Issuing certificates for user and clients from different forest/domain

Hello,
at first I would like to say that I have made some researches on this forum and in the Internet overall.
I have AD Forest with ~10 sites all over the Europe, DFL and FFL is 2008 R2, right now we are migrating site by site from old domain (samba) to AD.
Last time I have deployed PKI based on offline root CA and 2 Enterprise acting as 2-node Failover Cluster.
Everything in my AD Forest is OK, I mean, autoenrollment works perfect for users and computers from my forest,
now I need to deploy a certificate (for test) to one web-based pbx server in samba domain, there are no trusts etc. Samba domain as well as AD Forest are working on the same network, with routeable subnets in each site, so there is no problem with connectivity,
What are possible way to achieve this goal? I mean to issue cert to client from different forest, so that this client is able to validate it, validate certificate chain and renew it when needed?
I have Installed and Configured CE Web Service and CE Policy Web Service. Now I have configured Enrollment Policies on my virtual machine (being part of different domain), I selected username/password authentication, I am able to request certificate, I can
see all templates which I should see, but when I try to enroll I got an error:
(translated from my language)A certification chain processed correctly, but one of the CA certificates is not trusted by the policy provider
My root CA cert is added to trusted publishers for computer and user node as well.
What could be wrong? If you have any ideas or questions, please share or ask.
Thank you in advance.

Everything is clear, I have Certificate Enrollment Web Services installed and configured,
problem is what i get from certutil - TCAInfo
================================================================
CA Name: COMPANY-HATADCS002-ISSUING-CA
Machine Name: COMPANYClustGenSvc
DS Location: CN=COMPANY-HATADCS002-ISSUING-CA,CN=Enrollment Services,CN=Public Key Services,CN=Services,CN=Configuration,DC=COMPANY,DC=COM
Cert DN: CN=COMPANY-HATADCS002-ISSUING-CA, DC=COMPANY, DC=COM
CA Registry Validity Period: 2 Years -- 2016-03-04 12:20
NotAfter: 2019-02-14 12:44
Connecting to COMPANYClustGenSvc\COMPANY-HATADCS002-ISSUING-CA ...
Server "COMPANY-HATADCS002-ISSUING-CA" ICertRequest2 interface is alive (1078ms)
Enterprise Subordinate CA
dwFlags = CA_VERIFY_FLAGS_NT_AUTH (0x10)
dwFlags = CA_VERIFY_FLAGS_CONSOLE_TRACE (0x20000000)
dwFlags = CA_VERIFY_FLAGS_DUMP_CHAIN (0x40000000)
ChainFlags = CERT_CHAIN_REVOCATION_CHECK_CHAIN_EXCLUDE_ROOT (0x40000000)
HCCE_LOCAL_MACHINE
CERT_CHAIN_POLICY_NT_AUTH
-------- CERT_CHAIN_CONTEXT --------
ChainContext.dwInfoStatus = CERT_TRUST_HAS_PREFERRED_ISSUER (0x100)
ChainContext.dwRevocationFreshnessTime: 18 Days, 4 Minutes, 1 Seconds
SimpleChain.dwInfoStatus = CERT_TRUST_HAS_PREFERRED_ISSUER (0x100)
SimpleChain.dwRevocationFreshnessTime: 18 Days, 4 Minutes, 1 Seconds
CertContext[0][0]: dwInfoStatus=102 dwErrorStatus=0
Issuer: CN=HATADCS001-COMPANY-ROOT-CA
NotBefore: 2014-02-14 12:34
NotAfter: 2019-02-14 12:44
Subject: CN=COMPANY-HATADCS002-ISSUING-CA, DC=COMPANY, DC=COM
Serial: 618f3506000000000002
Template: SubCA
9e1bea4ffa648e5fe3e9f8c4be3c604c49af04e9
Element.dwInfoStatus = CERT_TRUST_HAS_KEY_MATCH_ISSUER (0x2)
Element.dwInfoStatus = CERT_TRUST_HAS_PREFERRED_ISSUER (0x100)
CRL 02:
Issuer: CN=HATADCS001-COMPANY-ROOT-CA
ThisUpdate: 2014-02-14 12:16
NextUpdate: 2024-02-15 00:36
d7bafb666702565cae940a389eaffef9c919f07a
Issuance[0] = 1.2.3.4.1455.67.89.5
CertContext[0][1]: dwInfoStatus=10c dwErrorStatus=0
Issuer: CN=HATADCS001-COMPANY-ROOT-CA
NotBefore: 2014-02-14 11:55
NotAfter: 2024-02-14 12:05
Subject: CN=HATADCS001-COMPANY-ROOT-CA
Serial: 18517ac8a4695aa74ec0c61b475426a8
b19b85e0e145da17fc673dfe251b0e2a3aeb05e9
Element.dwInfoStatus = CERT_TRUST_HAS_NAME_MATCH_ISSUER (0x4)
Element.dwInfoStatus = CERT_TRUST_IS_SELF_SIGNED (0x8)
Element.dwInfoStatus = CERT_TRUST_HAS_PREFERRED_ISSUER (0x100)
Issuance[0] = 1.2.3.4.1455.67.89.5
Exclude leaf cert:
5b309c67a8b47c50966088a4d701c8526072c9ac
Full chain:
413b91896ba541d252fc9801437dcfbb21d37d91
Issuer: CN=HATADCS001-COMPANY-ROOT-CA
NotBefore: 2014-02-14 12:34
NotAfter: 2019-02-14 12:44
Subject: CN=COMPANY-HATADCS002-ISSUING-CA, DC=COMPANY, DC=COM
Serial: 618f3506000000000002
Template: SubCA
9e1bea4ffa648e5fe3e9f8c4be3c604c49af04e9
A certification chain processed correctly, but one of the CA certificates is not trusted by the policy provider. 0x800b0112 (-2146762478 CERT_E_UNTRUSTEDCA)
Supported Certificate Templates:
Cert Type[0]: COMPANYOnlineResponder (COMPANY Online Responder) -- No Access!
Cert Type[1]: COMPANYWebServer(SSL) (COMPANY WebServer (SSL))
Cert Type[2]: COMPANYUser(Autoenrollment) (COMPANY User (Autoenrollment))
Cert Type[3]: COMPANYKeyRecoveryAgents (COMPANY Key Recovery Agents)
Cert Type[4]: COMPANYEnrollmentAgent(Computer) (COMPANY Enrollment Agent (Computer))
Cert Type[5]: COMPANYEnrollmentAgent (COMPANY Enrollment Agent)
Cert Type[6]: COMPANYComputer(Autoenrollment) (COMPANY Computer (Autoenrollment)) -- No Access!
Validated Cert Types: 7
================================================================
COMPANYClustGenSvc\COMPANY-HATADCS002-ISSUING-CA:
Enterprise Subordinate CA
A certification chain processed correctly, but one of the CA certificates is not trusted by the policy provider. 0x800b0112 (-2146762478 CERT_E_UNTRUSTEDCA)
Online
CertUtil: -TCAInfo command completed successfully.
please put some light on it because it's driving me crazy :/
Thanks in advance
one remark: certutil -tcainfo performed on CA directly is 100% OK, no errors regarding
"A certification chain processed correctly, but one of the CA certificates is not trusted by the policy provider. 0x800b0112 (-2146762478 CERT_E_UNTRUSTEDCA)"

Similar Messages

Generate Certificates for WLC and clients

Hi Guys
I've been working acording the following document to integrate my WLC 5508 with LDAP for internal users:
http://www.cisco.com/c/en/us/support/docs/wireless/4400-series-wireless-lan-controllers/100590-ldap-eapfast-config.html
However when I try to generate the device certificate on Windows Server 2012, I see the steps are different, for example when I reach the step 4 (of Generate a Device Certificate for the WLC section), the CA ask me for a Certificate Signing Request instead of Create and submit request to this CA option, as appears in the document.
How do I get this?
Thanks in advance for your support!
Marcelo

Hi,
If you are trying to get a device certificate for WLC, then you may need to use 3rd party software like openSSL for this.
Below post may help you to see how you can do this
http://mrncciew.com/2013/04/22/configuring-eap-tls-on-wlc/
HTH
Rasika
*** Pls rate all useful responses ****

Certificates for Server and Client to install . Pls advice

I am doing File --XI --- File scenario with FTPS.
Currently consider only File -- XI part now.
We go point by point: for this link:
https://www.sdn.sap.com/irj/sdn/go/portal/prtroot/docs/library/uuid/964f67ec-0701-0010-bd88-f995abf4e1fc
Blog says:
1. In the visual admin of XI make Server Public and Private keys.
2. In the visual admin of XI make Client Public and Private keys.
Suppose File Sender System is Server and XI is Client
Questions:
a. Do I need make Server Public and Private keys In the visual admin of XI ?
b. Do I need make Client Public and Private keys In the visual admin of XI ?
Generic Rule -- system1 sends its public key to system2 and similarly system2 sends its public key to system1.
c. For Export keys and Import keys as given in blog
-- I am not able to get this part given from Page 38 - 41 of this blog.
Pls advice me
Regards
Edited by: Henry A on Mar 3, 2008 1:07 PM
Edited by: Henry A on Mar 3, 2008 1:08 PM
Edited by: Henry A on Mar 3, 2008 1:54 PM

Hi DecaXD,
thank you for quick response :)
on the client site i tried to establish the connection to the work repository with the following connection information:
Login information*:
Oracle Data Integrator Connection
Login name = odi_server
User = SUPERVISOR
Database connection (Master Repository):
User = odim
URL = jdbc:oracle:thin:@<server ip>:1521:orcl
A work repository could be found, but the connection failed! (?!)
" ODI-26130: Connection to the repository failed.
oracle.odi.core.config.NotWorkRepositorySchemaException: ODI-10147: Repository type mismatches.
Could not get JDBC Connection; nested exception is java.sql.SQLException: Unable to start the Universal Connection Pool: oracle.ucp.UniversalConnectionPoolException: Invalid SQL-Query for validating the connection (+translated from german into english+) "
my ODI configuration on the server site (loged in as: odiw):
topology tab*:
Physical architecture:
Technology:
Definition:
Dataserver name = oracle_db_11gr2
User = odiw
JDBC-URL = jdbc:oracle:thin:@10.168.178.131:1521:orcl
Datasource:
Agent = OracleDIAgent
JNDI-Name = [DataSourceName]
Agents:
Definition:
Name = OracleDIAgent
Host = <IP of the server>
Port = 8001
Webapplicationcontext = oraclediagent
Datasources:
Dataserver = oracle_db_11gr2
JNDI-Name = [DataSourceName]
Logical architecture:
Technology:
Defintion:
Name = oracle_db_11gr2
Context = aMIS_dev
Physical schema = oracle_db_11gr2.ODIW
Agent:
Name = OracleDIAgent
Context = aMIS_dev
Physical agent = OracleDIAgent
when i test the connection of the data server (topology>physical architecture>technology>oracle>oracle_db_11gr2) with the OracleDIAgent i receive the
" ODI-26039: Connection failed.
oracle.odi.runtime.agent.invocation.InvocationException: javax.naming.NameNotFoundException: Unable to resolve '[DataSourceName]'. Resolved ''; remaining name '[DataSourceName]' "
since testing the connection on the server site failed in first place, i couldn't test the connection on the client site.

How do I use home sharing for music and apps from different devices that already have Apple IDs? We have music from CDs and iTunes.

We have a iPhone 3G used as an touch, a 4S and 2 5s that I would like to share the music and possibly the pictures but i dont know how to set it up since we all have our own Apple IDs. Please help.

Do you have a computer. You can't share music or apps from one mobile device to another. To share photos you need to use photo stream shared albums.

Problems switching users and recovering from long sleep sessions

I upgraded my 2008 MacBook Pro to Mavericks and am now having issues with switching users and recovering from sleep. I can sometimes go to the login window but the system hangs when switching from one user to another. It often hangs after long sleep sessions.
Often I am finding that switching off and back on i sth easiest solution but I am getting a bit sick of it. Anyone have any suggestions?

funkyblue:
I usually leave my Pismo on and allow it to sleep. I find that waking from sleep and general functioning of the computer works a lot better if from time to time (I do it at least weekly) I shut down the computer, start up in Safe Mode, log in, empty Trash and reboot normally. The emptying Trash part clears the font caches.
You should consider doing other maintenance procedures, if you don't already. Gulliver's Mac OS X System Maintenance has good ideas with linked resources.
Please do not hesitate to post back with further questions or comments.
Good luck.
cornelius

What is the option client certificate for user authentication used for?

Hi All,
I have to work on a FTPS - XI -SAP scenario.
I can see an option for client certificate for user authentication when security is enabled for the FTP adapter. what exactly is this option used for?
P.S: I went through sap help but couldnt quite understand.

Thanks a lot Mark.
So for a FTPS -> XI -> SAP scenario the following settings are required.
1. I have to create a certificate in Visual Admin for the XI server , send a csr to a CA and get it signed by them, and i have to add this to the ssl_service view.
2. I have to hand over the public key to the FTPS server & this key will be used for encryption of the file
the above 2 steps are mandatory.
If i choose to use the client certificate option , i have to get the client certificate from the FTPS server and add it into the TrustedCAs list. This certificate is just to imply that the client is what it claims to be.
Will this certificate be used for encryption?
To make it clear let me put it this way. The certificate created in the XI Server is used for encryption and also for ascertaining that the its what it claims to be.
The clients certificate option is used only to make sure that the client is what its claiming to be & this is not used for encryption?

Cisco ISE User Authentication Certificates for Wired and Wirless Users (BYOD)

Can any one tell me from where we can purchase User Authentication Certificates for Wired and Wireless Users (BYOD) for Cisco ISE. Also Confirm what certificates we required for the purpose.
Please suggest the Website form where we can purchase and ipmort in Cisco ISE certificate Section.
Thanks.

Dear Mohana,
Thanks for your reply, Can you please confirm me in regards EAP-TLS certificate, which authorities you recomend if i go to Go dadday or very Sign to buy it and then import in ISE.
Looking forward for your reply.
Regards,
Muhammad Imran Shaikh
Resident Engineer, IT Network Section - PPL
Mobile : 0092-312-288-1010
LinkedIn : pk.linkedin.com/pub/muhammad-imran-shaikh/10/471/b47/

Can the SidHistory attribute be moved from one User account to a different User account in the same Forest/Domain?

Hello,
Can the SidHistory attribute be moved from one User account to a different User account in the same Forest/Domain manually with Active Directory Users and Computers or with something like Powershell? it would seem to me this is a safe operation.
Thanks for your help! SdeDot

Hi,
In addition, please also take a look at the below thread:
copy SIDHistory from one account to another in the same domain
http://social.technet.microsoft.com/Forums/en-US/2ca8727c-b3fd-4ef8-9747-99295f0cd61c/copy-sidhistory-from-one-account-to-another-in-the-same-domain?forum=winserverDS
Hope this helps
Best regards
Michael
If you have any feedback on our support, please click
here.
Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

Getting a list of users and permission from a folder

I run this command to get a a list of users and permission from a folder
$project_folder = "\\servername\foldername"
get-acl $project_folder | %{ $_.Access } | ft -property IdentityReference, AccessControlType, FileSystemRights > folder.csv.
This only lists information for 1 folder.
If i have multiple folders how should the code be modified?

this is the code i am looking for
$project_folder
= "\\servername\foldername\foldername1"
get-acl $project_folder | %{ $_.Access } | ft -property IdentityReference, AccessControlType,
FileSystemRights > folder.csv.
I run this code and this gives me the information for only the folder 'foldername1'.
Ex. i need a list of users who have permmission in \\servername\foldername\foldername2.
i run the code and it gives me the permissions and list of users in foldername2.
This is the issue
IF there are multiple folders \\servername\foldername\foldername2, \\servername\foldername\foldername1,
i need to run the code each time for 1 folder.
is there a command where i can combine the path of these 2 or more folders and export
it to csv
Ex. $project_folder
= "\\servername\foldername\foldername1",
"\\servername\foldername\foldername2"
get-acl $project_folder | %{ $_.Access } | ft -property IdentityReference, AccessControlType,
FileSystemRights > folder.csv.
This will give me the list of users and the type of access they have in foldername1 and
foldername2

I have a new Macbook pro and need to run some Windows software, it appears "Parallel" should work well from what I've have read. Will I have any issues or problems accessing and printing from various printers on my Windows 7 network within Parallel?

I have a new Macbook pro and need to run some Windows software, it appears "Parallel" should work well from what I've have read. Will I have any issues or problems accessing and printing from various printers on my Windows 7 network within Parallel? Is Parallel in fact the best way to go?

First, back up all data immediately, as your boot drive might be failing.
There are a few other possible causes of generalized slow performance that you can rule out easily.
Reset the System Management Controller.
If you have many image or video files on the Desktop with preview icons, move them to another folder.
If applicable, uncheck all boxes in the iCloud preference pane.
Disconnect all non-essential wired peripherals and remove aftermarket expansion cards, if any.
Check your keychains in Keychain Access for excessively duplicated items.
If you have more than one user account, you must be logged in as an administrator to carry out this step.
Launch the Console application in the same way you launched Activity Monitor. Make sure the title of the Console window is All Messages. If it isn't, select All Messages from the SYSTEM LOG QUERIES menu on the left. If you don't see that menu, select
View ▹ Show Log List
from the menu bar.
Select the 50 or so most recent entries in the log. Copy them to the Clipboard (command-C). Paste into a reply to this message (command-V). You're looking for entries at the end of the log, not at the beginning.
When posting a log extract, be selective. Don't post more than is requested.
Please do not indiscriminately dump thousands of lines from the log into this discussion.
Important: Some personal information, such as your name, may appear in the log. Anonymize before posting. That should be easy to do if your extract is not too long.

Loadbalance for servers thats belongs from different Vlan

Hi,
We are using FWSM and ACE module in our switch. We have to configure our new application in cisco ACE. Our exiciting servers and vip are in vlan5 and new servers and vips are in vlan 6. vlan 6 is defined in FWSM. We have craeated one interface vlan 6 for the application. While checking the interface status through "show interface vlan 6" we are getting the following error.
Not assigned from the Supervisor, down on Supervisor
We have already assigned vlan group to supervisor. We have allocated same interfce vlan to context also.
kindly suggest what chould be the issue.
Kindly suggest can we do the loadbalance for servers thats belongs from different Vlan???
Thanks in advance.
Regards,
Ranjith

Hi Daniel,
We are using cisco 6509 switch with FWSM and ACE module.
We have created interface VLAN 6 in FWSM and ACE and assigned the IP as follows.
FWSM Interface VLAN 6 is 10.6.10.55 and ACE Interfce VLAN 6 is 10.6.10.60.
We have 2 servers in the same vlan (.49 and .50). and they are physicaly connected to switch vlan 6 and logicaly connected to FWSM interface vlan 6.
We have defined the VIP as 10.6.10.51 and that is not pinging from our network.
Server default gateway and ACE default gateway is FWSM interface vlan 6 IP(ie, 10.6.10.55).
We dont want to change the server gateway as ACE interface vlan 6 ip.
KIndly suggest how can i achive the loadbalancing with out changing my server gateway to ACE IP.
Thanks in advance.
Regards,
Ranjith

BSR code on TDS Certificate for Customer and vendor in india

Hi
We have a requirement to print BSR code on TDS Certificates for customer and Vendor in india.
Currently the BSR code for Customer TDS certificates picked up from Bank branch ( BNKA-BRNCH ) field and
for vendor TDS certificates picked up from Bank Key field.
There is a 3rd party sowtware running monthly to update the BNKA table. so we are not following the standard process and we are implemented another options to picked up the BSR code for TDS certificate printing on Vendor/Customers.
For Vendor TDS certificate, we implemented SAP notes 1299729 & 1338645
to print the BSR code from Tax Number1 (T012-STCD1) field and it is working fine.
For customer TDS certificate also we want program to pickup BSR code
from Tax Number1 (T012-STCD1) field
Please let me know is there any other SAP correction Notes avalible to print the BSR code on Customer TDS certificates from Tax Number1 (T012-STCD1) field.
Thanks
Risha

answews

How to create windows users and groups from Java

Hi,
Can any one please tell me, which Package/API will helps to create windows users and groups from Java.
Thanks,
M.Prem.

You can't do it with pure Java, and it's not in the core API. You'd have to write a native function to do it, using whatever API Windows provides, and then call it with JNI. Or look for a third party native-based Java library that already does that.

Need to migrate Shared services users and groups from 9.3.1 to 11.1.2.2 ver

Hi All,
We need to migrate Shared services users and groups from 9.3.1 to 11.1.2.2 version. Any help would be appreciated. Can we use CSS import export utility?
Thanks in advance!!

Hi John, In my another environment I have to migrate the users and groups from Hyperion HSS 11.1.1.2 to Hyperion shared services 11.1.2.2. I am using LCM for that, when I export the users and gropus from 11.1.1.2, it exports fine but when i import it to my 11.1.2.2 using LCM, I am getting the below errors.
Error when I try to import the groups:
ErrorEPMIE-00051: Failed to perform operation on role. Could not locate role matching filter {0} and filter attribute {1}. Please ensure that a role exists matching the filter with filter attribute.
EPMIE-00024: Failed to import all of the membership info for group test group. Invalid group members encountered. Please ensure the validity of members and its existence in their respective providers.
Errors when i try to import the users:
ErrorEPMIE-00051: Failed to perform operation on role. Could not locate role matching filter {0} and filter attribute {1}. Please ensure that a role exists matching the filter with filter attribute.
EPMIE-00020: Failed to update user 04668162 during import. Invalid identity for user. Please ensure that the user is available in the system with the identity specified in the import file.
Any idea?
Thanks in advance.

Admin Console not displaying new Users and Groups from LDAP

We created a new Realm in WebLogic, which specifies the location of the Netscape
LDAP server. Our Weblogic application, called TGSLC, is able to find the ldap
server to use for authentication. My problem is this- the Admin Console is not
displaying the new users and groups from the LDAP server. Shouldn't the WebLogic
Admin Console display any users and groups specified in the ldap server, which
is referenced in the customized Realm?

Hi Andy,
I am not sure why you are unable to see the users and groups through the
console., you should be able to. Can you post the config.xml?
thanks,
-satya
Andy Levy <[email protected]> wrote in message
news:3b700c36$[email protected]..
>
We're running WLS 6.0 Sp2 on Windows 2000 Professional.
"Satya Ghattu" <[email protected]> wrote:
Andy,
Could you please tell us what Version of Weblogic you are running?
thanks,
-satya
Andy Levy <[email protected]> wrote in message
news:[email protected]..
We created a new Realm in WebLogic, which specifies the location ofthe
Netscape
LDAP server. Our Weblogic application, called TGSLC, is able to findthe
ldap
server to use for authentication. My problem is this- the Admin
Console
is not
displaying the new users and groups from the LDAP server. Shouldn'tthe
WebLogic
Admin Console display any users and groups specified in the ldap
server,
which
is referenced in the customized Realm?

Issuing certificates for user and clients from different forest/domain

Similar Messages

Maybe you are looking for