will use the new hash algorithm after the restart. -
Untrusted server cert chain & does not recognize the certificate authority
I have java code that makes an ssl connection to an HTTPS server.
The code workes fine when I connect to a server that has a
certificate that was issued by a recognizable authority.
But when I try to connect to our test HTTPS server which has a
certificate that was created by ourselves for debug, I get this
java exception: "untrusted server cert chain".
When I connect to our test HTTPS server with a browser, I get
this message from the browser in a popup window:
"www.xyz.com is a web site that uses a security certifcate to
identify itself. However netscape 6 does not recognize the
certificate authority that issued this certificate."
At this point I am able to accept the certificate in the popup
window and continue.
Question: In my java code how can I accept a certificate
that was signed by an unrecognizable authority just like the
browser can. Or during debug, how can I set an override
to accept ALL certs no matter what.
Thanks.....PaulYou will have to import your server test certificate into your client machine keystore. By default the keystore will be the 'cacerts' file in JAVA_HOME/jre/lib/security, get your server certificate in .pem format and use keytool to import it to the client.
keytool -import -alias <anything> -file <full path of .pem file> -keystore <full path of cacerts file>
The keystore password is 'changeit' by default, keytool comes with the JDK.
The reasoning behind this is to prevent the misuse of test certificates, the client has to consciously import an untrusted certificate. When you install a real certificate on your server the client will be automatically validated if bought from a trusted CA (Thawte, Verisign).
Take a look at the java.security.KeyStore class, you can use it to view your certificate chain.
Ronny.
Maybe you are looking for
-
HT1657 What happens if my movie rental has a download error
I recently attempted to rent a movie from itunes and the error message i received was that therer was an error with the download. If I delete the download and try again, I have to re-rent it. I did and I keep getting the error becausse it still shows
-
In addition to the FormsCentral subscription charge ($152.87 including tax) I was billed about the same time for $15.93. I can't find any way to get in touch with anyone from Adobe. The phone number I'm supposed to call is cut off on my invoice. Can
-
Updating several pages in one transaction?
Sometimes a site update can involve 2 (or many more) updates to a site. In that case, it would be best to be able to edit several pages individually and then publish all of them at once (and, of course, all of their accompanying files). Can this be d
-
Trying to import MP4 to iMovie
Alright, so I downloaded a video file from the internet, and the format is apparently MP4. But when I import it to iMovie, it doesn't show up in the event viewer. The event will be created for it, but there's nothing in it. I checked the folder in my
-
JQUERY integration within APEX
Hi everybody and merry chrismas... I have a problem with jquery within apex. I looked for in previous posts but I can not achieve to make it works... I am running apex 3.2.1 on linux with apex listener. I want to refresh a report and I found that it