ISE Certificate Authority Certificate

I'm confussed about the certificates:
Some weeks ago a certificate was installed in the ISE to avoid the browser certificate error when the customer access the sponsor portal ...
Now, the customer is requesting to authenticate the sponsor users through LDAPS ... I understand Active Directory or LDAP as External Identity Sources are not secure. So, in order to enable LDAPS we must check the Secure Atuthentication box in the LDAP configuration, but a ROOT CA must be chooseen also.
I understand the ISE should validate the customer PKI in order to validate the user certificate ... Am I right?
Do I need request the customer to provide me the "Certificate Authority Certificate" from its PKI ??
Is it a file completely different to the certificate already loaded in the ISE ??
With this certificate, would the ISE validate the user's computer certificate additional to user and password ??
Would the user must use a computer with certificate in order to access the sponsor portal ??
Thanks in advance.
Regards
Daniel Escalante.

Please follow the "secure authentication tab" in the below table( highlighted)
go to >LDAP Connection Settings
Table lists the fields in the LDAP connection tab and their descriptions.
Table : LDAP Connection Tab
Option Description
Enable Secondary Server
Check this option to enable the secondary LDAP server to be used as a backup in the event that the primary LDAP server fails. If you check this check box, you must enter configuration parameters for the secondary LDAP server.
Primary and Secondary Servers
Hostname/IP
(Required) Enter the IP address or DNS name of the machine that is running the LDAP software. The hostname can contain from 1 to 256 characters or a valid IP address expressed as a string. The only valid characters for hostnames are alphanumeric characters (a to z, A to Z, 0 to 9), the dot (.), and the hyphen (-).
Port
(Required) Enter the TCP/IP port number on which the LDAP server is listening. Valid values are from 1 to 65,535. The default is 389, as stated in the LDAP specification. If you do not know the port number, you can find this information from the LDAP server administrator.
Access
(Required) Anonymous Access—Click to ensure that searches on the LDAP directory occur anonymously. The server does not distinguish who the client is and will allow the client read access to any data that is configured as accessible to any unauthenticated client. In the absence of a specific policy permitting authentication information to be sent to a server, a client should use an anonymous connection.
Authenticated Access—Click to ensure that searches on the LDAP directory occur with administrative credentials. If so, enter information for the Admin DN and Password fields.
Admin DN
Enter the DN of the administrator. The Admin DN is the LDAP account that permits searching of all required users under the User Directory Subtree and permits searching groups. If the administrator specified does not have permission to see the group name attribute in searches, group mapping fails for users who are authenticated by that LDAP.
Password
Enter the LDAP administrator account password.
Secure Authentication
Click to use SSL to encrypt communication between Cisco ISE and the primary LDAP server. Verify that the Port field contains the port number used for SSL on the LDAP server. If you enable this option, you must choose a root CA.
Root CA
Choose a trusted root certificate authority from the drop-down list box to enable secure authentication with a certificate.
See the "Certificate Authority Certificates" section on page 12-17 and "Adding a Certificate Authority Certificate" section on page 12-19 for information on CA certificates.
Server Timeout
Enter the number of seconds that Cisco ISE waits for a response from the primary LDAP server before determining that the connection or authentication with that server has failed. Valid values are 1 to 300. The default is 10.
Max. Admin Connections
Enter the maximum number of concurrent connections (greater than 0) with LDAP administrator account permissions that can run for a specific LDAP configuration. These connections are used to search the directory for users and groups under the User Directory Subtree and the Group Directory Subtree. Valid values are 1 to 99. The default is 20.
Test Bind to Server
Click to test and ensure that the LDAP server details and credentials can successfully bind. If the test fails, edit your LDAP server details and retest.

Similar Messages

ISE 1.1.1 don't have certificate authority certificate anymore?

Hi all,
i am working on ISE 1.1.1, surprisingly i couldn't found certificate authority certifiate at certificate operation anymore.
would it be the change on GUI? So now where i can import the CA certificate to ISE?
Thanks
Noel

Hi,
The document is pretty clear and the directions are stated here:
http://www.cisco.com/en/US/docs/security/ise/1.1.1/user_guide/ise_man_cert.html#wp1053515
Thanks,
Tarik Admani
*Please rate helpful posts*

Certificate Authority certificate issued with incorrect hash algorithm

Hi all,
We have a certificate authority which was migrated from Server 2003 to 2008R2, the issue is that after running this command:
certutil -setreg ca\csp\CNGHashAlgorithm sha256
to upgrade the CA to SHA256, we renewed the CA certificate but the certificate still renewed using SHA1. The cryptographic settings in the CA properties dialog box says SHA256 however the certificate is issued using SHA1. Here is the image:
Any pointers to how we can reissue CA certificate with SHA256 algorithm?
Thanks,
Ojas

[Puneet Singh] What i feel is that your initial key which was generated was CAPI based that might be the reason you might be facing the problem.
Try to do the things in below sequence.
certification authority’s system, you will need to run the following commands from an elevated command line window:
certutil -setreg ca\csp\CNGHashAlgorithm SHA256
net stop certsvc
net start certsvc
Make sure you are using a Key Storage Provider that supports SHA256 – for example the Microsoft Key Storage Provider -
and then renew the certification authority’s certificate.
if you have the CAPI provider or you are CAPI based key then you have to convert it to CNG key and use certutil
repair so that it does start using the CNG key.
Puneet Singh

Asking specific client certificate (not certificates trusted by authority)

As I understand from what I read so far, during the handshake negotiation for two way ssl, the server sends the client a list of trusted certificate authorities and say to the client: "hey, those are the authorities I trust. send me a certificate that can be verified by one of them".
I also read how you can customize SSLSocketFactory to, on the client side, look for a specific certificate alias (http://www.ibm.com/developerworks/java/library/j-customssl/). I would like to move this idea further and ask for specific certificates depending on what resources the user is trying to access.
For example:
Let's suppose I have two resources on my server called "bobPrivateStuff" and "alicePrivateStuff". I also have a certificate authority who can validate both Bob and Alice certificates on a custom trust keystore. In a regular scenario, the server will ask for a client certificate and will accept either Alice or Bob certificate, as both can be verified by the custom trust.
But what if Alice can't access "bobPrivateStuff"? What if when trying to open a connection, to say http://myserver.com/services/bobPrivateStuff, the server asks specifically for Bob's certificate? Can I setup the handshake in a way it will actually ask for Bob's certificate instead of only just "any certificated trusted by this CA"?
And what piece of information could be used to distinguish one certificate from another? Is the serial number unique between multiple certificates? Is this pushing the envelop too much and trying to use SSL for more than what it is intended for?

I agree 100%. It's just that we want to use certificates to validate the client's identity (instead of relying on username/password).Fine, that's exactly what SSL & PKI will do for you.
It might not be elegantBut it is!
See my point?Of course I see your point. SSL already does that. I said that. You agreed. I agree. What it doesn't do is the authorization part. Because it can't. It isn't meant to. You are supposed to do that.
Instead of the server asking for a specific certificate, it justs checks if the certificate sent by the client has access to the resource.Not quite. It should check if the identity represented by the client certificate (Certificate.getSubjectX500Principal(), or SSLSocket.getSession().getPeerPrincipal()) has access to the resource.
This way, we can leave the server untouchedNo you can't. The server has to get hold of the client principal after the handshake and authorize it against the resource.
if Bob wants to access some resources, Bob has to prove he is who he says he is.You're still confused. That's authentication, and SSL already does that for you. SSLSocket.getSession().getPeerPrincipal() returns you the authenticated identity of the peer. The server then has to check that that identity can access that resource. This is 'authorization'. You can't automate it via keystores and truststores. That's not what they do and it's not what they're for.
So I think it is perfectly plausible to do this kind of verification on the server side (i.e. "hijack" a certificate sent to validate the ssl handshake to also verify if the user has the correct privileges).There's no 'hijacking' about it, but you're concentrating on the certificate instead of the identity it represents. A client could have a large number of certificates that all authenticate the same identity. You need to think in terms of authorizing Principals to access resources.

How do I set up my own certificate authority

I tried google on the above question, and the most recent thing I found was 7 years old. replacing the phrase used generates a lot of hits with a very poor signal to noise ratio.
I have OpenSSL (in the cygwin distribution), which is quite recent, but frankly its documentation leaves just about everything to be desired. I found pyca, but it has no documentation at all (and it is a couple years old).
I tried the steps appended below, but invariably the attempt to sign the certificates fails with an obscure error message about OpenSSL not finding one thing or another.
At this stage, I just don't care whether I do this using something in the J2SDK such as keytool or OpenSSL, as long as I can get it done. Or if there is some other opensource software tool I can use, terrific. This is primarily for the purpose of securing communications within an Intranet, and secondarily for signing applets and applications distributed through WebStart. If I am not mistaken, I'll need a certificate for each of my servers. Right?
If you know of an URL where this is well explained and illustrated, great. Give that to me.
Otherwise, a simple illustration (or a correction of what I've appended below) would be appreciated. I believe I understand what ought to be happening. It ought to be rather simple to do, but there are these irritating and frustrating minor details getting in the way. For example, the steps I show below seem simple, but everything appears to get messed up by some of the contents of openssl.cnf in 'usr/ssl', in the cygwin directory, and there is no explanation of how to set things up for the first time you use OpenSSL within Cygwin (or on unix for that matter).
Any assistance would be appreciated.
Thanks,
Ted
========failed attempt=====================
# Generation of Certificate Authority(CA)
openssl req -new -x509 -keyout cakey.pem -out cacert.pem -config /usr/ssl/openssl.cnf
# Create server request and key
openssl req -new -keyout server-key.pem -out server-req.pem -days 36502 -config /usr/ssl/openssl.cnf
# Remove the passphrase from the key
openssl rsa -in server-key.pem -out server-key.pem
# Sign server cert
openssl ca -policy policy_anything -out server-cert.pem -infiles server-req.pem -config /usr/ssl/openssl.cnf
# Create client request and key
openssl req -new -keyout client-key.pem -out client-req.pem -days 36502 -config /usr/ssl/openssl.cnf
# Remove a passphrase from the key
openssl rsa -in client-key.pem -out client-key.pem
# Sign client cert
openssl ca -policy policy_anything -out client-cert.pem -infiles client-req.pem -config /usr/ssl/openssl.cnf

The following works for me:
NB: Some of the output has been removed in the interests of privacy (this will not affect the outcome)
1. Create CA key and certificate
1.1 Create a new file called "serial" containing the value "01".
1.2 Create an empty file "index.txt"
1.3 Create a subdirectory "newcerts"
1.4 Execute.... create a key for your CA
[ben@localhost ca]$ openssl genrsa -out ca.key 2048
Generating RSA private key, 2048 bit long modulus
.....................................+++
..........................................................+++
e is 65537 (0x10001)
1.5 Execute... create a certificate for your own CA
[ben@localhost ca]$ openssl req -config ./openssl.cnf -new -x509 -key ca.key -out cacert.pem -days 365
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
Country Name (2 letter code) [GB]:
County or State (full name) []:
City or town (eg, Hitchin) []:
Organization Name (eg, company) []:
Organizational Unit Name (eg, section) []:
Common Name (eg, your name or your server's hostname) []:
Email Address []:
2. Create PK key and .csr
2.1 Execute...
[ben@localhost ca]$ keytool -genkey -alias PK
Enter keystore password: password
What is your first and last name?
[Unknown]:
What is the name of your organizational unit?
[Unknown]:
What is the name of your organization?
[Unknown]:
What is the name of your City or Locality?
[Unknown]:
What is the name of your State or Province?
[Unknown]:
What is the two-letter country code for this unit?
[Unknown]:
Is CN=, OU=, O=, L=, ST=, C=GB correct?
[no]: yes
Enter key password for <PK>
(RETURN if same as keystore password):
2.2 Create .csr
[ben@localhost ca]$ keytool -certreq -alias PK -file PK.csr
Enter keystore password: password
3. Sign PK with CA cert
[ben@localhost ca]$ openssl ca -config ./openssl.cnf -in PK.csr -out PK.pem -keyfile ca.key -days 365
Using configuration from ./openssl.cnf
Check that the request matches the signature
Signature ok
Certificate Details:
Serial Number: 0 (0x0)
Validity
Not Before: Jan 5 19:48:33 2006 GMT
Not After : Jan 5 19:48:33 2007 GMT
Subject:
countryName = GB
stateOrProvinceName =
organizationName =
organizationalUnitName =
commonName =
X509v3 extensions:
X509v3 Basic Constraints:
CA:FALSE
Netscape Comment:
OpenSSL Generated Certificate
X509v3 Subject Key Identifier:
D6:2D:7E:71:77:9E:1A:BB:54:69:98:63:6A:6A:E2:BA:12:C4:D7:DD
X509v3 Authority Key Identifier:
keyid:92:7C:33:7C:EC:1D:76:C5:B8:F0:30:6D:10:12:40:E5:E7:EA:24:31
DirName:/C=GB/ST=/L=/O=/OU=/CN=/emailAddress=
serial:F0:D1:38:36:65:6D:71:D5
Certificate is to be certified until Jan 5 19:48:33 2007 GMT (365 days)
Sign the certificate? [y/n]:y
1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated
4. Convert PK certificate into DER format
[ben@localhost ca]$ openssl x509 -in PK.pem -out PK.der -outform DER
5. Import CA certificate into keystores
[ben@localhost ca]$ keytool -import -alias ca -file cacert.pem
Enter keystore password: password
Owner: EMAILADDRESS=, CN=, OU=, O=, L=, ST=, C=GB
Issuer: EMAILADDRESS=, CN=, OU=, O=, L=, ST=, C=GB
Serial number: f0d13836656d71d5
Valid from: Thu Jan 05 19:41:09 GMT 2006 until: Fri Jan 05 19:41:09 GMT 2007
Certificate fingerprints:
MD5: AF:3D:8E:25:12:24:04:1F:40:70:BC:A0:9E:0E:44:84
SHA1: B8:E8:0B:A5:86:33:21:0C:B5:3C:6E:F2:DE:7B:31:0F:59:AE:21:E4
Trust this certificate? [no]: yes
Certificate was added to keystore
6. Import signed PK into keystore
[ben@localhost ca]$ keytool -import -alias pk -file PK.der
Enter keystore password: password
Certificate reply was installed in keystore
REF:
http://www.yorku.ca/dkha/docs/jsse_cert/jsse_cert.htm
http://httpd.apache.org/docs/2.2/ssl/ssl_faq.html#ownca
http://www.openssl.org/docs/apps/ca.html#
openssl.cnf:#
# OpenSSL example configuration file.
# This is mostly being used for generation of certificate requests.
# This definition stops the following lines choking if HOME isn't
# defined.
HOME               = .
RANDFILE          = $ENV::HOME/.rnd
# Extra OBJECT IDENTIFIER info:
#oid_file          = $ENV::HOME/.oid
oid_section          = new_oids
# To use this configuration file with the "-extfile" option of the
# "openssl x509" utility, name here the section containing the
# X.509v3 extensions to use:
# extensions          =
# (Alternatively, use a configuration file that has only
# X.509v3 extensions in its main [= default] section.)
[ new_oids ]
# We can add new OIDs in here for use by 'ca' and 'req'.
# Add a simple OID like this:
# testoid1=1.2.3.4
# Or use config file substitution like this:
# testoid2=${testoid1}.5.6
[ ca ]
default_ca     = CA_default          # The default ca section
[ CA_default ]
dir          = .               # Where everything is kept
certs          = $dir/certs          # Where the issued certs are kept
crl_dir          = $dir/crl          # Where the issued crl are kept
database     = $dir/index.txt     # database index file.
#unique_subject     = no               # Set to 'no' to allow creation of
                         # several ctificates with same subject.
new_certs_dir     = $dir/newcerts          # default place for new certs.
certificate     = $dir/cacert.pem      # The CA certificate
serial          = $dir/serial           # The current serial number
#crlnumber     = $dir/crlnumber     # the current crl number must be
                         # commented out to leave a V1 CRL
crl          = $dir/crl.pem           # The current CRL
private_key     = $dir/private/cakey.pem# The private key
RANDFILE     = $dir/private/.rand     # private random number file
x509_extensions     = usr_cert          # The extentions to add to the cert
# Comment out the following two lines for the "traditional"
# (and highly broken) format.
name_opt      = ca_default          # Subject Name options
cert_opt      = ca_default          # Certificate field options
# Extension copying option: use with caution.
# copy_extensions = copy
# Extensions to add to a CRL. Note: Netscape communicator chokes on V2 CRLs
# so this is commented out by default to leave a V1 CRL.
# crlnumber must also be commented out to leave a V1 CRL.
# crl_extensions     = crl_ext
default_days     = 365               # how long to certify for
default_crl_days= 30               # how long before next CRL
default_md     = md5               # which md to use.
preserve     = no               # keep passed DN ordering
# A few difference way of specifying how similar the request should look
# For type CA, the listed attributes must be the same, and the optional
# and supplied fields are just that :-)
policy          = policy_match
# For the CA policy
[ policy_match ]
countryName          = match
stateOrProvinceName     = match
organizationName     = match
organizationalUnitName     = optional
commonName          = supplied
emailAddress          = optional
# For the 'anything' policy
# At this point in time, you must list all acceptable 'object'
# types.
[ policy_anything ]
countryName          = optional
stateOrProvinceName     = optional
localityName          = optional
organizationName     = optional
organizationalUnitName     = optional
commonName          = supplied
emailAddress          = optional
[ req ]
default_bits          = 1024
default_keyfile      = privkey.pem
distinguished_name     = req_distinguished_name
attributes          = req_attributes
x509_extensions     = v3_ca     # The extentions to add to the self signed cert
# Passwords for private keys if not present they will be prompted for
# input_password = secret
# output_password = secret
# This sets a mask for permitted string types. There are several options.
# default: PrintableString, T61String, BMPString.
# pkix      : PrintableString, BMPString.
# utf8only: only UTF8Strings.
# nombstr : PrintableString, T61String (no BMPStrings or UTF8Strings).
# MASK:XXXX a literal mask value.
# WARNING: current versions of Netscape crash on BMPStrings or UTF8Strings
# so use this option with caution!
# we use PrintableString+UTF8String mask so if pure ASCII texts are used
# the resulting certificates are compatible with Netscape
string_mask = MASK:0x2002
# req_extensions = v3_req # The extensions to add to a certificate request
[ req_distinguished_name ]
countryName               = Country Name (2 letter code)
countryName_default          = GB
countryName_min               = 2
countryName_max               = 2
stateOrProvinceName          = County or State (full name)
stateOrProvinceName_default     =
localityName               = City or town (eg, Hitchin)
localityName_default          =
0.organizationName          = Organization Name (eg, company)
0.organizationName_default     =
# we can do this but it is not needed normally :-)
#1.organizationName          = Second Organization Name (eg, company)
#1.organizationName_default     = World Wide Web Pty Ltd
organizationalUnitName          = Organizational Unit Name (eg, section)
organizationalUnitName_default     =
commonName               = Common Name (eg, your name or your server\'s hostname)
commonName_max               = 64
emailAddress               = Email Address
emailAddress_max          = 64
# SET-ex3               = SET extension number 3
[ req_attributes ]
challengePassword          = A challenge password
challengePassword_min          = 4
challengePassword_max          = 20
unstructuredName          = An optional company name
[ usr_cert ]
# These extensions are added when 'ca' signs a request.
# This goes against PKIX guidelines but some CAs do it and some software
# requires this to avoid interpreting an end user certificate as a CA.
basicConstraints=CA:FALSE
# Here are some examples of the usage of nsCertType. If it is omitted
# the certificate can be used for anything *except* object signing.
# This is OK for an SSL server.
# nsCertType               = server
# For an object signing certificate this would be used.
# nsCertType = objsign
# For normal client use this is typical
# nsCertType = client, email
# and for everything including object signing:
# nsCertType = client, email, objsign
# This is typical in keyUsage for a client certificate.
# keyUsage = nonRepudiation, digitalSignature, keyEncipherment
# This will be displayed in Netscape's comment listbox.
nsComment               = "OpenSSL Generated Certificate"
# PKIX recommendations harmless if included in all certificates.
subjectKeyIdentifier=hash
authorityKeyIdentifier=keyid,issuer:always
# This stuff is for subjectAltName and issuerAltname.
# Import the email address.
# subjectAltName=email:copy
# An alternative to produce certificates that aren't
# deprecated according to PKIX.
# subjectAltName=email:move
# Copy subject details
# issuerAltName=issuer:copy
#nsCaRevocationUrl          = http://www.domain.dom/ca-crl.pem
#nsBaseUrl
#nsRevocationUrl
#nsRenewalUrl
#nsCaPolicyUrl
#nsSslServerName
[ v3_req ]
# Extensions to add to a certificate request
basicConstraints = CA:FALSE
keyUsage = nonRepudiation, digitalSignature, keyEncipherment
[ v3_ca ]
# Extensions for a typical CA
# PKIX recommendation.
subjectKeyIdentifier=hash
authorityKeyIdentifier=keyid:always,issuer:always
# This is what PKIX recommends but some broken software chokes on critical
# extensions.
#basicConstraints = critical,CA:true
# So we do this instead.
basicConstraints = CA:true
# Key usage: this is typical for a CA certificate. However since it will
# prevent it being used as an test self-signed certificate it is best
# left out by default.
# keyUsage = cRLSign, keyCertSign
# Some might want this also
# nsCertType = sslCA, emailCA
# Include email address in subject alt name: another PKIX recommendation
# subjectAltName=email:copy
# Copy issuer details
# issuerAltName=issuer:copy
# DER hex encoding of an extension: beware experts only!
# obj=DER:02:03
# Where 'obj' is a standard or added object
# You can even override a supported extension:
# basicConstraints= critical, DER:30:03:01:01:FF
[ crl_ext ]
# CRL extensions.
# Only issuerAltName and authorityKeyIdentifier make any sense in a CRL.
# issuerAltName=issuer:copy
authorityKeyIdentifier=keyid:always,issuer:always

Windows Server 2008 R2 Standard "Certificate Authority Service" / Exchange Server 2010 EMC not starting and no AD connectivity for authentication.

Hello,
I am a new IT Manager at this company and need assistance big time. Their environment looks as follows:
Server 1. Domain Controller Server (Windows Server 2008 R2 Standard) running active directory.
Server 2. Email Server (Windows Server 2008 R2 Standard) running Exchange Server 2010 .
* Note. No back ups to work with aside from whats mentioned below.
DC had a virus infection causing a lot of issues on the shared network drives 2 days ago locking up all the files with a crypto ransom virus. Running Avast suppressed the infection. Had to recover the file shares which luckily had a back up.
The issue is that the Exchange Server 2 post this lost connectivity with the AD Server 1. Exchange Server 2 when launching EMC could not launch the console stating the following:
"No Exchange servers are available in any Active Directory sites. You can’t connect to remote
Powershell on a computer that only has the Management Tools role installed."
Shortly after I found that it is possible the EMC launcher was corrupt and needed to be reinstalled following another blog post. I deleted the exchange management console.msc per instructions only to discover I couldnt relaunch it because there was
no way how. So I copied another msc file that happened to be on the DC Server 1 back to Exchange Server 2 and got it to launch again.
Another post said that it might be an issue with the Domain Account for the Computer, so to delete it in the AD Server 1 only to find that rejoining it from Exchange Server 2 using Computer>Properties> Chage Settings > Change is greyed out because
it is using the Certificate Authority Service.
I tried manually re-adding the computer in AD and modeling permissions after another server in group settings but no go. After this I was unable to login to the Exchange Server 2 with domain accounts but only local admin, receiving the following Alert:
"The Trust Relationship between this workstation and primary domain failed."
I tried running the Power Shell tools on Exchange Server 2 to rejoing and to reset passwords for domain accounts as noted in some other blogs but no luck as the Server 2 could not make the connection with Server1 or other errors it kept spitting out.
I also during the investigation found the DNS settings were all altered on both the Server 1 and Server 2 which I luckily was able to change back to original because of inventorying it in the beginning when I started.
I need help figuring out if I need to rejoin the Exchange Server 2 manually by disabling the Certificate Authority Service (or removing the CA as listed here:
https://social.technet.microsoft.com/Forums/exchange/en-US/fb23deab-0a12-410d-946c-517d5aea7fae/windows-server-2008-r2-with-certificate-authority-service-to-rejoin-domain?forum=winserversecurity
and getting exchange server to launch again. (Mind you I am relatively fresh to server managing) Please help E-Mail has been down for a whole day now!
Marty

I recommend that you open a ticket with Microsoft Support before you break things more.
Ed Crowley MVP "There are seldom good technological solutions to behavioral problems."

Certificate Authority is not being seen by windows server 2003 machines

Good Afternoon,
We recently installed a certificate authority using windows server 2008 r2. There was an old certificate authority that had went bad and the role could not be uninstalled on the bad server. The new certificate authority works with windows 2008 machines but
does not work with server 2003 machines. Mainly trying to get the domain controller certificate. At first it was stating that the rpc was unavailable for the CA. I tried to delete the remnants under the sites and services role of the old server. The error
now it states that it can not find a certificate authority. As stated above the newer machines (Server 2008) can see the certificate authority and request certificates but older machines cant. Any assistance on what to do next will be greatly appreciated.
Attached is the error I receive when trying to request a certificate through the CA mmc.
dmg

It is possible to change the hash algorithm a CA uses to support XP and 2003 "out of the box" without the hotfix.
But it would be better to have two CAs in parallel - one using a more modern algorithm and a CA supporting a "legacy" algorithm - and the latter should only be used as long as there are clients that aren't able to validate the other algorithms.
On the CA, start regedit and locate the following registry key:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\CertSvc\Configuration\<Your CA>\CSP
I am assuming that the Software CNG provider is used with SHA256 or higher (not with SHA1).
Change CNGHashAlgorithm to SHA1 and restart the CA service.
The setting can be reverted by changing the value back. All certificates and all CRLs signed by this CA will use the new hash algorithm after the restart.

Untrusted server cert chain & does not recognize the certificate authority

I have java code that makes an ssl connection to an HTTPS server.
The code workes fine when I connect to a server that has a
certificate that was issued by a recognizable authority.
But when I try to connect to our test HTTPS server which has a
certificate that was created by ourselves for debug, I get this
java exception: "untrusted server cert chain".
When I connect to our test HTTPS server with a browser, I get
this message from the browser in a popup window:
"www.xyz.com is a web site that uses a security certifcate to
identify itself. However netscape 6 does not recognize the
certificate authority that issued this certificate."
At this point I am able to accept the certificate in the popup
window and continue.
Question: In my java code how can I accept a certificate
that was signed by an unrecognizable authority just like the
browser can. Or during debug, how can I set an override
to accept ALL certs no matter what.
Thanks.....Paul

You will have to import your server test certificate into your client machine keystore. By default the keystore will be the 'cacerts' file in JAVA_HOME/jre/lib/security, get your server certificate in .pem format and use keytool to import it to the client.
keytool -import -alias <anything> -file <full path of .pem file> -keystore <full path of cacerts file>
The keystore password is 'changeit' by default, keytool comes with the JDK.
The reasoning behind this is to prevent the misuse of test certificates, the client has to consciously import an untrusted certificate. When you install a real certificate on your server the client will be automatically validated if bought from a trusted CA (Thawte, Verisign).
Take a look at the java.security.KeyStore class, you can use it to view your certificate chain.
Ronny.

SSL certificates and/ or Oracle Certificate Authority

Our Oracle infrastructure is as follows:
1.Database server
(a)Oracle 9i R2 database
(b) Oracle ApEx 2.2
2. Infrastructure server
(a) Oracle 10g (9.0.4.x.x) Infrastructure
(b) OID - configured as external authentication to Microsoft 2003 Active Directory LDAP version 3
(c) SSO - configured as Windows Native authentication
3. Application server
(a)Oracle 10g (9.0.4.x.x) Forms and reports server
Network traffic currently is not encrypted. All we need is to ensure that network traffic is encrypted between the the end-user PC and all servers (database or app server)
I was reading through Oracle Certificate Authority and Secure Sockets Layer.
1. Is there a difference between the two products?
2. Which product would be best to ensure the encryption (authentication is provided through MS LDAP)
Thanks,
Mayura

Certificate authority and SSL are two completely different concepts. They can be related but are by no means similar.
SSL is a service or a feature, not a product. SSL is used to encrypt the traffic. Part of SSL is the use of certificates for authentication. A server or user would pass a certificate as part of an SSL transmission.
The certificates used for enrypted transmission(SSL), can be obtained from the Oracle Certificate Authority(OCA), or by a third party certificate authority. OCA is not required to use SSL.
To achieve a fully encrypted envrinment, you would need to use SSL at several layers. This would be done with or without the use of the Oracle certificate authority.
1. From the web browser to the middle tier
2. End user to database
3. from the middle tier to OID
4. from the middle tier to the database
5. From OID to active directory

HOW TO INSTALL ROOT (Authority) CERTIFICATES ON S4...

Recently i bought a 6500 Classic and stupidly deleted my Authority Certificates.
After trwaling the net for info on how to re-install certificates i couldnt find an answer apart from NO YOU CANT DO THIS.
Well to that i say NUTS!!! because you can and i will show you how by simply following these steps.
1. Create a New Folder on your desktop and call it whatever you like.
2. Open notepad on your computer.
3. Copy the text below into the Notpad file. (I got this from some website as they were using it for smething else but it does work so thanks to them or thanks to you if this is yours)
<?xml version="1.0"?>
<!DOCTYPE html PUBLIC "-//WAPFORUM//DTD XHTML Mobile 1.0//EN" "http://www.wapforum.org/DTD/xhtml-mobile10.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>Install root CA</title>
</head>
<body>
<p>
<a href="der1.cer">Download a CA Cert1</a>
<a href="der2.cer">Download a CA Cert2</a>
<a href="der3.cer">Download a CA Cert3</a>
<a href="der4.cer">Download a CA Cert4</a>
<a href="der5.cer">Download a CA Cert5</a>
<a href="der6.cer">Download a CA Cert6</a>
<a href="der7.cer">Download a CA Cert7</a>
<a href="der8.cer">Download a CA Cert8</a>
<a href="der9.cer">Download a CA Cert9</a>
<a href="der10.cer">Download a CA Cert10</a>
<a href="der11.cer">Download a CA Cert11</a>
</p>
</body>
</html>
4. Save the Notpad file as type ALL FILES but when naming it just call it cert.html and save it to the folder you created on your desktop earlier.
5. Now downlaod the Root Certificates you need to the same folder on your Desktop.
6. When saving the first Certificate to the folder call it der1 ((make sure not to take out the file extension eg .cer)) then the second der2, third der3 and so on and so on till you get to der11. (Dont worry this will not rename the certificate when it installs on your phone.)
Example of what the files in your Desktop folder should be called der1.cer, der2.cer etc etc.
7. Now transfer the whole folder from your Desktop to your Mobile phone. (I did this by using Nokia PC Suite.)
8. When the folder with the certificates and hmtl we made have been transfered to you phone navigate using your phone to that folder.
9. Go into the folder and open the cert.html file. (Your browser will now open a page with 11 download links available)10. Now all you have to do is click on each link and accept each certificate remembering to save and they will install on your phone. (On my 6500 Classic i can check this by Navigating through my phone to Menu>Settings>Security>Authority Certificates)
Notes:- Some errors you may receive when trying to download the certificates through your phone browser may be Already Exists, Expired Certificate and the most annoying is Corrupted Certificate.
Already Exists - Shouldt allow you to save (DO NOT SAVE IF IT ALLOWS YOU)
Expired Certificate - (DO NOT SAVE)
Corrupted Certificate - Install the certificate on your computer first, then go to Tools>Internet Options>Content>Certificates.
(save the certificate to other people tab) Browse for the certificate you installed then export it in DER format to the Desktop Folder you created then start process over again to get it onto your phone.
Remember to delete any certificates as you go that you have already installed so you dont get mixed up.
Any issues reply and i will do what i can to help and if anyone has Hutchinson 3G Root Certificates please let me know.
Thanks.
Message Edited by andyhardie on 15-Jul-2009 04:05 PM

I have nokia 6300 s40v3 and when I tried to open cert.html it showed format unknown.
What should I do. Can you tell me the format of bookmark so that can rename it to cer.(format)
sir please give some guidense its very urgent
reply at *******
MODERATOR'S NOTE:
Personal details removed by a moderator. We kindly ask you not to share your personal e-mail address or any other personal information publicly on this forum. This is for your personal safety and privacy.
Message edited by Aikin19

How to filter certificate templates in Certificate Authority snap-in with the correct values

How to filter certificate templates in Certificate Authority snap-in with the correct values
I have a 2012 R2 server running Microsoft Certificate Authority snap-in.
I want to do a filter on a specific Certificate Template which i know exists in the 'Issued Certificates' folder.
All the documentation i can find seems to suggest i copy the certificate name and use this in the View Filter.
1). I add the 'Certificate Template' option into the Field drop-down.
2). I leave the Operation as the '=' symbol
3). I paste in just the name of the template in question. for example: 'my computers'
The search results always come back blank 'There are no items to show in this view.' even when i know there are many instances of this template. I've tried on a win 2008 server and same issue.
Is there a correct value to enter for the Certificate Template name?
Can this be done easier using certutil commands?
When i run the certutil tool i can confirm i have several issued templates. Certutil -catemplates -v > c:\mytemplate_log.csv
Anybody know what i'm doing wrong?
I seem to be getting nowhere with this one.

> But its important you are using the template name, not the display name
this is incorrect. OIDs are mapped to *display name*, not common name (it is true for all templates except Machine template). That is, in order to translate template name to a corresponding OID, you need to use certificate template's display name. And, IIRC,
template name in the filter can be used only for V1 templates. For V2 and higher, OID must be used.
My weblog: en-us.sysadmins.lv
PowerShell PKI Module: pspki.codeplex.com
PowerShell Cmdlet Help Editor pscmdlethelpeditor.codeplex.com
Check out new: SSL Certificate Verifier
Check out new:
PowerShell FCIV tool.

Certificate Authority root CA increased validity problem

Dear all,
I was successfully able to create in Certificate Services root CA for 20 years, issued a certificate and login using smartcard using the following procedure:
1. I increased the CA lifetime to 20 years by using this link http://www.expta.com/2010/08/how-to-create-certificates-with-longer.html
Created the file CAPolicy.inf in %SYSTEMROOT% with following content
[Version]
Signature=”$Windows NT$”
[certsrv_server]
RenewalValidityPeriod=Years
RenewalValidityPeriodUnits=20
2. Renew CA root using this guide https://technet.microsoft.com/en-us/library/cc780374(v=ws.10).aspx
Console Root -> Certification Authority -> select domain -> Right click -> All Tasks -> Renew CA certificate
3. Delete from
Console Root -> Certificates (local computer) -> Trusted Root Certification Authority -> Certificates the *WINSC-CA that has the previous lower validity, and from
Certificates (local
computer) -> Personal, the *WINSC-CA that was lower validity
4. I performed a reboot here
5. Change in Console Root -> Certificate Templates -> Smartcard Logon Custom Template (my custom duplicate template) -> Properties -> Validity 10 years
6. Change in registry HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\CertSvc\Configuration\<CAName>\ValidityPeriod
to value 10 for 10 years.
7. Request a new certificate from CA webpage http://ipofdomain/certsrv and let the webpage write it to smartcard (I was making
sure there is no other certificate on the smartcard)
8. Try to log in. At this point it should throw an erorr that smartcard logon is not supported for this account type. This
is becuase we need to enroll it again for domain authentication
9. Console Root -> Certificates (local Computer) -> Personal -> Right click -> All Tasks -> Request new Certificate
-> Next -> Active Directory Enrollment -> Next -> Select Domain Controller Authentication -> Enroll -> Finish.
Now you should be able to login using your smartcard and 10 years generated certificate.
Though I have a
problem at step 3, after CA server reboots the *WINSC-CA certificate with lower validity is restored automatically, but the certificates are generated for 10 years.
What am I doing
wrong ? How can I delete the lower validity root CA ?

Hi,
Thanks for your post.
Did you try to restart the CertSrv service to check the result after you create and save the CAPolicy.inf file?
Regards.
Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Support, contact [email protected]

How can I permanently accept a certificate without trusting its certificate authority?

Hello,
When I try to connect to a secure website for which the certificate is signed by an untrusted certificate authority, Firefox warns me, as expected.
The problem is that I would like to add a permanent exception for this certificate, but the corresponding checkbox is disabled. Note that I do not want to add the certificate authority in my database but only the certificate of the website.
Is there a way to allow an excpetion of this kind?

Thanks for the suggestion, I should've mentioned I'd already tried that without success. I tried clearing everything in the Clear Recent History section actually but the certificate is still remembered.
I've also just now tried deleting the certificates completely but not even that works - a little concerning. (:

How to accept certificate authority in HP PPM

How can we accept the Certificate Authority (similar to VeriSign) of any organization specific instead of just accepting the individual certificate in HP PPM.This enables to be able to accept any cert from that organization specific instead of having to import the Certificate each year

Hi FahadKhan,
Welcome to the HP Forums, I hope you enjoy your experience! To help you get the most out of the HP Forums I would like to direct your attention to the HP Forums Guide First Time Here? Learn How to Post and More.
I am sorry, but to get your issue more exposure, I would suggest posting it in the commercial forums, since this is a commercial product. You can do this at
http://h30499.www3.hp.com/t5/Operations-Management/ct-p/operations-management
I hope this helps!
Regards
MechPilot
I work on behalf of HP
Please click “Accept as Solution ” if you feel my post solved your issue, it will help others find the solution.
Click the “Kudos, Thumbs Up" on the right to say “Thanks” for helping!

Delete or distrust a certificate authority (CA)

The security blogs are reporting that the Certificate Authority "DigiNotar" has been compromised. I have already removed the CA from FireFox via Preferences/Advanced/Encryption but I can't find anything similar in Safari Preferences.
Can someone tell me how to remove or distrust a CA in Safari?
Walt

Don't forget your phones...
... but as far as I can tell, Apple hasn't allowed for any CA configurations to be done through the iPhone Configuration Utility (v3.3).
I relooked at the CA list once Lion became officail and roughly 94 out 176 are non-US-based CA. Everyone's level of trust is different (and hacks can happen everywhere and to everyone).

ISE Certificate Authority Certificate

Similar Messages

Maybe you are looking for