Go Daddy Certificate on ISE Repeat accept certificate on Windows 7/8/8.1

We have moved from a self signed certificate to a Go Daddy certificate to avoid trust issues around self signed certificates. IOS devices continue to work fine, but Windows devices have to accept the certificate trust many times. Sometimes it takes 4-6 times clicking connect while on some machines it takes 10-14 times of clicking connect when it prompts you to verify the certificate. Sometimes it will never connect and you have click terminate once and then click connect a few times. What is the deal? This happens equally on Windows 7, 8, and 8.1 machines when connecting to the ISE SSID the first time. This also only happens when using the Microsoft PEAP. On my machine, I have an Intel WIFI card so I have the option of using Intel control and Intel PEAP instead of Microsoft. This works fine. Something to do with the Microsoft supplicant and ISE on this trust? Anyone else have this issue or know how to fix it? The system does work. It is just annoying for low end users who don't understand to just keep clicking connect...windows will believe you eventually.
More information: I have also installed the provided Go Daddy intermediate cert in Intermediate Certification Authorities and in Trusted Root Certification Authorities. Neither help the process.

#8 The Start Menu and User Interface
1. The Start Menu
Allow Drag and Drop from the left list to the right pinned icons. Update build 10041, Microsoft have done this.
The Start menu is bloated with Metro Apps, making it more cumbersome to find useful installed programs. Example of Start Menu to the left bloated with Metro Apps.
These should all be in a Windows Apps folder similar to all the (more useful) items in the Windows Accessories folder.
2. Windows and X Menu (Right Click Start)
Please add your votes to my Windows UserVoice suggestion here.
Add the following to the “Windows and X” menu:
Windows Defender
Windows Defender Offline
Devices and Printers
.iso to Bootable USB Utility
"Settings" → This definitely has to be here
Make the Windows and X Menu look like part of Windows 10.
3. Windows Defender
Add it to the Windows and X Menu as described above and also add right click context menus like Microsoft Security Essentials had:
4. Minor Feedback
I'm not a great fan of the new icons, the folders are too bright and it looks like they have been drawn in Microsoft paint. The Recycle bin particularly looks terrible.

Similar Messages

ISE 1.3 certificate issue

Hi experts,
I have tried to replicate an issue that my customer is having:
issue: when running client provisioning on default port 8905, the portal certificate shows that it's using the certificate created for the Admin. However, when visiting guest portal or running onboarding process (using port 8443 which is the default one), the certificate is presented with the correct one (the one used for the portal).
Here is what I have setup in my lab:
1. in ISE 1.3, installed two certificate: one for admin and the other for portal access:
2. when accessing the admin page and the client portal, I can see that it's using the correct certificate. ( the OU=ESC one is the admin certificate and the OU=MS one is the portal certificate)
However, when accessing the test client provisioning portal on 8905, the certificate shows it's using the admin one:
In the adminstration->device portal mgmt->client provisioning portal, the port is used as default 8443. It makes more sense it uses the client provisioning certificate rather than the admin certificate when the portal is redirected on to port 8905.
Is the issue an as-designed feature or is there additional configuration needs to be implemented?

Hello Neno,
Thanks for the reply!
Let me clarify: when I access the client provisioning portal on default 8443 which URL is generated by the ISE, I can see the correct certificate (OU=MS) is presented. But when I manually change the port from 8443 to 8905 in the same URL and access, ISE brings me to the same portal page, but this time the incorrect certificate is presented (OU=ESC which I generated for the admin portal).
So it seems that ISE presents a wrong certificate (the one for admin) when user is redirected to the provisioning portal on a port other than port 8443. I believe ISE should present the portal certificate usage in this case. I am not sure if this is an as-designed feature, or some additional configuration should be done.
Let me know if you still have questions with this.
Many thanks,

Manage certificate on ISE

Hi All,
Need explanation on manage certificate on ISE 1.1.1
If i am trying to let ISE primary node register another standalone unit as Inline posture node, what should i deal with this setting
01. on local certificate's Bind CA Signed Certificate Eanble Validation of certifcate extenstions and Certificate store "Trust for client authentiation"
Should i check this option during the time i import the certifiate? and what this mean on it?
02. on local certificate's Bind CA Signed Certificate, should i check the option on "Protocol: Mangement interface" as well?
Thanks
Noel

Please review the below links for assistance on your query:
http://www.cisco.com/en/US/docs/security/ise/1.0/user_guide/ise10_man_cert.html
http://www.cisco.com/en/US/products/ps11640/products_tech_note09186a0080bd0953.shtml

Always accept certificate [solved] (sort of)

Hello everyone,
I'm trying to mount a webdav folder to /mnt/dav but it always asks me to accept the certificate. Is there any way to always accept the certificate (without asking me)?
[jules@Inspiron mnt]$ mount /mnt/dav
The server certificate is not trusted.
Server identity: *.xs4all.nl
Issuer: Equifax Secure Inc., US
Subject: Domain Control Validated - RapidSSL(TM), See www.rapidssl.com/cps (c)05, https://services.choicepoint.net/get.jsp?GT59386789, *.xs4all.nl, NL
Fingerprint: b9:1a:64:f8:d8:9d:d4:ae:9a:4a:8c:60:47:59:b1:f0:79:7a:b6:47
You only should accept this certificate, if you can
verify the fingerprint! The server might be faked
or there might be a man-in-the-middle-attack.
Accept certificate for this session? [y,N] y
/sbin/mount.davfs: No free coda device to mount.
/sbin/mount.davfs: Trying fuse kernel file system.
[jules@Inspiron mnt]$

RTFM
At the moment it is not possible to store these certificates permanently, but
you will be prompted every time you connect. This feature is intended for one
of the next releases.....

Does ISE support wildcard certificates?

Hello guys,
My customer doesnt have a CA, but instead has wildcard certificates.
I will implement ISE in 3 different locations (each location independent and with all ise services). Havent look in dept about wildcard certs, but does ISE support this type of certificates? The certs i need is only for corporate users not to be shown with the ssl cert error when accesing ise portals.
If wild certificates supported, then will every independent site need to create a separate CSR for each one of them?
Thanks!
Emilio

Support for Universal Certificates:
Cisco ISE, Release 1.2 supports the use of wildcard server certificates for HTTPS (web-based services)
and EAP protocols that use SSL/TLS tunneling. With the use of universal certificates, you no longer have
to generate a unique certificate for each Cisco ISE node. Also, you no longer have to populate the SAN
field with multiple FQDN values to prevent certificate warnings. Using an asterisk (*) in the SAN field
allows you to share a single certificate across multiple nodes in a deployment and helps prevent
certificate-name mismatch warnings.
For more information, refer to the Cisco Identity Services Engine User Guide, Release 1.2. Kindly find the attached PDF for your clarification ISE 1.2 supports wildcard certificates. Even I had highlighted the same on page 14.
Support for Universal Certificates:
Cisco ISE, Release 1.2 supports the use of wildcard server certificates for HTTPS (web-based services)
and EAP protocols that use SSL/TLS tunneling. With the use of universal certificates, you no longer have
to generate a unique certificate for each Cisco ISE node. Also, you no longer have to populate the SAN
field with multiple FQDN values to prevent certificate warnings. Using an asterisk (*) in the SAN field
allows you to share a single certificate across multiple nodes in a deployment and helps prevent
certificate-name mismatch warnings.
For more information, refer to the Cisco Identity Services Engine User Guide, Release 1.2.

Go Daddy UCC Certificate: "ExRCA can only validate the certificate chain using the Root Certificate Update functionality from Windows Update"

Hello,
I have this issue regarding certificate chains while performing Outlook Anywhere connectivity test
by Microsoft Remote Connectivity Analyzer:
"ExRCA can only validate the certificate chain using the Root Certificate Update functionality from Windows Update. Your certificate may not be trusted on Windows if the "Update Root Certificates" feature isn't enabled."
Note: even if I got the error, Outlook Anywhere and
ActiveSync services work fine.
Environment:
- Exchange 2007 with SP3
- Go Daddy Multiple Domains UCC certificate (up to 5 Subject Alternative Names)
I already read and followed instructions on this TechNet post
Can I safely ignore this warning about the SSL cert? Using GoDaddy UCC cert but it is a little bit different by this case.
So after an investigation I understand the issue above is related to SSL certificate
Certification Path (see screenshots below).
NO ERRORS on ExRCA checking
Go Daddy Secure Certification Authority is under Intermediate Certification Authorities
repository
Go Daddy Class 2 Certification Authority is under Intermediate Certification Authorities
repository
Starfield Technologies (http://www.valicert.com)
is under Trusted Root Certification Authorities repository
ERROR on ExRCA checking
Go Daddy Secure Certification Authority is under Intermediate Certification Authorities
repository
Go Daddy Class 2 Certification Authority is under Trusted Root Certification Authorities
repository
Can you add some useful information ?
I'm opening a support ticket at Go Daddy; I hope they could me some positive feedbacks.
Regards,
Luca Fabbri
Disclaimer: This posting is provided "AS IS" with no warranties or guarantees, and confers no rights.

Strange I have a feeling the exrca tool can't validate the godaddy class2 root authority due some older compability and wants to use the older original root authority valicert owned godaddy. Or when the exrca tool is validating the root CA it only has the
goaddy class2 root ca that was issued by valicert and not the standalone cert when doing the comparision. I sent the question to MS and will let you know when I hear back.
You can get rid of it
https://certs.godaddy.com/anonymous/repository.seam
Download the cert
◦gd_cross_intermediate.crt
Then import it into the trusted root cert authority on your CAS boxes. Then you need to delete the other godaddy class2 root authority. Make sure you see the one you imported both will be named goaddy class2 root authority but one will be issued by valicert.
Re-run the test and it will go away, I also saw the error with my domain as well using godaddy and got rid of it by using the new cert authority.
James Chong MCITP | EA | EMA; MCSE | M+, S+ Security+, Project+, ITIL msexchangetips.blogspot.com

Avoid to accept Certificate alert in sun java plugin

Hallo ,
did somebody know how to avoid the 'accept Certificate' alert when a signed jar are used in Forms?
I know that you can use certdb.txt for Jinitiator but how is it possible in sun java plugin (we have 1.4.2_08).
Fatih

Fatih,
looks as if this is in identitydb.obj
See:
http://java.sun.com/products/plugin/plugin.faq.html
http://www.suitable.com/docs/signingsignplug.html
Frank

Once cancelled, Accept Certificate window never appears again! (HELP!)

Ok, I am developing a self-signed applet for me and a few friends to play a webgame.
They can still play. In fact, they're having a grand ole' time. but ME, the DEVELOPER is locked out.
WHY? because I hit "cancel" on the "accept certificate" one time.
It's been 3 days now, and I'm at my wits end trying to figure out how to flush my accepted / rejected certificates!
It's not in the java > security > control panel thing, because I hvae played around with every option there, and still in both my browsers (even after reinstalling firefox) I get just a plain white-screen whit no popup window when I visit the html.
Simply stated: How do I force the "Accept Certificate" dialogue to pop up again? I'm sure anyone who's made a signed applet experiences this worry!!!

Hi,
The original posters have probably worked this out already ;)
On Windows you can control certificates by going to Control Panel->Java Control Panel->Security and click "Certificates"

Unable to install SSL Certificate - ADMIN4118: Only one server certificate can be installed at a time

Hi,
We are trying to install SSL certificate (Verisign Class 3) on iPlanet Web Server (version 7). However, at the final step we are getting the error "ADMIN4118: Only one server certificate can be installed at a time"
We are following the below steps,
Under "Server Certificates" tab,
     -> Click on "Install" button.
     -> On "Select Configuration" click on "Next" button.
     -> On "Select Tokens and Passwords", select default token as "internal" and click on "Next" button.
     -> On "Enter Certificate Data", select option as "Certficate File" and give path to the certificate file which is having .p7b extension
     -> On "Certificate Details" we are getting warning as "Duplicate Server Details Found" and it's by default using the existing certificate's nickname.
     -> On "Review" page after clicking "Finish" button, an error is displayed saying "ADMIN4118: Only one certificate server can be installed at a time"
There are multiple sub-domains availble and the new certificate we want to install contains one more sub-domain.
So, say currently the subdomains present are,
1.abc.com
2.abc.com
so on...
and now we are trying to install a SSL certificate having one more subdomain say 10.abc.com.
Please let us know if you have solution to this problem.
Thanks,
Rajesh

Hi Rajesh,
That error is most commonly seen when you are trying to install a certificate chain into the Web Server.
The chain should be installed using the "Certificate Authorities" tab per the following steps:
1) Login to the Admin Console.
2) Click Edit Configuration from Common Tasks > Configuration Tasks.
3) Click the Certificates > Certificate Authorities tab from the Configurations page.
4) Click the Install... tab from the Certificate Authorities (CAs) page.
An Install CA Certificate Wizard opens. The wizard guides you through the settings available for installing a Certificate Chain. Select Certificate Chain when prompted for Certificate Type.
You should then see the CA and intermediate certificate(s) listed in the security database.
If you have access to MOS, more details can be found in the MOS KM Note:
   Oracle iPlanet Web Server - 'ADMIN4118: Only one server certificate can be installed at a time' When Installing Certificate Chain (Doc ID 1925025.1)
regards
Tracey

Clients getting a certificate warning of an expired certificate that doesn't exist

Running exchange 2010 and clients using Outlook 2007 and 2010, clients are getting the certificate warning dialog that the certificate is expired. The name of the server in the certificate is correct, however when looking at the certificates installed
on the Exchange server, the one that is referenced with the issued and expiration dates doesn't show up on the server.
Where could the clients be getting this from?

You need to look at each Client Access Server. A quick way to see what SSL cert is bound is to just look at the IIS splash page:
https://servername
You'll likely get a cert error, but just continue and the IIS splash page should load. When it does, view the certificate that has been presented to the browser. Ensure the expiration is good, the CA chain is trusted and the cert name (or SAN)
has the URL to the Client Access Array FQDN in the cert.
Normally, a self signed Exchange cert is not used in a production environment because the clients will not trust the publisher. If you have more than one CAS, it's likely one of them is not using the correct cert.
Good luck!
- Chris Ream -
**Remember, if you find a post that is helpful, or is the answer, please mark it appropriately.**

After updating SSL Certificate, iCal is saying the certificate has expired.

Having a problam with iCal after updating our SSL certificate. The certificate expired recently so we renewed it with godaddy and followed the steps on their site to update it on our server. Everything seemed to have gone fine, under server admin in the certificates section it shows the certificate is valid through 2015 and I have Mail and iCal both set to use that certificate (it is the only one you can select.). E-mail works fine but when you connect with iCal it says there is a problem with the certificate. When I click details it shows the certificate has expired and shows the esperation date of the old certificate. I have tried to delete and import the new certificate again but still have the same issue. It seems that some how iCal is still holding the old certificate. Does anyone know what is going on? Did I make a mistake somewhere?

Hi,
According to your post, I understand that client face an problem “The linked image cannot be displayed. The file may have been moved, renamed, or deleted. Verify that the link points to the correct file and location” after change SSL certificate.
If I misunderstand your concern, please do not hesitate to let me know.
Do you see the "page cannot be displayed" error only from your DC server or also from a Windows 7 client machine? What browser do you use and what version?
Please run “certutil –store” command from a command to verify that the certificate is correctly installed in the certificate store. Also run “certutil -store my” to check the certificate from CA.
If the certificate is already installed, please refer to below link to check the value of Cache in registry:
https://support.microsoft.com/en-us/kb/2753594
Thanks
Please remember to mark the replies as answers if they help, and unmark the answers if they provide no help. If you have feedback for TechNet Support, contact [email protected]
Allen Wang
TechNet Community Support

E71. Repeated 'Accept Incoming connection' when sy...

Morning,
When Syncing via Bluetooth I get repeated 'Accept Incoming Connection...' requests. This is kind of annoying having to validate each connection attempt for Calendar, Notes etc. I would have thought since the phones are paired that it would not require a connection request OR accept only the first verification.
Any help would be appreciated.
Jacques

Thank you jimemo for your post. I was going crazy with this repated confirmation request
Message Edited by canmind on 14-Feb-2009 07:59 PM
Message Edited by canmind on 14-Feb-2009 07:59 PM

Push windows trusted root certificate to adobe trusted store/certificate

Hi,
Can we push windows trusted root certificate to adobe trusted store/certificate ?
Regards,
Nitin Harikant

I have tried something similar by trying to import the Windows Cert Store into Adobe, but I never did have it work. I just recently found the option is XI for Adobe to look at the Windows store itself.
XI: Edit > Preferences > Signature > (Verification) More... > (Windows Integration) Check Validating Signatures, Check validating Certified Documents
It should happen right away; although I will note I am having issues with this working for Non-Admins on a Terminal Server. Might be a privilege issue.
If you want to set via GPO:
Key Path: Software\Adobe\Adobe Acrobat\11.0\Security\cASPKI\cMSCAPI_DirectoryProvider
Value Name: iMSStoreTrusted
Value Type: Reg_DWORD
Value Data: 62, or 60 (Hex)
Link: Digital Signatures

Intermediate CA certificate and the Root CA certificate

HI
What are Intermediate CA certificate and the Root CA certificate ??
What is the difference between these two types of certificates ??
What are all the other alternative names that are used with these names ??
thanks
kumar

Hi,
An intermediate certificate is the certificate, or certificates, that go between your site (server) certificate and a root certificate.
The intermediate certificate, or certificates, completes the chain to a root certificate trusted by the browser.
Using an intermediate certificate means that you must complete an additional step in the installation process to enable your site certificate to be chained to the trusted root, and not show errors in the browser when someone visits your web site.
Refer
https://support.comodo.com/index.php?_m=downloads&_a=view&parentcategoryid=1&pcid=0&nav=0
The advantages of using intermediate certificates u2013 Sometimes referred to as u2018chainingu2019
http://www.whichssl.com/intermediate_certificates2.html
Root certificate
The root certificate is usually made trustworthy by some mechanism other than a certificate, such as by secure physical distribution. For example, some of the most well-known root certificates are distributed in the Internet browsers by their manufacturers.
a root certificate is either an unsigned public key certificate or a self-signed certificate that identifies the Root Certificate Authority (CA). A root certificate is part of a public key infrastructure scheme. The most common commercial variety is based on the ITU-T X.509 standard, which normally includes a digital signature from a certificate authority (CA).
http://support.microsoft.com/kb/887413
Thanks
swarup

Certificate Authority - How to issue Certificates without extensions?

We are operating a Windows 2012 Server PKI with an Enterprise Subordinate Certificate Authority that is issuing Certificates through an AD Certificate Template, however there are certain certificate extensions that need
to be excluded.
We are following the procedure defined in ;
http: //blogs.technet.com/b/pki/archive/2007/01/03/how-to-exclude-the-certificate-template-name-from-certificates-to-be-issued.aspx
certutil -setreg policy\DisableExtensionList +1.3.6.1.4.1.311.20.2
certutil -setreg policy\DisableExtensionList +1.3.6.1.4.1.311.21.7
net stop certsvc
net start certsvc
This does not have any effect as issued certificates continue to have the extensions in them after the change.

Can you confirm that this command contains EDITF_DISABLEEXTENSIONLIST flag enabled:
certutil -getreg policy\editflags
if not, then you should enable it:
certutil -setreg policy\editflags +EDITF_DISABLEEXTENSIONLIST
and restart CA service.
My weblog: en-us.sysadmins.lv
PowerShell PKI Module: pspki.codeplex.com
PowerShell Cmdlet Help Editor pscmdlethelpeditor.codeplex.com
Check out new: SSL Certificate Verifier
Check out new:
PowerShell FCIV tool.

Go Daddy Certificate on ISE Repeat accept certificate on Windows 7/8/8.1

Similar Messages

Maybe you are looking for