Issue generating a subordinate certificate - The certification authority's certificate contains invalid data

Other recipients:
Hi Guys, I have a root CA and a sub CA. I want to generate another Sub CA certificate from my current sub CA however when I try to do so either via web or csr file I get the below error: The certification authority's certificate contains
invalid da
<input role="presentation" style="width:1px;height:1px;opacity:0;" tabindex="-1" type="text" />
Hi Guys,
I have a root CA and a sub CA both windows 2008 R2 ent. I want to generate another Sub CA certificate from my current sub CA however when I try to do so either via web or csr file I get the below error:
The certification authority's certificate contains invalid data. 0x80094005 (-2146877435). Denied by policy module.
I have confirmed that the basic constraint attribute for my current subca is none so I should be able to generate a certificate for a new subca.
Any assistance is greatly appreciated.
Thanks.

Hi,
According to your description, you want to build a new CA which is under an existing sub CA (one of your two working sub CAs) to issue certificates to other devices, am I right?
Based on my research, to achieve this, we need to install another
Subordinate Certification Authority. During the installation process, this new sub CA will generate a certificate request to its parent CA.
“The subordinate CA cannot be used until it has been issued a root CA certificate and this certificate has been used to complete the installation of the subordinate CA”, I quoted this
sentence from the article I posted in my last reply.
Therefore, in your case, the process flow should be like:
Install a new sub CA.
Generate a certificate request to its parent CA during installation.
The parent CA approves this request.
Installation of the subordinate CA has completed.
The new sub CA issues new certificates to other devices.
Please feel free to let me know if this method is not working.
Best Regards,
Amy Wang

Similar Messages

  • What is the certification authority, the third party that can confirm the digital signature?

    I created a nice electronic signature, that I now regularly use and add to every document. I was told that a signature needs to be issued by a verification authority, a third party that is able to verify the signature, certificate. I created a free certificate at CAcert.org and tried to combine it with the adobe signature certificate file, but it doesnt support .cer and .crt files. Is the Adobe the certification authority in this case since i created signature in the Adobe software? Its not a big deal, I just want everything to be correct since I use the signature in official documents now (instead of scanning a signed document) ... Thanks for any info, ideas or help.
    Jacob

    Each Digital Certificate has a pair of private and public keys used for encryption/decryption. The private key belongs to the certificate owner and should be kept secret. It is protected by a password. The public key can be used by anyone. Digital certificates come in two flavors: one that contains both private and public key and one that contains only public key.
    When you create a digital signature the signing process uses the private key to encrypt the signed content digest and the public key is used to decrypt it. So, only you can encrypt signed content with your certificate that has both private and private keys and anyone can decrypt it to validate the signature using certificate that has only public key. Usually, this certificate with the public key only is embedded in the digital signature, so that anyone can use it for decryption.
    The .cer certificate contains only public key. Certificates with both private and public keys usually have extensions .pfx or .p12. You need one of those to sign.
    CAcert.org issues only public key certificates. so you cannot use its certificates for digital signing.
    Adobe is not a general purpose certification authority. It issues some certificates for internal use only.
    Acrobat has a feature that allows you to create so-called self-signed certificates with both private and public keys but these certificates can be used only in a limited way. They do not provide the means to authenticate the real certificate owner nor revoke a certificate if it is stolen.
    Generally, a digital signature asserts three main features:
    1. Document integrity (document has not been changes since it had been signed),
    2. Authentication (the signer is indeed what the certificate says)
    3. Non-repudiation (the signature author cannot deny that he signed it: this is achieved via certificate revocation mechanism).
    A self-signed certificate (of the type that Acrobat produces) can be used only for #1. It cannot be used for ##2 and 3. The latter two come only when a certificate (with private key) is issued by a reputable Certificate Authority which is trusted (like VeriSign, Symantec, etc.).

  • The registration authority's response is invalid when provisioning iOS devices

    I'm working on a BYOD deployment and I've run into a snag. When a windows PC runs through the provisioning process they recieve a certificate without any issues, but iOS devices fail with the error: The registration authority's response is invalid.
    Any ideas on what is causeing this?

    To upload offline client provisioning resources, complete the following steps:
    Please update the patch useing the below details and try it.
    Step 1 Go to the Download Software web page at http://www.cisco.com/cisco/software/navigator.html?a=a&i=rpm. You may need to provide login credentials.
    Step 2 Navigate to Products > Security > Access Control and Policy > Cisco Identity Services Engine > Cisco Identity Services Engine Software.
    Choose from the following Off-Line Installation Packages available for download:
    •win_spw--isebundle.zip— Off-Line SPW Installation Package for Windows
    •mac-spw-.zip — Off-Line SPW Installation Package for Mac OS X
    •compliancemodule--isebundle.zip — Off-Line Compliance Module Installation Package
    •macagent--isebundle.zip — Off-Line Mac Agent Installation Package
    •nacagent--isebundle.zip — Off-Line NAC Agent Installation Package
    •webagent--isebundle.zip — Off-Line Web Agent Installation Package
    Step 3 Click Download or Add to Cart.

  • Error for EC-CS : The dependent char. partner unit contains invalid value?

    Hi,
    We are using PC consolidation and while doing rollup for p1/2011 facing following error:
    The dependent char. partner unit contains invalid partner unit. We are facing this error only for one newly created GL/Fs item and that to for some company codes/consol groups.
    The intercompany transaction created in FI is not rolling to EC-CS thru CXCD rollup.

    Hi,
    We need to maintain the default values in transaction - CXOAA.
    The issue is solved.
    Njoy
    Siva

  • Invalid text value. A text field contains invalid data. Check the value and try again

    Hello,
    I am having a problem with the error mentioned in the title. I see alot of others have experienced the same problem, but I have quite a twist to it.
    I see the problem when I try to edit a list item, and then try to save the changes.
    Here what I see in the ULS log:
    System.Runtime.InteropServices.COMException: Invalid text value. A text field contains invalid data. Check the value and try again  
    at Microsoft.SharePoint.Library.SPRequestInternalClass.AddOrUpdateItem(String bstrUrl, String bstrListName, Boolean bAdd, Boolean bSystemUpdate, Boolean bPreserveItemVersion, Boolean bUpdateNoVersion, Int32& plID, String& pbstrGuid, Guid pbstrNewDocId,
    Boolean bHasNewDocId, String bstrVersion, Object& pvarAttachmentNames, Object& pvarAttachmentContents, Object& pvarProperties, Boolean bCheckOut, Boolean bCheckin, Boolean bMigration, Boolean bPublish, String bstrFileName, ISP2DSafeArrayWriter
    pListDataValidationCallback, ISP2DSafeArrayWriter pRestrictInsertCallback, ISP2DSafeArrayWriter pUniqueFieldCallback)   
    at Microsoft.SharePoint.Library.SPRequest.AddOrUpdateItem(String bstrUrl, String bstrListName, Boolean bAdd, Boolean bSystemUpdate, Boolean bPreserveItemVersion, Boolean bUpdateNoVersion, Int32& plID, String& pbstrGuid, Guid pbstrNewDocId, Boolean
    bHasNewDocId, String bstrVersion, Object& pvarAttachmentNames, Object& pvarAttachmentContents, Object& pvarProperties, Boolean bCheckOut, Boolean bCheckin, Boolean bMigration, Boolean bPublish, String bstrFileName, ISP2DSafeArrayWriter pListDataValidationCallback,
    ISP2DSafeArrayWriter pRestrictInsertCallback, ISP2DSafeArrayWriter pUniqueFieldCallback)
    I have 3 front end servers(fx wfe1, wfe2, wfe3).  And here is the twist.
    If I access the library directly through wfe1 and wfe2, I get the error. If I access the library via wfe3 if works just fine.
    So because of this, I think it is safe to assume that is has nothing to do with the character limit of 255. Nor does it have anything to do with the field type, since it is already set to mulitible lines of text.
    So. Any ideas?
    Regards,
    Michael
    mic

    Check if there is any change in web.config of these servers
    http://support.microsoft.com/kb/2880758
    To work around this issue, limit the length of the personal message in the invitation to 256 characters or less.
    This is a known issue. Microsoft is working to resolve this issue.
    http://social.msdn.microsoft.com/Forums/en-US/7bb16e51-e7cc-439e-a8b3-755683ccac1a/max-length-on-custom-field-types
    To solve the problem you may have to change the field's parent type to "note". To do that you have to open your fldtypes... file under Templates/xml and change the line to:
    "<Field Name="ParentType">Note</Field>" from "<Field Name="ParentType">Text</Field>"
    You might also have to add a sql type if your text needs to be longer than 255 characters
    <Field Name=”SQLType”>ntext</Field>
    and inherit from SPFieldMultiLineText instead of SPFieldText
    If this helped you resolve your issue, please mark it Answered

  • Error Message - "could not complete your request because the preset contains invalid data"

    I am trying to open a file, and every time I do it comes up with the following error message:
    "Could not complete your request because the preset contains invalid data"
    I am using Photoshop CS4 on a Macbook Pro running Snow Leopard 10.6.2.
    I have tried:
    - restarting my mac
    - opening different files created at different times
    - deleting photoshop from my app folder and the app support folder from my /username/library/application support/adobe/ folder and copied them back from a Time Machine backup from a few days ago.
    I was using Photoshop all day today with absolutely no problems. I have searched Google and this forum and have come up short. No one has this exact error anywhere.
    Any help? Thanks so much in advance!
    Pat Dryburgh

    The one thing you didn't do is reset your Photoshop preferences.
    Most likely the preferences got corrupted, and reference a corrupt preset.

  • I cannot open files in excel with error message "The file name or path contains invalid characters

    I cannot open files in excel with error message "The file name or path contains invalid characters

    Found the solution. The hardrive name was changed to "/" which is not a recognised file path character. So I changed the name to "Mac" then I was able to already open all files in excel and word

  • TS3212 when I try to install itunes it gives me the following error: '2.iTunes contains invalid character'.  I am running windows 7.

    I am trying to update my iTunes.  I am running windows 7.  When I manually try and update it I get the following message:  '2.iTunes contains an invalid character'.  Any ideas of how to get my itunes upfated?

    Try the following user tip:
    "not a valid short file name" and "invalid character" install errors

  • How to remove Expired Certificate in Certification Authority

    So the base certificate at a client site running Server Standard 2012 R2 expired.
    I went in and did a renewal, which created a new certificate, but the old expired cert still shows in the list and is still being handed out by the CA.
    Certificates #1 & #2 are the renewed cert's, Cert #0 is expired, why did it not get replaced during the renewal process?
    How do I remove the expired Certificate?  The CA is still using it and handing out expired cert's, this is preventing people from connecting to the secure Corporate WiFi environment because the NAP server is now rejecting access due to an expired certificate.
    Before I renewed and changed the certificates in the NAP server to point to the new reviewed cert, I was getting this event log entry when a user tried to connect to the Secure Corporate WiFi:
    Event ID 6273, Reason Code 262, The supplied message is incomplete.  The signature was not verified.
    After I changed to the Certificates in the NAP server to point to the renewed cert's, I get this error, still not able to connect to WiFi:
    Event ID 6273, Reason Code 265, The certificate chain was issued by an authority that is not trusted.
    How do I go about cleaning out that Expired Certificate in the CA, I removed it from the computer cert list using the Certificates snap in and connecting to the local computer.  I then stopped and restarted both the CA and NAP services.  Still
    no change.  I need to get the CA cleaned up and trusted again.
    Any help would be greatly appreciated.
    Curt Winter
    Microsoft Certified Professional

    Ok the NAP server is now working properly, the Expired Certificates are clean up and we are back in working order.
    Here is a review of what I did to get the issue resolved:
    1) First thing was to remove the old SBS server entries that where causing the workstation to try and renew their certs with the old server.  To do this I ran ADSIEdit expanded the
    CN=Configuration | CN=Services | CN=Public Key Services.  I then went through every folder and every entry under Public Key Services looking for and removing or updating entries pointing to the old SBS. I then made sure authenticated
    users had read permissions on CN=Enrollment Services.
    2) Ensure the CA is an Enterprise CA, I ran certutil -cainfo
    to ensure it showed as Enterprise Root CA.
    3) I then went back into ADSIEdit expanded
    CN=Configuration | CN=Services | Public Key Services | CN=Enrollment Services. Right click the CA in the right pane and ensure
    flags is set to 10.
    4) Ensure the CA is trusted, launch PKIView, right click on
    Enterprise PKI and select Manage AD Containers click on the Enrollment Services Tab, the status should show as OK.
    5) I then copied that Certificate to a file and ran certutil -verify on the file to check for any additional errors.
    6) I then opened CertSrv.msc on the CA, right click on the name of the CA and select properties, click on the Security tab and ensure Authenticated Users have the
    Request Certificates permission.
    7) I then ran certutil -deleterow 3/11/2015 Cert to remove all the certs that had expired before 3/11/2015.
    At this point the workstations started to get new cert's all the cert renewal errors in the client event logs stopped
    8) I then went back into the NAP server and select the correct certificate fin the EAP Properties and Smart Card properties.
    9) I then updated the domain 802.11X policy ensuring all the EAP properties had the correct certificate listed.
    At this point computers where again connecting to the Secure WiFi through the NAP server.  I hope this may help someone in the future.
    Curt Winter
    Certified Microsoft Professional
    Curt Winter

  • Corresponding table in the source system does not contain any data -URGENT

    Hi Guru's,
    I have already uploaded master data.
    I have created infosource added infoObjects to it and activated it to create communication strucure.
    M using RSA1OLD transaction.
    and assigned datasource to infosource ie source system name and clicked ok.
    save datasource to infosurce assigned msg displayed, clicked ok.
    transfer rules r created, i have also created update rules and assigned infosource to it.
    then created infopackage n added execel file name .csv
    in datatargets tab selected data target as infocube. n then in schedule tab start data load immediately and clicked ok.
    everything is fine upto schedule n in monitor it does not display any data.
    what will be the problem??

    i have also created update rules and assigned infosource to it.
    then created infopackage n added execel file name .csv ??
    Are you loading the data from flat file or R3? If you are loading it from R3, why are you giving the Flat file name?
    In this case, check in RSA3 (R3 side), whther the datas source is getting the value.
    In case you are loading a flat file, you need to create a flat file data source and assign to the infosource.
    Thanks..
    Shambhu

  • Certification authority - Migration

    Hello people,
    I have a certification authority installed on my
    DC.
    I need to migrate this certification authority
    to another server with just
    this function and remove the DC.
    How can I do this safely,
    without impacting applications that depend on the
    certification authority, with certificates issued?
    I have a domain with 2
    domain controllers, Windows Server 2008R2,
    200 users.
    thank you

    Hi,
    Here is a detailed CA migration guide article below I suggest you refer to:
    Active Directory Certificate Services Migration Guide
    http://technet.microsoft.com/en-us/library/ee126170(v=WS.10).aspx
    I hope this helps.
    Best Regards,
    Amy Wang

  • Move Certification Authority Web Enrollment to new server issue.

    Hello, 
    i'm trying to move the Certification Authority Web Enrollment  from one server to a new one. I've got a fully functional server where i can enroll any certificate i want and everything is working properly.
    on the new server i configured I'm facing a problem that seems to be an impersonation issue. Indeed, while i try to enroll a certificate i get the following error msg from the interface :
    Request Mode:
    newreq - New Request 
    Disposition:
    (never set) 
    Disposition message:
    (none) 
    Result:
    The RPC server is unavailable. 0x800706ba (WIN32: 1722) 
    COM Error Info:
    CCertRequest::Submit: The RPC server is unavailable. 0x800706ba (WIN32: 1722) 
    LastStatus:
    The operation completed successfully. 0x0 (WIN32: 0) 
    Suggested Cause:
    This error can occur if the Certification Authority Service has not been started. 
    an i can also see on the CA it targets the following  application error event :
    Event 18209, ComRuntime:
    The application-specific permission settings do not grant Local access permission to the COM Server application C:\Windows\system32\certsrv.exe with APPID 
    {D99E6E74-FC88-11D0-B498-00A0C90312F3}
     to the user NT AUTHORITY\ANONYMOUS LOGON SID (S-1-5-7) from address LocalHost (Using LRPC). This security permission can be modified using the Component Services administrative tool.
     While i register a certificate on the server were it all works fine i can see event in the Security log on the CA that authenticate the user i generate the certificate with, where-as with the server were it does not work, all seems to be anonymous.
     IIS configuration are identical on both servers and the delegation has been set identically too ( ADUC object )
     Any idea how what I could check next? 

    Hi,
    Regarding event 18209, please follow steps from this article below to assign access permissions for the user mentioned in the event message:
    Event ID 18209 — COM Security Policy Configuration
    http://technet.microsoft.com/en-us/library/cc726319(v=WS.10).aspx
    Best Regards,
    Amy
    Please remember to mark the replies as answers if they help and un-mark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact [email protected]

  • Certification Authority

    We installed the Certification Authority service on a 2008 server.  How do we issue a certificate to a user to allow them to digitally sign Excel and Word documents?    When I try to sign a document the only certificate available says
    it cannot be verified. 

    Hi,
    Based on my research, we must obtain a digital certificate before we can obtain a digital signature. Therefore, we need to request a
    Code Signing certificate for this usage.
    Here are some related links below that could be useful to you:
    Walkthrough: Request a Digital Certificate from Certificate Server or create a testing Digital Certificate to sign a Package
    http://blogs.msdn.com/b/sqlforum/archive/2011/01/03/walkthrough-request-a-digital-certificate-from-certificate-server-or-create-a-testing-digital-certificate-to-sign-a-package.aspx
    Description of digital certificates
    http://support.microsoft.com/kb/206637
    What is a digital signature?
    http://technet.microsoft.com/en-us/library/cc545901(v=Office.12).aspx
    I hope this helps.
    Best Regards,
    Amy Wang

  • Restric manager certificate and grant authority

    helloa
    first thing i got request from of our managers
    basically we manages the Certificate Root server, we have 3-4 
    domains with same architecture, and we want to get control of 
    who can manage certificate and whose not
    i know that option to restrict with out the security tab configure
    also on templates existing
    please share with me some of the knowledge above
    thanks 

    Hey Yugi
    Thanks for posting,
    As You have mentioned the security tab able to restrict by denied
    But, the Certification Authority can be very useful with what 
    You have request for:
    Try properties the Certification Authority and moved to certificate managers TAB
    There You could configure who to restrict and even a specific  template and for who
    Be very careful with it.
    I'd be glad to answer any question

  • The File name property is not valid. The file name is a device or contains invalid characters

    I have an SSIS task that has run successfully for years. They just moved the dtsx to a new server and now it is failing. 
    Issue:
    The task has a data flow that writes a raw file destination. It then has a subsequent data flow that reads the raw file destination. 
    The path and name of the raw file is passed to each of the data flows via the same variable. 
    The raw file resides in a folder on the server in the same path that the dtsx resides in. 
    The task fails with the "The File name property is not valid. The file name is a device or contains invalid characters" error when trying to access the raw file.
    What we have done to troubleshoot:
    1. I ran the task successfully on my local machine so it is definitely a server issue.
    2. The first thing we were seeing was that it failed trying to write to the raw file. The task is set to "Create Always". 
    3. We saw that the dba's copied over the entire directory structure from the old server which included a previously created raw file, so we deleted the raw file.
    4. We reran the task and it successfully wrote a new raw file but then failed on reading the raw file with the same error as above.
    5. We reran the task AGAIN and this time it failed trying to write the raw file throwing the same error as above.
    6. The dba looked at the directory and the account that performs the task has full control.
    7. The dba looked at the raw file that was created and verified that the account that performs the task has full control of the file and that it is the owner of the file.
    Summary:
    The task fails when trying to access the file EXCEPT when the file does not exist. In that situation it can write the file but subsequently fails in accessing it again.

    Hi Whalensdad,
    Based on my research, the issue can be caused by the following reasons:
    There are some invalid characters in the File name at package runtime. In this scenario, just as Russ said, could you please post the value that is in the File name variable? Also use a Script Task with Messagebox.show to show the variable values at runtime.
    May be it changes to others at run time.
    The account runs the package not having access to all the folders in the path. Since you are moving the dtsx file from one server to the current server, do you also move the raw file to the same folder in the current server? Does the user runs the package
    have access to all the folders in the path? To solve this, please ensure that the user has access to all folders and the raw file in the path on the current server.
    Thanks,
    Katherine Xiong
    If you have any feedback on our support, please click
    here.
    Katherine Xiong
    TechNet Community Support
    Please see the response above. I can't use a message box on a server so I logged the values to the database. The resource account has full control to the folder. I haven't been able to get the DBA to check the SQL Agents permissions, but I was always under
    the impression that if you use "Run As" on the task, it will not use the SQL Agent but the account you identify it to "Run As". The "Run As" account has full control on the folder and file.

Maybe you are looking for