IPhone's and Public Certificates

Hello,
My question is specific to using PEAP (EAP-MSCHAP v2) with 3rd party certificates on iPhones. I have read that despite having a public certificate, iPhones will continue to prompt to accept the cert every time. Can anyone confirm if this is true or if you
can avoid the cert prompt by having a public certificate installed?
Thanks

Hi,
I don’t similar the iPhone certificate processing mechanism, but base on my experience, it must your iPhone not trust the root certificate of your CA. Please confirm your
iPhone have install the certificate which same with your NPS server.
Certificate enrollment for computers that are not domain members cannot be performed with autoenrollment. When a computer is joined to a domain, a trust is established that
allows autoenrollment to occur without administrator intervention. When a computer is not joined to a domain, trust is not established and a certificate is not issued. Trust must be established using one of the following methods:
An administrator (who is, by definition, trusted) must request a computer or user certificate using the CA Web enrollment tool.
• An administrator must save a computer or user certificate to a floppy disk and install it on the non-domain member computer. Or, when the computer is not accessible to the
administrator (for example, a home computer connecting to an organization network with an L2TP/IPsec VPN connection), a domain user whom the administrator trusts can install the certificate.
• An administrator can distribute a user certificate on a smart card (computer certificates are not distributed on smart cards).
The related KB:
Certificates and NPS
http://social.technet.microsoft.com/Forums/en-US/3dcbc123-c7ed-479a-82fc-79670c05bed5/iphones-and-public-certificates?forum=winserverNAP
Hope this helps.
We
are trying to better understand customer views on social support experience, so your participation in this
interview project would be greatly appreciated if you have time.
Thanks for helping make community forums a great place.

Similar Messages

  • TS3988 i have updated my phone with the new software and it keeps saying that verification has failed on my icloud and that the certificate for service is invalid.  following this now my phone does not recognise any of my iphone contacts and so i cannot f

    i have updated my phone with the new 6 IOS. Since doing this my icloud account keeps saying that verification failed and the certificate for service is invalid.  Folowin this problem my phone also does not recognise my other iphone contacts so i cannot facetime or send imessage

    You don't need an app. You need couple's counseling. I believe what you want to do may also be illegal in many jurisdictions.

  • ISE Provisioning Issues - Public Certificate & EAP-TLS

    Anyone run into the issues similar to the below?:
    Public Certificate bound for HTTPS
    Internal AD Certificate Bound for EAP
    Issue is SPW or Native Supplicant will be provisioned with Root CA of Public Cert then SCEP enrolls EAP-TLS with Internal CA however as client device (ipad/iphone/android) doesnt get the Internal Root CA provisioned they will fail EAP-TLS communication
    Running ISE 1.1.2 patch2, 2 node-cluster
    Guest Portal being used for Provisioning if AD credentials passed
    Works a treat if i bind both https & eap on the Internal identity ceritficate (only issue then is Guests/BYOD devices get Certificate Warnings on the portal)
    Cheers
    Kam

    the process doesnt fail as such for the onboarding/provisioning on the iphone, however the when entering domain credentials to the guest portal which intiates the onboarding/provisioning process, i notice the root CA certificate is prompted to be installed on the iphone is that of the public certificate instead of the internal root CA, the rest of the user certificate and scep process properly completes however as the root CA for the internal CA wasnt installed i get warnings when connect to our dot1x eap-tls SSID.
    On other devices this process fails which i can only assume is down to the lack of internal root CA cert
    so as per the above im pretty much following this (differentiated access via certificates) :
    http://www.cisco.com/en/US/solutions/collateral/ns340/ns414/ns742/ns744/docs/howto_60_byod_certificates.pdf
    however my setup is slighlty different as the EAP & HTTPS indentity certificate is not the internal, i have installed a public cert for HTTPS to remove certificate warnings on guest portal (as BYOD devices and guests will only have non-domain machines thus a public cert removes the certificate warnings)
    does that clarify anymore?
    Cheers
    Kam

  • I have an iMac protected by Intego. If I buy an iPhone 6 and it gets hacked, will by iMac be vulnerable?

    I have an iMac protected by Intego. If I buy an iPhone 6 and it gets hacked, will by iMac be vulnerable?

    Mac users often ask whether they should install "anti-virus" (AV) software. The usual answer is "no." That answer is right, but it may give the wrong impression that there is no threat from what are loosely called "viruses." There is a threat, and you need to educate yourself about it.
    1. This is a comment on what you should—and should not—do to protect yourself from malicious software ("malware") that circulates on the Internet and gets onto a computer as an unintended consequence of the user's actions.
    It does not apply to software, such as keystroke loggers, that may be installed deliberately by an intruder who has hands-on access to the computer, or who has been able to take control of it remotely. That threat is in a different category, and there's no easy way to defend against it. AV software is not intended to, and does not, defend against such attacks.
    The comment is long because the issue is complex. The key points are in sections 5, 6, and 10.
    OS X now implements three layers of built-in protection specifically against malware, not counting runtime protections such as execute disable, sandboxing, system library randomization, and address space layout randomization that may also guard against other kinds of exploits.
    2. All versions of OS X since 10.6.7 have been able to detect known Mac malware in downloaded files, and to block insecure web plugins. This feature is transparent to the user. Internally Apple calls it "XProtect."
    The malware recognition database used by XProtect is automatically updated; however, you shouldn't rely on it, because the attackers are always at least a day ahead of the defenders.
    The following caveats apply to XProtect:
    ☞ It can be bypassed by some third-party networking software, such as BitTorrent clients and Java applets.
    ☞ It only applies to software downloaded from the network. Software installed from a CD or other media is not checked.
    As new versions of OS X are released, it's not clear whether Apple will indefinitely continue to maintain the XProtect database of older versions such as 10.6. The security of obsolete system versions may eventually be degraded. Security updates to the code of obsolete systems will stop being released at some point, and that may leave them open to other kinds of attack besides malware.
    3. Starting with OS X 10.7.5, there has been a second layer of built-in malware protection, designated "Gatekeeper" by Apple. By default, applications and Installer packages downloaded from the network will only run if they're digitally signed by a developer with a certificate issued by Apple. Software certified in this way hasn't been checked for security by Apple unless it comes from the App Store, but you can be reasonably sure that it hasn't been modified by anyone other than the developer. His identity is known to Apple, so he could be held legally responsible if he distributed malware. That may not mean much if the developer lives in a country with a weak legal system (see below.)
    Gatekeeper doesn't depend on a database of known malware. It has, however, the same limitations as XProtect, and in addition the following:
    ☞ It can easily be disabled or overridden by the user.
    ☞ A malware attacker could get control of a code-signing certificate under false pretenses, or could simply ignore the consequences of distributing codesigned malware.
    ☞ An App Store developer could find a way to bypass Apple's oversight, or the oversight could fail due to human error.
    Apple has taken far too long to revoke the codesigning certificates of some known abusers, thereby diluting the value of Gatekeeper and the Developer ID program. Those lapses don't involve App Store products, however.
    For the reasons given, App Store products, and—to a lesser extent—other applications recognized by Gatekeeper as signed, are safer than others, but they can't be considered absolutely safe. "Sandboxed" applications may prompt for access to private data, such as your contacts, or for access to the network. Think before granting that access. Sandbox security is based on user input. Never click through any request for authorization without thinking.
    4. Starting with OS X 10.8.3, a third layer of protection has been added: a "Malware Removal Tool" (MRT). MRT runs automatically in the background when you update the OS. It checks for, and removes, malware that may have evaded the other protections via a Java exploit (see below.) MRT also runs when you install or update the Apple-supplied Java runtime (but not the Oracle runtime.) Like XProtect, MRT is effective against known threats, but not against unknown ones. It notifies you if it finds malware, but otherwise there's no user interface to MRT.
    5. The built-in security features of OS X reduce the risk of malware attack, but they are not, and never will be, complete protection. Malware is a problem of human behavior, not machine behavior, and no technological fix alone is going to solve it. Trusting software to protect you will only make you more vulnerable.
    The best defense is always going to be your own intelligence. With the possible exception of Java exploits, all known malware circulating on the Internet that affects a fully-updated installation of OS X 10.6 or later takes the form of so-called "Trojan horses," which can only have an effect if the victim is duped into running them. The threat therefore amounts to a battle of wits between you and Internet criminals. If you're better informed than they think you are, you'll win. That means, in practice, that you always stay within a safe harbor of computing practices. How do you know when you're leaving the safe harbor? Below are some warning signs of danger.
    Software from an untrustworthy source
    ☞ Software with a corporate brand, such as Adobe Flash Player, doesn't come directly from the developer’s website. Do not trust an alert from any website to update Flash, or your browser, or any other software. A genuine alert that Flash is outdated and blocked is shown on this support page. Follow the instructions on the support page in that case. Otherwise, assume that the alert is fake and someone is trying to scam you into installing malware. If you see such alerts on more than one website, ask for instructions.
    ☞ Software of any kind is distributed via BitTorrent, or Usenet, or on a website that also distributes pirated music or movies.
    ☞ Rogue websites such as Softonic, Soft32, and CNET Download distribute free applications that have been packaged in a superfluous "installer."
    ☞ The software is advertised by means of spam or intrusive web ads. Any ad, on any site, that includes a direct link to a download should be ignored.
    Software that is plainly illegal or does something illegal
    ☞ High-priced commercial software such as Photoshop is "cracked" or "free."
    ☞ An application helps you to infringe copyright, for instance by circumventing the copy protection on commercial software, or saving streamed media for reuse without permission. All "YouTube downloaders" are in this category, though not all are necessarily malicious.
    Conditional or unsolicited offers from strangers
    ☞ A telephone caller or a web page tells you that you have a “virus” and offers to help you remove it. (Some reputable websites did legitimately warn visitors who were infected with the "DNSChanger" malware. That exception to this rule no longer applies.)
    ☞ A web site offers free content such as video or music, but to use it you must install a “codec,” “plug-in,” "player," "downloader," "extractor," or “certificate” that comes from that same site, or an unknown one.
    ☞ You win a prize in a contest you never entered.
    ☞ Someone on a message board such as this one is eager to help you, but only if you download an application of his choosing.
    ☞ A "FREE WI-FI !!!" network advertises itself in a public place such as an airport, but is not provided by the management.
    ☞ Anything online that you would expect to pay for is "free."
    Unexpected events
    ☞ A file is downloaded automatically when you visit a web page, with no other action on your part. Delete any such file without opening it.
    ☞ You open what you think is a document and get an alert that it's "an application downloaded from the Internet." Click Cancel and delete the file. Even if you don't get the alert, you should still delete any file that isn't what you expected it to be.
    ☞ An application does something you don't expect, such as asking for permission to access your contacts, your location, or the Internet for no obvious reason.
    ☞ Software is attached to email that you didn't request, even if it comes (or seems to come) from someone you trust.
    I don't say that leaving the safe harbor just once will necessarily result in disaster, but making a habit of it will weaken your defenses against malware attack. Any of the above scenarios should, at the very least, make you uncomfortable.
    6. Java on the Web (not to be confused with JavaScript, to which it's not related, despite the similarity of the names) is a weak point in the security of any system. Java is, among other things, a platform for running complex applications in a web page, on the client. That was always a bad idea, and Java's developers have proven themselves incapable of implementing it without also creating a portal for malware to enter. Past Java exploits are the closest thing there has ever been to a Windows-style virus affecting OS X. Merely loading a page with malicious Java content could be harmful.
    Fortunately, client-side Java on the Web is obsolete and mostly extinct. Only a few outmoded sites still use it. Try to hasten the process of extinction by avoiding those sites, if you have a choice. Forget about playing games or other non-essential uses of Java.
    Java is not included in OS X 10.7 and later. Discrete Java installers are distributed by Apple and by Oracle (the developer of Java.) Don't use either one unless you need it. Most people don't. If Java is installed, disable it—not JavaScript—in your browsers.
    Regardless of version, experience has shown that Java on the Web can't be trusted. If you must use a Java applet for a task on a specific site, enable Java only for that site in Safari. Never enable Java for a public website that carries third-party advertising. Use it only on well-known, login-protected, secure websites without ads. In Safari 6 or later, you'll see a padlock icon in the address bar when visiting a secure site.
    Stay within the safe harbor, and you’ll be as safe from malware as you can practically be. The rest of this comment concerns what you should not do to protect yourself.
    7. Never install any commercial AV or "Internet security" products for the Mac, as they are all worse than useless. If you need to be able to detect Windows malware in your files, use one of the free security apps in the Mac App Store—nothing else.
    Why shouldn't you use commercial AV products?
    ☞ To recognize malware, the software depends on a database of known threats, which is always at least a day out of date. This technique is a proven failure, as a major AV software vendor has admitted. Most attacks are "zero-day"—that is, previously unknown. Recognition-based AV does not defend against such attacks, and the enterprise IT industry is coming to the realization that traditional AV software is worthless.
    ☞ Its design is predicated on the nonexistent threat that malware may be injected at any time, anywhere in the file system. Malware is downloaded from the network; it doesn't materialize from nowhere. In order to meet that nonexistent threat, commercial AV software modifies or duplicates low-level functions of the operating system, which is a waste of resources and a common cause of instability, bugs, and poor performance.
    ☞ By modifying the operating system, the software may also create weaknesses that could be exploited by malware attackers.
    ☞ Most importantly, a false sense of security is dangerous.
    8. An AV product from the App Store, such as "ClamXav," has the same drawback as the commercial suites of being always out of date, but it does not inject low-level code into the operating system. That doesn't mean it's entirely harmless. It may report email messages that have "phishing" links in the body, or Windows malware in attachments, as infected files, and offer to delete or move them. Doing so will corrupt the Mail database. The messages should be deleted from within the Mail application.
    An AV app is not needed, and cannot be relied upon, for protection against OS X malware. It's useful, if at all, only for detecting Windows malware, and even for that use it's not really effective, because new Windows malware is emerging much faster than OS X malware.
    Windows malware can't harm you directly (unless, of course, you use Windows.) Just don't pass it on to anyone else. A malicious attachment in email is usually easy to recognize by the name alone. An actual example:
    London Terror Moovie.avi [124 spaces] Checked By Norton Antivirus.exe
    You don't need software to tell you that's a Windows trojan. Software may be able to tell you which trojan it is, but who cares? In practice, there's no reason to use recognition software unless an organizational policy requires it. Windows malware is so widespread that you should assume it's in every email attachment until proven otherwise. Nevertheless, ClamXav or a similar product from the App Store may serve a purpose if it satisfies an ill-informed network administrator who says you must run some kind of AV application. It's free and it won't handicap the system.
    The ClamXav developer won't try to "upsell" you to a paid version of the product. Other developers may do that. Don't be upsold. For one thing, you should not pay to protect Windows users from the consequences of their choice of computing platform. For another, a paid upgrade from a free app will probably have all the disadvantages mentioned in section 7.
    9. It seems to be a common belief that the built-in Application Firewall acts as a barrier to infection, or prevents malware from functioning. It does neither. It blocks inbound connections to certain network services you're running, such as file sharing. It's disabled by default and you should leave it that way if you're behind a router on a private home or office network. Activate it only when you're on an untrusted network, for instance a public Wi-Fi hotspot, where you don't want to provide services. Disable any services you don't use in the Sharing preference pane. All are disabled by default.
    10. As a Mac user, you don't have to live in fear that your computer may be infected every time you install software, read email, or visit a web page. But neither can you assume that you will always be safe from exploitation, no matter what you do. Navigating the Internet is like walking the streets of a big city. It can be as safe or as dangerous as you choose to make it. The greatest harm done by security software is precisely its selling point: it makes people feel safe. They may then feel safe enough to take risks from which the software doesn't protect them. Nothing can lessen the need for safe computing practices.

  • Single edition and p12 certificate

    Two questions:
    1 - Using Single edition will I only need the serial number (Adobe single edition number) to publish on the app store? I've been finding conflicting information saying, yes, it's possible on the Adobe site, and then another source saying I would need either Professional or Enterprise to make the viewer "public" rather than "private." It seems with single edition I only have the "private" option available.
    2 - I am building the app for a university. In order to sign the distribution app, I've downloaded the distribution mobileprovision file from the university's ios developer site. I can't create a p12 certificate using the university's distribution certificate on my computer.
    I found this webpage describing how to transfer what I think I need: exporting your signing and provisioning assets from the one Mac and importing them to the other.
    http://developer.apple.com/library/ios/#documentation/Xcode/Conceptual/ios_development_wor kflow/10-Configuring_Development_and_Distribution_Assets/identities_and_devices.html#//app le_ref/doc/uid/TP40007959-CH4-SW8
    After my university contact sent me their p12 certificate, I'm having the following error message, "Not finding expected label 'iPhone Distribution:' in this certificate."
    Can you tell me how to solve both issues?

    1. In Single edition Workflow, you do not have an option to publish as Public, thus publish as Private then you would need to export the Folio and import it in Viewer Builder while building the App. Use the serial number to activate your build for download.
    Read the following link for more on the workflow:
    http://help.adobe.com/en_US/digitalpubsuite/using/WS67cb9e293e2f1f6032817afa1337a03d59b-7f ff.html
    2. Read the iPad publishing guide for creating required certificates (Attached). It's best if you complete the whole certificate process on a Single Mac using keychain Access to avoid complications. While creating certificates, remember to de-select enable for iCloud. I would recommend going though the guide in detail and follow step by step process as mentioned in the guide.

  • Private key and digital certificate

    I have a keystore . in ordeer to know what it contains ,i opened this keystore with this command ...keytool -list -keystore DemoIdentity.jks
    and i got,
    Keystore type: jks
    Keystore provider: SUN
    Your keystore contains 1 entry
    demoidentity, Jan 4, 2007, keyEntry, // is it called private key ?
    Certificate fingerprint (MD5): 60:42:75:33:31:AA:9A:C6:9D:1A:CD:9F:22:8D:4A:6A // is it called certificate ?
    Question :
    I still dont understand what a keystore contains. does it contains "private key" + "digital certificate" ?
    If so , what are private keys and digital certificate in the above contents ?
    Message was edited by:
    Unknown_Citizen
    Message was edited by:
    Unknown_Citizen

    The content of a 'keystore' is what you, or the person who provided it, put in it. In this case it looks like all it contains it a public key certificate with an alias of 'demoidentity' .

  • I'm currently running ios 5 beta on my iphone 4 and when i woke up this morning my phone had decided to automatically update the software OTA. After connecting to wifi and switching on location i proceeded to follow the instructions 'slide to setup'. I wa

    I'm currently running ios 5 beta on my iphone 4 and when i woke up this morning my phone had decided to automatically update the software OTA. After connecting to wifi and switching on location i proceeded to follow the instructions 'slide to setup'. I was informed that it may take 3 minutes to activate phone but was then presented with the screen 'Could not Activate iphone', this is because the activation server is unavailable. Can anybody shed some light on this for me?
    Many thanks

    Can anybody shed some light on this for me?
    Not here. iOS5 beta is only available to registered developers, and discussing it publicly outside of the private developer forums is a violation of the non-disclosure agreement you signed to access the beta.

  • Need suggestion for ISE distributed deployment model in two different data centers along with public certificate for HTTPS

    Hi Experts,
    I am bit confused about ISE distributed deployment model .
    I have two data centers one is DC & other one is as a DR I have  requirement of guest access service implementation using CWA and get public certificate for HTTPS to avoid certificate error on client devices :
    how do i deploy ISE persona for HA in this two data centers
    After reading cisco doc , understood that we can have two PAN ( Primary in DC  & Secondary in DR ) like wise for MnT (Monitoring will be as same as PAN ) however I can have 5 PSN running in secondary i.e. in DR ISE however I have confusion about HA for PSN .. since we have all PSN in secondary , it would not work for HA if it fails
    Can anybody suggest me the best deployment solution for this scenario ?
    Another doubt about public certificate :
     Public Certificate: The ISE domain must be a registered or part of a registered domain name on the Internet. for that I need Domain name being used from customer .
    Please do correct me if I am wrong about certificate understanding :
    since Guest will be the outside users , we can not use certificate from internal CA , we need to get the certificate from service provider and install the same in both the ISE servers
    Can anybody explain the procedure to opt the public certificate for HTTPS from service provider ? And how do i install it in both the ISE servers ?

    Hi there. Let me try answering your questions:
    PSN HA: The PSNs are not configured as "primary" or "secondary" inside your ISE deployment. They are just PSN nodes as far as ISE is concerned. Instead, inside your NADs (In your case WLCs) you can specify which PSN is primary, which one is secondary, etc. You can accomplish this by:
    1. Defining all PSN nodes as AAA radius servers inside the WLC
    2. Then under the SSID > AAA Servers Tab, you can list the AAA servers in the order that you prefer. As a result, the WLC will always use the first server listed until that server fails/gets reloaded, etc. 
    3. As a result, you can have one WLC or SSID prefer PSN server A (located in primary DC) while a second WLC or SSID prefer PSN server B (located in backup DC)
    Last but not the least, you could also place PSNs behind a load balancer and that way the traffic would be equally distributed between multiple PSNs. However, the PSN nodes must be Layer 2 adjacent, which is probably not the case if they are located in two different Data Centers
    Certificates: Yes, you would want to get a public certificate to service the guest portal. Getting a public/well known certificate would ensure that most devices out there would trust the CA that signed your ISE certificate. For instance, VeriSign, GoDaddy, Entrust are some of the ones out there that would work just fine. On the other hand, if you use a certificate that was signed by your internal CA, then things would be fine for your internal endpoints that trust your internal CA but for any outsiders (Guests, contractors, etc) that do not trust and do not know who your internal CA is would get a certificate error when being redirected to the ISE guest portal. This in general is only a "cosmetic" issue and if the users click "continue" and add your CA as a trusted authority, the guest page would load and the session would work. However, most users out there would not feel safe to proceed and you will most likely get a lot of calls to your helpdesk :)
    I hope this helps!
    Thank you for rating helpful posts!

  • Howto use SSL-2 (https) and .pfx certificate in SOAP cc - padding error!

    I'm working on a rfc to soap scenario in PI 7.1, and I must connect PI to some external web services through https.
    We must use a two-sided SSL connection (SSL-2), we received a .pfx certificate to achieve this.
    SAP Basis installed the certificate in the (java)nwa. In the SOAP communication channel i can choose the installed ceritifcate when i set the 'Configure Certificate Authentication'. Tried this, got the "error: iaik.security.ssl.SSLException: Padding length error: 106"
    Other option tried is to set the 'Select security profile'and choose Web Services Security. Then in the receiver agreement i can set the certificate for the encryption and/or decryption. Various scenario's tried, not succesful. We've seen that the pfx certificate contains two certificates (private and public one). But in the receiver agreement there is no choice between those two, we can only select the .pfx
    We also added a user with transaction EXTID_DN. Still got the same error.
    Does somebody have a suggestion what to do?  Must we split the .pfx certificate in two separate files/certificates?  Do we use the incorrect DN/CN in the EXTID_DN?

    Hi,
    What is your requirement ? The "2-sides" concept of SSL, what is it exactly ? Or does it simply mean that you're going to connect to a SSL target providing a SSL client certificate ?
    Usually, you import the SSL target's CA chain (ie Verisign CAs, etc) into the NWA key store, provide the CA chain for your own SSL client cerificate to the target and configure channels accordingly
    Rgds
    Chris

  • I have an old iphone 3gs which is backed up on itunes. bought a new iphone 4gs and need to back it up. will syncing new phone erase old 3gs data?

    i have an old iphone 3gs which is backed up on itunes. bought a new iphone 4gs and need to back it up. will syncing new phone erase old 3gs data?

    This is not very iTunes Public Site Manager related... but I was in the same situation as you a little while ago.
    1 - Sync/back up your old 3gs.
    2 - Activatie your new phone when connected to itunes via cable and it will ask you if you want to restore our old phone.
    3 - ???
    4 - profitt!
    might also work with icloud but i have not tried that method.

  • Restore my Iphone on a Public PC

    How can i restore my iphone from a public computer. the library wont let you download itunes and i dont have my own PC
    HELPPPPPPPPPPP ???
    i also dont have icloud as a backup option as i didnt use it...
    Any suggestions..

    Visit an Apple Store and they will do it for you for free. Make an appointment first: Apple - Concierge
    Or ask a friend willing to install iTunes to help.

  • Powershell to classify files ( confidential, highly confidential, Business use, and Public ) and encrypt it for confidential & highly confidential types.

    Hello Experts  !!
    I am wondering if PowerShell can be used to classify files (  confidential, highly confidential, Business use, and Public ) and encrypt it for confidential & highly confidential types.
    I found some material for Windows Server 2008 R2 and Windows 8.1 but that doesn't seem convincing. I need it for Xp and Windows 7.
    Thanks !

    You may want to consider using FCI (File Classification Infrastructure) in Server 2012 R2. You will need FSRM (File Server Resource Manager), AD RMS (Active Directory Management Services), AD CS (Active Directory Certificate Services, and DAS (Dynamic Access
    Control). You will also need a 2012 level forest and domain, and KDC support for claims, compound authentication, and Kerberos armoring. 
    Microsoft has already developed the software foundation to do exactly what you're looking for at an enterprise scale. It may be easier to implement it, instead of reinventing the wheel..
    Sam Boutros, Senior Consultant, Software Logic, KOP, PA http://superwidgets.wordpress.com (Please take a moment to Vote as Helpful and/or Mark as Answer, where applicable)

  • How many Public Certificate do I need for Edge federation with Skype

    Hi All,
    I am trying to setup Lync 2013 with Edge to federate with Skype.
    Now how many Public CA do i need to be able to setup Lync Edge to federate with Skype,.
    Thank you,

    Hi,
    You need to have to add the CA where you're getting the public certificate from. By default, most common Trusted CA's are included in to the Windows OS it self and does not need to be added manually.
    Z-Hire -- Automate Lync User Account creation process ( AD / Exchange / Lync )

  • WS-Security:  Fail to configure Keystore and Identity Certificates

    Hi,
    This is my first question here!
    I want to set a secure web service, following the guide "Web Services Security Guide" i set up the keystore and Identity Certificates with a keystore that contains two certificates created by me, I set the keys to be used as signature and encryption. Not define any method for authentication.
    I deployed the application to the server (oc4j_extended_101350) and up to this point apparently everything went well.
    I created a web service proxy to test the web service with jdeveleper, but when I call the web service method the server responds with the error:
    java.rmi.ServerException:
    start fault message:
    Internal Server Error
    : End fault message
    at oracle.j2ee.ws.client.StreamingSender._raiseFault (StreamingSender.java: 571)
    at oracle.j2ee.ws.client.StreamingSender._sendImpl (StreamingSender.java: 401)
    at oracle.j2ee.ws.client.StreamingSender._send (StreamingSender.java: 114)
    at clientmessageoc4jstda.proxy.runtime.MyWebService1SoapHttp_Stub.getHelloWorld (MyWebService1SoapHttp_Stub.java: 77)
    at clientmessageoc4jstda.proxy.MyWebService1SoapHttpPortClient.getHelloWorld (MyWebService1SoapHttpPortClient.java: 42)
    at clientmessageoc4jstda.proxy.MyWebService1SoapHttpPortClient.main (MyWebService1SoapHttpPortClient.java: 30)
    On the server the following error occurs:
    ERROR OWS-04005 error has occurred on port: () http://messagelevelsecurity/ MyWebService1SoapHttpPort: oracle.j2ee.ws.common.soap.fault.SOAP11FaultException: java.lang.NullPointerException.
    The client and server are not in the same directory.
    The class exposed by the web service is a simple Hello World.
    public class HelloWorld {
    public HelloWorld() {
    public String getHelloWorld(){
    return "Hello World";
    Thanks in advance
    I apologize for my English

    I had to add : " outProps.put(WSHandlerConstants.SIG_KEY_ID, "DirectReference");" to the client code and it started working !

  • How to sign iPhone application using developer certificates

    Hello,
    will anyone tell me that how to sign the iPhone application using developer certificate and one more thing that how will i get the developer certificate.
    Thanks

    ya i got the solution, just go through the following link...
    you will also know how we do that..
    http://developer.apple.com/iphone/library/documentation/Xcode/Conceptual/iphonedevelopment/120-Running_Applications/runningapplications.html
    http://developer.apple.com/iphone/library/documentation/Xcode/Conceptual/iphonedevelopment/128-Managing_Devices/devices.html#//appleref/doc/uid/TP40007959-CH4-SW38

Maybe you are looking for