Certificate export

Hi,
I want to provide certificate to partner without private key.I am trying to export the certificate, but not sure how to proceed.
From where should I export the certificate? I have opened the mmc but not sure where to check -- In Local Computer/Personal/Certificate OR Current User/Personal/Certificate.
I can see some certificates in Local Computer/Personal/Certificate but I dont see any in Current User/Personal/Certificate.
Can someone please guide me to export the certificcate?
Thanks, Girish R. Patil.

Hi Girish,
When you send the message, you would create both the private and public key. Then you would share the public key to client which would be used by them to decrypt the received message. You
generally install your private key in Current User/Personal/Certificate. If you were to use the public key shared to you by the client, then you would install it in the Local Computer/Other People/Certificate store. I don't think the referenced article mentions
about "Local Computer/Personal/Certificate". In the referenced article check the section "How to export ONLY the public key from a certificate"
When installing the private key, you should have logged in as your service account (account used by your host instance) and install it in the Current User/Personal/Certificate.
If you use the same account in your host instance as your logged account, then private key should have been installed in Local Computer/Personal/Certificate.
If this answers your question please mark it accordingly. If this post is helpful, please vote as helpful by clicking the upward arrow mark next to my reply.

Similar Messages

SSL Certificate Export Password

Hi ,
I am trying to export certificate and Key from CSS, Unforunately i do not have password from them.
Is their anyway to recover password or can i export keys and certificate without password.
Thanks in Advance
Aniruddha

I think the only way to export the key is to use the password issues when importing the key. The SSL Certificate and Key are stored in DES encryption. There is no way to get the key without the password for the certificate and key except to break DES or guess the password.

ISE certificate export problem (stops ISE App Server process?)

I am trying to export certs for backup on a distributed ISE deployment.On every box of every type of node when I attempt a backup with or without the private key, nothing happens, but the GUI stops. After checking the "sh app status ise" on the CLI I notice that it now says "ISE Application Server process is not running." After a few minutes the process starts again by itself and the GUI starts working by I dont recive any cert export.
Anybody got any ideas?
thanks
Nick

Hi Jatin,
I did an upgrade of a distributed deployment today. After a deregister of the first admin/monitoring node I was able to export the certificate including the keys for this machine. Hower this didn't work for the PSN nodes in standalone mode. Also after the upgrade to version 1.1.4 - patch 1, trying to export the identity certificate with the keys included causes a stop/start of the ISE application. It doesn't matter if the units are in standalone mode or added to the deployment. The only difference is that the PSN nodes run as a VM wereas the pap/mnt nodes are 3395 appliances.
Sent from Cisco Technical Support iPhone App

ACS Server certificate export

Hello,
We are in the process of renewing a certificate for our ACS server (v3.2). Is there a way to export the certificate currently in use?
We don't want to lose it if we install a certificate that does not work. We are also exploring using a self-signed certificate, but we're not sure if that will meet our needs.
Thanks!

Thanks for the info...unfortunately, we tried doing the self-signed certificate, but clients couldn't connect to our wireless network (we use that to authenticate wireless users). We then tried to do a restore from a backup taken earlier this morning and it's still trying to restore - as if something is hung and won't shut down.
This is ACS 3.2 running on a Windows 2003 server.

SCUP 2011 Verisign Certificate Export Issue

Hi folks,
I'm trying to export a Verisign .pfx certificate to my SCUP 2011 Install however after exporting it doesn't ask for the password.
And when I exit out of the settings page, I don't see the corresponding CN mentioned next time when I open the settings page.
There's nothing I get to see in the SCUP.log file as well.
Can anyone assist or point towards the cause.
Certificate Details--
Issued to-- Orgname
Intended Purpose EKU-- Code-Signing
Public Key-- 2048

Hello,
This blog discussed how to install SCUP with silf-signed certificate
http://gerryhampsoncm.blogspot.com/2013/04/sccm-2012-sp1-step-by-step-guide-part_27.html
Please Note: Since the web site is not hosted by Microsoft, the link may change without notice. Microsoft does not guarantee the accuracy of this information.
Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact [email protected]

Is it possible to use certutil to export multiple certificates from a local client machine store, to a .p7b file?

Is it possible to use certutil to export multiple certificates from a local client machine store, to a .p7b file?
Scenario: We have a few legacy certificates based on some legacy templates (2012 R2). Some belong to an old SubCA (2008 R2).
I’ve can manually export them using certmgr mmc on the local machine to a single .p7b e.g.
cert_backupNEW.p7b. But this is not a practical solution for me and I want to achieve this remotely via certutil or some other util that comes with Windows 7 machines.
I’ve already worked out how to run a certutil command to add the certs back into the store e.g.
certutil.exe -addstore -f my cert_backupNEW.p7b
Is there a way to export multiple certs to a single backup cert, or is what I’m trying to do not possible with multiple certs?
TC

Something like this:
$store = New-Object Security.Cryptography.X509Certificates.X509Store "my","localmachine"
$store.Open("ReadOnly")
Set-Content -Path exportedcerts.pfx -Value $store.Certificates.Export("pfx","password")
$store.Close()
note that this command will fail, if there are certificates with non-exportable keys. You cannot export certificates with non-exportable keys.
My weblog: en-us.sysadmins.lv
PowerShell PKI Module: pspki.codeplex.com
PowerShell Cmdlet Help Editor pscmdlethelpeditor.codeplex.com
Check out new: SSL Certificate Verifier
Check out new:
PowerShell FCIV tool.

Error in Export the ABAP certificate

Dear gurus:
I am executing the template to connect BW with Portal. The proble is this:
BI_00_This wizard will execute Postinstall steps of technical configuration of BI-Java > Export the ABAP Certificate
Export the ABAP Certificate
Description
No specified detailed description
State
START_ACTION
Support Information
Type of Action
InvokeServiceDebug Events
InvokeService:Export the ABAP Certificate
Library: sap.com/tclmctctemplateslevel1_4_tcc
SourcePath ./0. Complete BI PostInstallation/exportCertificate15
Time 2008/05/12 at 17:34:46
WSDL /content/NetWeaver/BI-Java/service/AbapRfcCall_exportCertificate_exportCertificate.wsdl
InvokeService- Result: Failed
Exception Message:SSFC_GET_OWNCERTIFICATE_FAILED
Exception Class:com.sap.mw.jco.JCO$AbapException
Stacktrace
com.sap.mw.jco.JCO$Client.execute(JCO.java:3429)
com.sap.ctc.util.AbapRfcCall.exportCertificate(AbapRfcCall.java:770)
sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
java.lang.reflect.Method.invoke(Method.java:324)
com.sap.tc.lm.ctc.provider.javaServiceProvider.JavaMethodExecuter.invoke(JavaMethodExecuter.java:227)
com.sap.tc.lm.ctc.provider.javaServiceProvider.JavaServiceExecuter.executeService(JavaServiceExecuter.java:94)
com.sap.tc.lm.ctc.cul.broker.BrokerServiceExecuter.executeService(BrokerServiceExecuter.java:55)
com.sap.tc.lm.ctc.cul.serviceimpl.executor.CULServiceExecutor.executeService(CULServiceExecutor.java:52)
com.sap.tc.lm.ctc.cul.serviceimpl.process.InvokeServiceControllerDefault.execute(InvokeServiceControllerDefault.java:145)
com.sap.tc.lm.ctc.metamodel.process.controller.ProcessControllerImpl.execute(ProcessControllerImpl.java:206)
com.sap.tc.lm.ctc.metamodel.process.controller.ProcessExecuter.run(ProcessExecuter.java:141)
java.lang.Thread.run(Thread.java:534)
Messages at cancel time
Messages at exception time
<exportCertificateInput> <PATH>.</PATH> <FILE>BWI_abap_certificate.crt</FILE> <ABAP_CLIENT>300</ABAP_CLIENT> <ABAP_SYSTEMNUMBER>00</ABAP_SYSTEMNUMBER> <ABAP_HOST>SAPIA64BW</ABAP_HOST> <ABAP_USER>ADMIN</ABAP_USER> <ABAP_PASSWORD>% secure content %</ABAP_PASSWORD> </exportCertificateInput>
global
<root> <TTINSTANCE_ID>01</TTINSTANCE_ID> <SLD_PASSWD>% secure content %</SLD_PASSWD> <TTJAVA_HOME>C:/j2sdk1.4.2_15-x64</TTJAVA_HOME> <TTOS_NAME>ntia64</TTOS_NAME> <TTOS_UNICODE>true</TTOS_UNICODE> <SYSTEM_ID>EPI</SYSTEM_ID> <TTCPU_COUNT>8</TTCPU_COUNT> <SLD_ADMIN>SLDDSUSER</SLD_ADMIN> <TTRDBMS_DRIVER_LOCATION>E:\usr\sap\EPI\JC01\exe\mssjdbc\base.jar;E:\usr\sap\EPI\JC01\exe\mssjdbc\util.jar;E:\usr\sap\EPI\JC01\exe\mssjdbc\sqlserver.jar;E:\usr\sap\EPI\JC01\exe\mssjdbc\spy.jar</TTRDBMS_DRIVER_LOCATION> <BACKEND_SYSNUMBER>01</BACKEND_SYSNUMBER> <P4PORT>50104</P4PORT> <TTDI_PREFIX_NAME>JC</TTDI_PREFIX_NAME> <TTCENTRAL_SERVICES_INSTANCE_ID>02</TTCENTRAL_SERVICES_INSTANCE_ID> <sapjsf.passwd>% secure content %</sapjsf.passwd> <BACKEND_SYSTEM>SAPIA64BW</BACKEND_SYSTEM> <TTUSR_SAP_DIR>J:/usr/sap</TTUSR_SAP_DIR> <J2EE_SYSNUMBER>01</J2EE_SYSNUMBER> <SLD_HOST>sapbw</SLD_HOST> <J2EE_SYSTEM>SAPIA64BW</J2EE_SYSTEM> <MACHINE_TYPE>ntia64</MACHINE_TYPE> <sapjsf.username>SAPJSF</sapjsf.username> <J2EE_PASSWORD>% secure content %</J2EE_PASSWORD> <USAGE>PI-AF</USAGE> <BACKEND_SID>EPI</BACKEND_SID> <TTSYSNAME>EPI</TTSYSNAME> <TTGLOBAL_SAP_SHARE_DIR>
SAPIA64BW/sapmnt/EPI/SYS/global/sapmnt</TTGLOBAL_SAP_SHARE_DIR> <TTR3_ENV_YES_NO>no</TTR3_ENV_YES_NO> <J2EE_SID>EPI</J2EE_SID> <TTAMOUNT_MEMORY>32737</TTAMOUNT_MEMORY> <AVERAGE_CPU_SPEED>2000</AVERAGE_CPU_SPEED> <TTINSTANCE_HOST>SAPIA64BW</TTINSTANCE_HOST> <TTOS_BIT_LENGHT>64</TTOS_BIT_LENGHT> <TTCENTRAL_SERVICES_MSPORT>3902</TTCENTRAL_SERVICES_MSPORT> <TTCENTRAL_SERVICES_HOST>SAPIA64BW</TTCENTRAL_SERVICES_HOST> <SERVER_HEAP_SIZE>1024</SERVER_HEAP_SIZE> <J2EE_ADMIN>Administrator</J2EE_ADMIN> <SLD_PORT>50300</SLD_PORT> <J2EE_HTTP_PORT>50100</J2EE_HTTP_PORT> <AMOUNT_MEMORY>32737</AMOUNT_MEMORY> <INSTANCE_ID>111979</INSTANCE_ID> <DISPATCHER_HEAP_SIZE>170</DISPATCHER_HEAP_SIZE> <NUMBER_SERVER_NODES>1</NUMBER_SERVER_NODES> <CPU_COUNT>8</CPU_COUNT> <WIZARD.jdk.OSSettings.OS>ntia64</WIZARD.jdk.OSSettings.OS> </root>
WebDynpro
<WebDynpro> <loggedInUser>Administrator</loggedInUser> <initial>true</initial> </WebDynpro>
ErrorMsg
<ErrorCodes/>
EMPTY_MESSAGE_FOR_XPATH
<EMPTY_MESSAGE_FOR_XPATH/>
UMEDestination
<Destination type="j2eeengine" subtype="default"/>
CTCImportParameters
<CTCImportParameters/>
BIUI_Input
<root> <ABAP_USER>ADMIN</ABAP_USER> <ABAP_PASSWORD>% secure content %</ABAP_PASSWORD> <BACKEND_SYSTEM>SAPIA64BW</BACKEND_SYSTEM> <ABAPDOMAIN>MADRID</ABAPDOMAIN> <BACKEND_SID>BWI</BACKEND_SID> <BACKEND_SYSNUMBER>00</BACKEND_SYSNUMBER> <BACKEND_CLIENT>300</BACKEND_CLIENT> <BACKEND_HTTP_PORT>8000</BACKEND_HTTP_PORT> <BACKEND_SERVER_PORT>3200</BACKEND_SERVER_PORT> <LOGONGROUP>SPACE</LOGONGROUP> <J2EE_ADMIN>Administrator</J2EE_ADMIN> <J2EE_PASSWORD>% secure content %</J2EE_PASSWORD> <J2EE_SYSTEM>SAPIA64BW</J2EE_SYSTEM> <JAVADOMAIN>MADRID</JAVADOMAIN> <J2EE_SID>EPI</J2EE_SID> <J2EE_HTTP_PORT>50100</J2EE_HTTP_PORT> <P4PORT>50104</P4PORT> </root>
local
<root> <SID>init</SID> <CERTCLIENT>000</CERTCLIENT> <TEMPLATE>com.sap.pct/templates/systems/com.sap.portal.SAP_R3_LoadBalancing</TEMPLATE> <SYSNAME>SAP_BW</SYSNAME> <SYSTEMNAME>init</SYSTEMNAME> <KMSERVICEURL/> <CLIENT>init</CLIENT> <ALIAS>SAP_BW</ALIAS> <POPUP/> <FOLDER>Systemlandscape</FOLDER> <SYSPARAM>init</SYSPARAM> <ABAP_HOST>init</ABAP_HOST> <PASSWORD>init</PASSWORD> <FILE>init</FILE> <KMRMPREFIX>/bw_metadata</KMRMPREFIX> <USERTYPE>DEFINED_USER</USERTYPE> <MSGSERVERNAME>init</MSGSERVERNAME> <DOMAIN>sap.com/tclmctcccltemplate_installerwd/webdynpro/public/lib/sap.comtclmctcccltemplate_installer~wd.jar</DOMAIN> <SYSNUMBER>init</SYSNUMBER> <TITLE>SAP_BW</TITLE> <DEFAULT>X</DEFAULT> <DESTNAME>init</DESTNAME> <URLPREFIX>init</URLPREFIX> <DESCRIPTION>init</DESCRIPTION> <HOST>init</HOST> <PATH>.</PATH> <ABAP_CLIENT>init</ABAP_CLIENT> </root>
usageProperties
<root> <PI-AF>true</PI-AF> <NWA>true</NWA> </root>
com.sap.tc.lm.ctc.SystemType
<SystemType> <MegaTenancyFlag>false</MegaTenancyFlag> <MegaTenancyType>CTC_NULL</MegaTenancyType> <SystemRole>CTC_NULL</SystemRole> <SystemLocation>CUSTOMERSITE</SystemLocation> <BCDesignTimeFlag>false</BCDesignTimeFlag> <AppRuntimeFlag>true</AppRuntimeFlag> </SystemType>
Wizard
<BI_UserInput1WizardPage0> <PrerequisitesWizardContainer> <textarea value="Please check for prerequisites:: Note 983156: 1. Ensure that the BI (ABAP) system is SSO enabled. Ensure that the following parameters have the required values: login/create_sso2_ticket = 2 login/accept_sso2_ticket = 1 Use report RSPARAM to check the values of these parameters. If necessary, use transaction RZ10 to change the values of these parameters. If you have to change these parameters, remember to restart the ABAP system afterwards. 2. Check that the logon group of your BI (ABAP) system is set up (use transaction smlg e.g.). 3. Ensure that the administrator user already exists in your BI (ABAP) system and has been assigned role SAP_BC_JSF_COMMUNICATION (minimum requirement) and profile S_BW_RFC. 4. Make sure that the http port of the application server of your BI (ABAP) system is set. 5. Registry your ABAP system in the SLD (system landscape directory) before. 6. Create pse in ABAP (Transaction strustsso2)."/> </PrerequisitesWizardContainer> <Container0> <ABAP_ADMIN value="ADMIN"/> <ABAP_PASSWORD value="% secure content %"/> <BACKEND_SYSTEM value="SAPIA64BW"/> <ABAPDOMAIN value="MADRID"/> <BACKEND_SID value="BWI"/> <BACKEND_SYSNUMBER value="00"/> <BACKEND_CLIENT value="300"/> <BACKEND_HTTP_PORT value="8000"/> <BACKEND_SERVER_PORT value="3200"/> <LOGONGROUP value="SPACE"/> </Container0> <Container1> <J2EE_ADMIN value="Administrator"/> <J2EE_PASSWORD value="% secure content %"/> <J2EE_SYSTEM value="SAPIA64BW"/> <JAVADOMAIN value="MADRID"/> <J2EE_SID value="EPI"/> <J2EE_HTTP_PORT value="50100"/> <P4PORT value="50104"/> </Container1> </BI_UserInput1WizardPage0>
SLDAdministrator
<SLDAdministrator> <Host>CTC_NULL</Host> <Port/> <User>CTC_NULL</User> <Password>CTC_NULL</Password> </SLDAdministrator>
J2EEAdministrator
<J2EEAdministrator> <User>CTC_NULL</User> <Password>CTC_NULL</Password> </J2EEAdministrator>
The only thing that I see incorrect are <TTRDBMS_DRIVER_LOCATION>, the path is not correct, the correct is J:\
I have checked Config Tools and some configuration files, but I can not see this parameter.
Could do you please help me ???
Thanks you very much

Hi
with 1.4.2_18 and 1.4.2_19 we are currently having massive stack overflow check the below link for more clarifications
X64 java 1.4.2_18 for SAP
Regards
Uday

Unable to Export certificates as Personal Information Exchange - PKCS #12 (.PFX) file format.

We are using Windows 2003 Certificate Authorities, and we are unable to Export certificates as .PFX, our only options are, DER encoded binary X.509 (.CER), Base-64 encoded X.509 (.CER), or Cryptographic Message Syntax Standard - PKCS #7 Certificates (.P7B). The .PFX option is grayed out in the Certificate Export Wizard on the CA.
This posses a problem because our Windows 2008 server running IIS 7 wants us to import a certificate as .PFX
can someone explain what is happening and how to fix it please

Greg --
The private key doesn't exist on the CA, but it does exist on the computer on whic you created the request. Here's what happens when you request a certificate.
If you're generating a request with a new key pair -- which you will in the vast majority of cases -- Windows first generates the public and private key pair. The private key is written to a key store. Where the key store is located will depend on which
Cryptographic Service Provider (CSP) or Key Storage Provider (KSP) is specified in the template. KSPs were introduced in Windows Server 2008/Vista, and are only available in v3 templates. In the case of most of the default Microsoft CSP/KSPs (with the exception
of those used with Smart Cards), the key store is located in either the user's profile, or in the case of computer certificates, the All Users profile. It is at this point, by the way, that the properties of that private key are also written to the key store.
One property of interest to you immediately is whether or not Windows should allow the private key to be exported.
Once the key pair is generated, the request is then created. The request contains the information that should be in the certificate. This information is generally specified by the template with the exception of the Subject field, which contains the Common
Name or Distinguished name of whoever is requesting the certificate. In the case of IIS, the Subject will be your site name. The public key is included in the request. Windows then signs the request with the newly created private key.
Windows also creates a dummy certificate object in the Certificate Enrollment Requests store so that it knows that there is an outstanding request.
At this point, the request is saved to a file or sent to an online CA depending on how you generated the request. Note that the private key is
not sent to the CA in most cases. The exception to this rule occurs when you have Key Archival enabled on the CA, and the template specifies that the private key should be archived in the CA database. If this is the case, Windows retrieves
the CA Exchange certificate from the CA and uses the public key in that certificate to encrypt the newly created private key. This encrypted private key is included in the request.
Once the CA receives the request, it processes that request to determine if it should issue the certificate or not. In the case of the Enterprise CA, this decision is based on the permissions on the template. One can also specify that certain templates
require CA manager approval before they can be issued. Assuming that everything is correct in the request, and that the necessary information can be retrieved from Active Directory (perhaps the user's email address, or the computer's DNS host name -- it depends
on the settings in the template), and that any CA Manager approvals specified in the template have been performed, the CA builds the certificate and signs it with its current private key. The certificate has been created.
This certificate is stored in the CA database, which is why you can export it in the Certificate Authority snap-in. If the encrypted private key for that certificate has been included in the request to be archived, the CA decrypts it first with its CA Exchange
private key, and then re-encrypts it using the public key(s) for any Key Recovery Agents configured on the CA. The newly encrypted private key is also stored in the CA database. Note that this encrypted private key can only be retrieved and decrypted
by a valid KRA.
The CA then returns the certificate to principal who requested it. If the request was first saved as a file and then submitted to the CA you have to retrieve the certificate manually. It is only returned automatically if you submitted the request via the
Certificiates MMC, or if the application you use to submit the request retrieves it for you. IIS does this, when you use the certificate request wizard to request a Web Server certificate.
When the client has received the certificate, it locates the dummy certificate object in the Certificate Enrollment Requests store. From this object, Windows copies the location of the key store for the private key (among other things). This dummy certificate
object is then deleted, and the new certificate is imported into the Personal store. The private key information is then written to an internal property of the certificate in the store. This is how Windows locates the private key of that certificate in order
to use it when you invoke the associated certificate.
When you go to export the certificate and private key, Windows reads the private key locate information from the certificate properties in order to find the key store wherein it is located. Assuming export is allowed, the certificate and private key are written
to a password protected PFX file.
That's how a certificate request gets turned into a certificate, and explains why the private key doesn't exist on the CA. If you need to generate a PFX file, then you'll have to export the certificate from the computer on which you generated the request.
Hope this helps.
Jonathan Stephens
Jonathan Stephens

Silently import exported Java certificate

Hi,
I exported a Java certificate using the Java Control Panel -> Security -> Certificates -> Export. Now I'm looking for a command to silently (without user/admin interaction) import this certificate on another PC. I will use this command line in WiseScript to automate deployment of a software package. Maybe also useful: it's a certificate of type: user, trusted.
Can someone advise me?
Thanks a lot!
Koen

Try the following (substitute your own info for %variables%):
"%JREPATH%bin\keytool.exe" -import -v -noprompt -file "%Path to your certificate%" -keystore "%JREPATH%lib\security\cacerts" -alias %certificate alias name% -storepass changeit -storetype JKS

Error while uploading SSL certificate in Visual Admin

Hi,
I generated a .cert base 64 certificate from STRUST tcode of my ECC server.I'am tring to load the certificate in visual administrator under key storage --> ADS Certs. while loading, it is giving me an error message stating " Key Store : ID21113:Input array size must be multiple by 4."
I was able to upload the same certificate with .cert extension previously, but this time it is throwing me import failed error and the above error message. I checked in forums but i couldn't find any solution.
Please guide me with a solution.
With Regards,
Joel

work around provided by SAP
I neither managed to load your key to my keystorage.
Nevertheless, I converted your certificate by means of the
"Certificate Export Wizard" (of the Internet Explorer) to "DER encoded
binary X.509 (.cer). Then I renamed the file to "ORDclstd.crt" and
finally was able to load this certificate to the keystorage.

Certificate based authentication for Exchange ActiveSync in Windows 8.* Mail app

I have a Surface Pro and want to setup access to my company's Exchange server that accepts only Exchange ActiveSync certificate-based authentication.
I've installed server certificates to trusted pool and my certificate as personal.
Then I can connect thru Internet Explorer, but this is not comfortable to use.
I don't have a password because of security politics of our company. When I'm setting up this account on my Android phone I'm using any digit for password and it works perfectly.
Can someone help to setup Windows 8 metro-style Mail application? Does it supports this type of auth? When I'm trying to add account with type Outlook, entering server name, domain name, username, 1 as a password then I've got a message like "Can't
connect. Check your settings."
Is there any plans to implement this feature?

For what it's worth we have CBA working with Windows 8.1 Pro. In our case we have a MobileIron Sentry server acting as an ActiveSync reverse-proxy, so it verifies the client cert then uses Kerberos Constrained Delegation back to the Exchange CAS, however
it should work exactly the same to the Exchange server directly. I just used the CA to issue a User Certificate, exported the cert, private key and root CA cert, copied to the WinPro8.1 device and into the Personal Store. Configured the Mail app
to point at the ActiveSync gateway, Mail asked if I would like to allow it access the certificate (it chose it automatically) and mail synced down immediately...
So it definitely works with Windows Pro 8.1.

Lync 2010 Certificate Issue - "There was a problem verifying your certificate from the server"

Greetings.
My Issue:
Lync 2010 client does not connect to server;error displayed "Cannot sign into Lync. There was a problem verifying the certificate from the server."
Description:
The client is running on my Windows 7 box, and my CA server is a Windows Server 2003 box. I have installed the hotfix on the Server 2003 box to update the Web Enrollment portion of CA to allow for newer clients (Vista and 7) to receive certificates from
this server.
Lync server is running on Server 2008 R2 STD, installation was a success.
The Windows 7 box is a part of the domain.
I have manually exported the Root CA from my Enterprise CA server from
Trusted Root Certification Authorities -> Certificates and imported into the same location on my Windows 7 box.
If I look at the certification path on the Root CA, on my Windows 7 box, it says "The certificate is OK." The same goes for the servers involved.
Still nothing.
I have read the other forum posts on here about people having success once they manually import the Root CA from the Enterprise CA server, but this is not my case here.
All certificates are successfully assigned on the Lync server box; however, I did have to manually import the Root CA into Lync server's
Trusted Root Certification Authorities -> Certificates before I could successfully assign them. Had to do this on another deployment I completed, so I didn't think anything of it.
To recap: it seems that even with my Root CA imported into my Windows 7 box I can still not connect to my Lync server with the client, and I get the error message "There was a problem verifying the certificate from the server."

Solved
Solution : Export certificate from Lync Server Start > Administrative Tools > IIS > Server Certificate > Export > abc.pfx save it, Copy and place the certificate where Ms Lync 2010 client is installed or getting certificate
error. Follow these steps on client machine to install certificate
Run > mmc > add or remove snap in > certificates > computer account > local computer >finish > ok > expand Certificate > Trusted Root Certification Authorities > Certificate > All task > Import > copy abc.pfx certificate
and delete unnecessary certificate from there.
Restart Client machine and open microsoft Lync client 2010 and open option menu > Personal > Advanced > choose Auto Configuration > save ok

Certificate error using webauth on guest wifi

I am trying to setup a guest wifi. We have our custom page package loaded and it looks great with our graphics, logo. Basically you have to check a box and click accept to the terms of service, and then it forwards you through to VLAN 12 in this case, which is directed to an untangle software based firewall / router with its own outside IP address.
The issue is that when you initially join the wireless network, the page at 1.1.1.1/login.htm throws a certificate error and you have to continue anyway (Internet Explorers language).
Does this mean we need to put our wildcard certificate on it for our *.domain.com (GoDaddy signed) or does it need another kind of certificate? What format would it need to be in (I have a pfx but can convert it if need be).
We are not passing any credentials, so it doesn't NEED to be https, so under Management > HTTP-HTTPS I changed WebAuth SecureWeb to Disabled. However when doing this, WebAuth is still putting https://1.1.1.1 and I get a page cannot be displayed. I take the s out of https and then the webauth page works.
So two things here, how could I just use it in http, or if preferred, what format and what kind of certificate needs to make https work in webauth? This is primarily for vendors that visit, or guests in our waiting lobby with their tablets or smartphones.
The WLC is a 5508 running 7.4.121.0.

I also tried this site as well:
http://www.packethead.net/2013/08/05/cisco-wlc-wireless-lan-controller-certificate-install-mac-os-x/
I tried it command line, and it tftp's fine in all instances above but I get:
TFTP Webauth cert transfer starting.
TFTP receive complete... Installing Certificate.
Error installing certificate.
Might have to open a case with tac if this doesn't work.
I have openssl 1.0.1j is that maybe a bad version? also every time I run it it says WARNING: can't open config file: /usr/local/ssl/openssl.cnf
Well of course not, that is a *nix based bath and this is the 64-bit windows version.
What I can get is a download from go daddy and the wildcard cert is already generated. I cannot submit a new cert request. We have this key and I've tried different ways of converting it with OpenSSL, I've imported it to windows and in the mmc for certificates exported in various formats. Nothing will work with this WLC.

List of PT TABLES which contain digital certificate

Team,
We have implemented self sign certicate in our environment.
So, can someone share the list of PT TABLES which contain digital certificate .
Because, we are going to refresh the environemnt and I dont want to lose the digital certificate after the refresh.
Thanks

On the safer side, I am taking export of below tables too. Please have a look.
-- PROCESS SERVERS
EXPORT PS_SERVERCLASS;
EXPORT PS_SERVERDEFN;
EXPORT PS_SERVERDEFN_LNG;
EXPORT PS_SERVERNOTIFY;
EXPORT PS_SERVERMESSAGE;
EXPORT PS_SERVEROPRTN;
EXPORT PS_SERVERCATEGORY;
EXPORT PS_SERVERSTAT;
--Report Node
EXPORT PS_CDM_DIST_NODE;
-- URL DEFINITIONS
EXPORT PSURLDEFN;
EXPORT PSURLDEFNLANG;
EXPORT PS_PT_URL_PROPS;
-- DIRECTORY
EXPORT PSDSDIR;
EXPORT PSDSSRVR;
EXPORT DSCONNECTID;
EXPORT PSDSEXT_INSTALL;
EXPORT PSDSSECMAPMAIN;
EXPORT PSDSSECMAPSRVR;
EXPORT DSUSRPRFLMAP;
EXPORT PSDSUSERPRFL;
EXPORT PSDSSECROLERULE;
EXPORT DSSRCH_SBR;
EXPORT DSSRCHATTR;
EXPORT DSSECFILTER;
EXPORT PT_WF_NOT_DSCFG;
-- WEB Data
EXPORT PSWEBPROFBROW;
EXPORT PSWEBPROFCOOK;
EXPORT PSWEBPROFDEF;
EXPORT PSWEBPROFILE;
EXPORT PSWEBPROFPROP;
EXPORT PSWEBPROFNVP;
EXPORT PSGATEWAY;
--Digital Certificates
EXPORT PSCERTISSUER;
EXPORT PSCERTDEFNDEL;
EXPORT PSCERTDEFN;
EXPORT PSCERTDB;
-- Search Attribute
EXPORT PSPTSF_ATTRS;
EXPORT PSPTSF_ADD_PRMS;
EXPORT PSPTSF_ATT_PROP;
-- Search Definition
EXPORT PSPTSF_SD;
EXPORT PSPTSF_SD_ATTR;
EXPORT PSPTSF_SD_ATTRH;
EXPORT PSPTSF_SD_DCATR;
EXPORT PSPTSF_SD_DCACL;
EXPORT PSPTSF_SD_LANG;
EXPORT PSPTSF_SD_PNLGP;
EXPORT PSPTSF_SD_SRACL;
-- Search Category
EXPORT PSPTSF_CATADVFD;
EXPORT PSPTSF_CATDSPFD;
EXPORT PSPTSF_CATFACET;
EXPORT PSPTSF_CAT_LANG;
EXPORT PSPTSF_SRCCAT;
EXPORT PSPTSF_SRCCATAT;
-- Search Context
EXPORT PSPTUS_CTX;
EXPORT PSPTUS_CTX_DET;

Certificate setup RDS 2012 R2

Hi,
I have set up an RDS 2012 R2 deployment for internal use. I plan to add a gateway server cluster for external access later (RDGW). That cluster will be placed in DMZ and use a public wildcard cert. It will connect external users to the farm. Internal or
Direct Access (DA) users will use the Web Access servers to connect internally in the corp. LAN.
For now, i have the following setup. Web Access role on 2 servers with DNS RR (RDWA). 2 clustered Connection Broker servers (RDCB), two Session Hosts (RDSH) and one licesning server. So a total of 7 servers (+ 2 GRGW servers in DMZ that are not set up
yet).
So, the issue is; I need to set up certificates. We have a CA in an AD top domain (our site is a sub.domain.com). We do not have access to that CA and need to order certs. from our corp. HQ. Ok, but what do i ask for? I need 3
DER encoded binary X.509
certs. That's the info i have. How can create a cert. request? See pictures below.
This posting is provided "AS IS" with no warranties or guarantees and confers no rights

Hi,
Thank you for your posting in Windows Server Forum.
Can you exactly let us know which certificate you want for your network (Self-signed or SSL)?
As per my suggestion you can use wildcard or SAN certificate for your network which can be used for external network also.
If you want Self-signed certificate for internal use, you can create the certificate from Deployment properties of RDS page or IIS Manager as per below path.
IIS Manager>Server Certificate>Create Self-Signed Certificate>Export the certificate on specified location then select the certificate in RDS installation process.
But see that, the certificate is installed into computer’s “Personal” certificate store with its corresponding private key & it’s added under trusted root certificate authority.
Please check below articles for detail.
1. Certificate Requirements for Windows 2008 R2 and Windows 2012 Remote Desktop Services
2. Configuring RDS 2012 Certificates and SSO
3. Minimum Certificate Requirements for Typical RDS implementation
Hope it helps!
Thanks.
Dharmesh Solanki

Certificate export

Similar Messages

Maybe you are looking for