Renew root certificate

Hi all,
My self-signed root cert is expiring. I would like to ask if I renew this certificate at my CA server, will it affect my Exchange 2007 , especially mail flow? If so, how do I renew it without affecting?
I am most likely be renewing it without generating the new key.
Appreciate for any suggestions

Hi,
Based on my experience, a new self-signed certificate should be trusted by all clients. Thus, there will be security alert when clients try to use the new certificate. To deploy the certificate for all clients, we can depend on group policy:
http://unixwiz.net/techtips/deploy-webcert-gp.html
Note: Microsoft is providing this information as a convenience to you. The sites are not controlled by Microsoft. Microsoft cannot make any representations regarding the quality, safety, or suitability of any software or information found there. Please make
sure that you completely understand the risk before retrieving any suggestions from the above link.
However, I recommend you confirm it on our Windows server forum as the above suggestion.
To renew a self-signed certificate, you can refer to the following article：
http://www.ncol.net/how-to-renew-a-self-signed-certificate-in-exchange-server-2007/
Note: Microsoft is providing this information as a convenience to you. The sites are not controlled by Microsoft. Microsoft cannot make any representations regarding the quality, safety, or suitability of any software or information found there. Please make
sure that you completely understand the risk before retrieving any suggestions from the above link.
If you have any question, please feel free to let me know.
Thanks,
Angela Shi
TechNet Community Support
Thank you Angela for the reply, I have renewed my Exchange certificate. It is the root certificate that I need to do. If I were to renew the existing root cert, extending the expiry date, will all my clients connecting to the CA be automatically be updated
or I need to create a cert and install every PC connecting on my office lan?
Thanks again for the reply. Please do not stop the other suggestions from coming. I am grateful for all helpful advice I could get.

Similar Messages

Error while renewing the certificate in SSLM

Hi,
While renewing the certificate on SSLM I am getting the following error
% failed to parse or verify imported certificate.
I am able to upload root certificate successfully.
I am sure that I renewed the certificate using the correct parameters.
Please advise
Regards
Jithesh

Hi Jithesh,
This error can occur when you install the identity certificate and do not have the correct intermediate or root CA certificate authenticated with the associated trustpoint. You must remove and reauthenticate with the correct intermediate or root CA certificate. Contact your 3rd party vendor in order to verify that you received the correct CA certificate.
Cheers!!
Sachin

Java ssl and root certificate

We use JAVA as a client for secure SSL connection. For this is a SSL root certificate necessary, if not, the SSL handshake fails due the trust relationship.
SUN introduced the feature in version 1.5, that JAVA can use OS keystore and grab ROOT certificate from there.
Unfortunately, this is not working anymore with JAVA 1.6 and if the ROOT is not present in JAVA keystore, the SSL handsake fails. Once the ROOT is imported in JAVA keystore, the SSL works fine. SUN JAVA 1.5 works fine with same environment and ROOT does not need to be in JAVA keystore.
The failed SSL handsake is visible in Ethereal Sniffing log and is always reproducible.
Please, are there known issues, that SUN JAVA 1.6.x can not use OS keystore, but only JAVA keystore ? Are there any reported bugs ?

Right. Hopefully you've gotten acquainted with this:
http://technet.microsoft.com/en-us/library/ee126140(v=ws.10).aspx
Is the CA on the DC also issuing certs, or is it just the Enterprise Root and there are subordinates issuing certs? I ask because if it's just the Enterprise Root but not actually issuing certs, that simplifies things greatly. If it's issuing
certs, one thing to research is what certs are currently issued, how often they are renewed, and what they are used for. This will give you an idea how much risk you're looking at during cutover.
To address the specific question of what happens to a desktop that has been offline during the cutover, as I understand it the desktop will pull the new PKI information (new AIA path, new CDP if that gets changed) from AD when it comes back online.
This data is stored in "CN=Public Key Services,CN=Services,CN=Configuration,DC=Domain,DC=COM" in AD. In a nutshell, it should be seamless to that particular client.

Reissue CA Root Certificate

Hello,
I have a Windows 2008 R2 enterprise CA root and it is currently using MD5 as the hash on the Root Certificate. I have discovered that this causes a lot of problems with TLS 1.2. I would like to replace this with a certificate that uses sha256
which is supposed to be compatible with TLS 1.2.
In Certificate Services I see the option for Renewing a Root Certificate but that does not allow me to modify the encryption method.
Can anyone direct me to how I can accomplish this?
Thank you,
Matt

Hi,
I found two similar threads here, hope they are helpful:
Change signature algorithm - possible
http://social.technet.microsoft.com/Forums/windowsserver/en-US/568ef7b7-5cad-4225-b35a-4630a57a3ac5/change-signature-algorithm-possible?forum=winserversecurity
Is it possible to change the hash algorithm when I renew the Root CA
http://social.technet.microsoft.com/Forums/windowsserver/en-US/91572fee-b455-4495-a298-43f30792357e/is-it-possible-to-change-the-hash-algorithm-when-i-renew-the-root-ca?forum=winserversecurity
Regards,
Yan Li
Regards, Yan Li

How do I install a Root Certificate on my Iphone for an email account?

I use an email account requiring a root certificate to be installed on my phone. I have this on my PC and need to know how to actually import the certificate to my iPhone. I go through the normal setup with the account which shows the correct port settings, however, without the certificate, every time I try getting emails, it fails to connect with the server. Any ideas??

Thanks for the tip. I emailed the certificate to my other email account on my iPhone, but when I tried to open the attached certificate I got a message - "Invalid Profile - Profile format not recognized."
Any other ideas. I may have to just set up another sure email account with another server.

[solved] dovecot errors after renewing SSL certificate

System:
OS X Server (Mountain Lion) 2.2
Using a single SSL Certificate for all services.
Symptom:
Users can't log into their IMAP accounts hosted on OS X Server (Mountain Lion) after renewing SSL Certificate
Diagnostics:
Give you an indication whether it's this problem. Some or all may apply:
Log shows all kinds of dovecot errors. e.g.
dovecotd[nnn]: master: Error: service(config): command startup failed, throttling
config: Fatal: Error in configuration file /Library/Server/Mail/Config/dovecot/dovecot.conf: ssl enabled, but ssl_cert not set
dovecotd[nnn]: master: Error: service(config): command startup failed, throttling
/Library/Server/Mail/Config/dovecot/conf.d/10-ssl.conf shows commented out lines:
ssl_cert
ssl_key
ssl_ca
Solution:
Go to the Certificates pane of the Server App and choose Secure Services Using: Custom
Set IMAP and POP server certificates to to None
Keep an eye on what the server App is doing to /Library/Server/Mail/Config/dovecot/conf.d/10-ssl.conf
Now set Secure Services Using: <My single SSL Certificate for all services>
Keep an eye on what the server App is doing to /Library/Server/Mail/Config/dovecot/conf.d/10-ssl.conf and you should now see all the ssl* settings as you would expect, and pointing to the correct SSL certificate in /etc/certificates
Hope this works for you too!

I had something similar happen. When I do anything with SSL certificates it deletes any regular websites. Only the sites that are setup for https are listed.
Couldn't understand why my website wasn't working and it turned out that the system had deleted it. The web server had multiple host set and I had to rebuild all the ones that had used port 80. All the ones that use 443 were fine.
Hope this helps.

Keychain root certificate not trusted (?)

I see a couple of items in keychain access that say "root certificate not trusted"
what is this and should they be deleted or somehow modified?
I looked at certificates with Certificate assistant "evaluate certificate"
but do not quite understand.
Thanks

Ok I'll try not to...
Thanks

How to include a new root certificate in BlackBerry device

Dear Sir/Madam,
　TWCA is a certification authority in Taiwan provides security system for internet banking, stock trading, e-commerce and SSL certification service in Asia-Pacific region. TWCA wish to add its' root certificate into BlackBerry mobile device in order that our customers may use BlackBerry mobile device to do internet banking and stock trading on secured SSL Website. Could you provide some information about BlackBerry/RIM root certificate program?
Thanks and Regards.
Blues Lin
Solved!
Go to Solution.

Hi and Welcome to the Forums!
It sounds like your question is of a formal nature -- as in you wish to communicate directly with RIM for your query. Unfortunately, these forums are not a user-to/from-RIM communication vehicle -- rather, they are a user-to-user support forum. As such, it is unlikely that anyone from RIM will see and respond to your question. Hopefully some other user knows how to advise you, but I just wanted to set your expectation correctly about what to expect from these forums.
Good luck!
Occam's Razor nearly always applies when troubleshooting technology issues!
If anyone has been helpful to you, please show your appreciation by clicking the button inside of their post. Please click here and read, along with the threads to which it links, for helpful information to guide you as you proceed. I always recommend that you treat your BlackBerry like any other computing device, including using a regular backup schedule...click here for an article with instructions.
Join our BBM Channels
BSCF General Channel
PIN: C0001B7B4 Display/Scan Bar Code
Knowledge Base Updates
PIN: C0005A9AA Display/Scan Bar Code

Windows Root Certificate authority questions.

hello,
I have 2 questions with regards to Offline ROOT CA in a 2 TIER Hierarchy :
(1) Is it necessary to to ” map the Namespace of Active Directory to an Offline CA’s Registry Configuration” ? I didn’t do this step in my lab env and find this in some but
but not all the online posts as well. what happens if we don't run this command on offline CA ?
For instance: certutil.exe –setreg ca\DSConfigDN CN=Configuration,DC=lab,DC=com
(2) What happens if i do not publish the ROOT CA certificate via "certutil -dspublish -f xxx.cer ROOTCA " command but instead just push the root certificate using Default Domain Group Policy Object to "Trusted Root Auth" store
on all the domain machines ? What are the pros/cons of using the certutil method vs the GPO method ?
Thanks
Neeraj

> Is it necessary to to ” map the Namespace of Active Directory to an Offline CA’s Registry Configuration” ?
it is necessary only if you configure LDAP URLs for CRL Dsitribution Points and Authority Information Access extensions on Root CA (not recommended).
> What are the pros/cons of using the certutil method vs the GPO method ?
different scopes. When publishing in Active Directory, it is downloaded to all
*forest* members, while GPO covers only limited scope (domain, site or OU).
Vadims Podāns, aka PowerShell CryptoGuy
My weblog: en-us.sysadmins.lv
PowerShell PKI Module: pspki.codeplex.com
PowerShell Cmdlet Help Editor pscmdlethelpeditor.codeplex.com
Check out new: SSL Certificate Verifier
Check out new:
PowerShell File Checksum Integrity Verifier tool.

WHere are the root certificates stored on the iPhone 5C, there is nothing in settings for profile?

WHere can I find the Application Root certificates on my 5C, I need to delete one so I can reload it?

Reinstall the certificate and then navigate to your profiles- is the certificate provisioning, configuration, or wifi certificate based. Or is it other? Please restate...

Where are root certificate located in OS 10.6.8?

I have been using Outlook for my mail, as Mail has dropped several attachments and does not seem to be as reliable. However, I am receiving error messages informing me that the root certificates for my .me account are not trusted. I accessed Keychain after downloading certificates from the Apple website, but I was not allowed to drag them into Keychain. When I attempted to open them, nothing seemed to happen to the list that was there. Does anyone know how to resolve this "untrusted certificate" issue?

You have probably figured this out by now, but I had trouble with this also. I figured it out by first quitting Safari, then going to the folder mentioned by Niel (Choose Go to Folder from the Finder's Go menu and provide ~/Library/Safari/ as the path).
Once that folder is opened, leave it open and then enter Time Machine. It will open up to that folder and then go back to your backup you want to restore from and restore the bookmarks.plst file.
That worked for me anyway and was a huge save after an iCloud mistake!
Shawn

SSPR registration and reset started to fail after renewing the certificates

Hi,
On our FIM 2010 R2 environment (version 4.1.3599.0), after renewing the certificates used on FIM Service/Portal and Password Reset/Registration servers two days back, both the password registration and reset no longer work but instead fails on the last
step of the process. So for example when user browse to https://passwordreset.domain.com and fills in their domain\username and click next, FIM will send a security code (SMS OTP) to user´s mobile phone and once user then fills in code and click Next, the
Communication error 3008 is shown to user. Same happens in the last step of the registration where user reviews that the mobile number is correct before clicking finally next. Once clicked the same error as is with Reset portal is shown to user.
Other changes than renewing the certificates have not been done to the environment after it was working last time two days ago. Synchronization of users/groups create in FIM Portal works normally towards AD.
All servers within FIM environment are on same domain and subnet and firewall is off on all servers.
The following error message as an example is recorded on FIM app log on either of the SSPR servers (two in NLB):
The error page was displayed to the user.
Details:
Title: Communication Error
Message: An error has occurred. Please try again, and if the problem persists, contact your help desk or system administrator. (Error 3008)
Source:
Attributes:
Details: Microsoft.IdentityManagement.CredentialManagement.Portal.Exceptions.GenericCommunicationException: An error occurred while receiving the HTTP response to http://fimservice.domain.com:5726/ResourceManagementService/SecurityTokenService/Registration.
This could be due to the service endpoint binding not using the HTTP protocol. This could also be due to an HTTP request context being aborted by the server (possibly due to the service shutting down). See server logs for more details. ---> System.ServiceModel.CommunicationException:
An error occurred while receiving the HTTP response to http://fimservice.domain.com:5726/ResourceManagementService/SecurityTokenService/Registration. This could be due to the service endpoint binding not using the HTTP protocol. This could also be due to an
HTTP request context being aborted by the server (possibly due to the service shutting down). See server logs for more details. ---> System.Net.WebException: The underlying connection was closed: An unexpected error occurred on a receive. ---> System.IO.IOException:
Unable to read data from the transport connection: An existing connection was forcibly closed by the remote host. ---> System.Net.Sockets.SocketException: An existing connection was forcibly closed by the remote host
The following error message as an example is recorded on FIM app log on either of the FIM Service/Portal servers (two in NLB):
Microsoft.ResourceManagement.Service: System.NullReferenceException: Object reference not set to an instance of an object.
at Microsoft.ResourceManagement.WebServices.SecurityTokenService.TokenIssuer.IssueSecurityToken(Message requestMessage, Object request, Claim[] claims)
at Microsoft.ResourceManagement.WebServices.SecurityTokenService.Challenger.IssueAuthenticationChallenge(Message requestMessage, Object requestBody, Nullable`1 requestContext, UniqueIdentifier authenticationProcessIdentifier, List`1 accumulatedClaims,
Nullable`1& currentWorkflowInstanceIdentifier, AuthenticationChallengeType[]& currentChallenges)
at Microsoft.ResourceManagement.WebServices.SecurityTokenService.ProcessRequest(Message requestMessage, Object requestBody)
at Microsoft.ResourceManagement.WebServices.SecurityTokenService.RequestSecurityTokenResponse(Message requestMessage)
Both http://fimservice.domain.com:5726 or http://fimservice.domain.com:5725 can be accessed ok using web browser from the SSPR servers. The url of http://fimservice.domain.com:5726/ResourceManagementService/SecurityTokenService/Registration gives http 400 bad
request which is ok.
At least the following fixes provided on urls below have been tried out or were in place already but did not fix the issue:
http://social.technet.microsoft.com/wiki/contents/articles/24629.fim-troubleshooting-sspr-registration-error-3008-an-error-occurred-while-receiving-the-http-response.aspx
https://social.technet.microsoft.com/Forums/en-US/ae16496e-413a-45b7-a0d1-b39652c6478a/fim-password-registration-portal-error-3008-communication-error?forum=ilm2 (we have exactly the same three errors on FIM app log as mentioned in this post)
https://social.technet.microsoft.com/Forums/en-US/aa14cff7-6b93-4413-8c75-737dd08bd25f/error-when-resetting-password-on-sspr?forum=ilm2
https://social.technet.microsoft.com/Forums/en-US/aab6d5ef-667a-4ea9-876d-415c56852da9/sspr-password-reset-failure?forum=ilm2 (no such lines on FIMService config files)
Can anyone help us with this and provide some tips what to check next on the environment? As the most weird thing here is that everything was working just fine before the certificates were renewed on all servers and no other changes were done on the environment.
-Pappa75

Hi,
Have you Stop-Start the FIM Service? If not then try this after performing this step. Also, there may be a possibility that the service won't be able to start if there is issue with the certificate.
The SSPR issue is related to certificate only, which might have some missmatch in the thumbprint value or some other problem.
If there is a problem with thumbprint of certificate, then you might see error in the Event Viewer and which can be resolved by making the certificate's thumbprint same within registry.
Regards,
Manuj Khurana

Problem updating CA root certificates in cacerts file

I've searched all over for this problem, and none of the posting seems to apply
to my situation. Hope this is not a repeat post.
I'm running WLS7 SP2 on W2K AS. I had SSL configured and working properly, until
1/7/2004 came along, of course. I followed the directions in http://sunsolve.sun.com/pub-cgi/retrieve.pl?doc=fsalert/57436
to update the Verisign Class2 and 3 root certificates in the cacerts file without
any problem. I also verified from the WL log that the server is reading the "cacerts"
file located in <bea_home>\server\lib. However, when I pulled up my website using
https://, I still get the "...security certificate has expired ..." message.
Why is my browser not getting the updated CA certificates from WLS?
Any help you can provide is much appreciated.
Michael An

Is the server's identity certificate issued by Verisign? Have you updated it? Does
the identity certificate chain include the root CA certificate? It might be that
the browser contains the expired certs among its trusted ca certificates, uses
them to complete the chain and then complains about it.
Pavel.
"Michael An" <[email protected]> wrote:
>
I've searched all over for this problem, and none of the posting seems
to apply
to my situation. Hope this is not a repeat post.
I'm running WLS7 SP2 on W2K AS. I had SSL configured and working properly,
until
1/7/2004 came along, of course. I followed the directions in http://sunsolve.sun.com/pub-cgi/retrieve.pl?doc=fsalert/57436
to update the Verisign Class2 and 3 root certificates in the cacerts
file without
any problem. I also verified from the WL log that the server is reading
the "cacerts"
file located in <bea_home>\server\lib. However, when I pulled up my
website using
https://, I still get the "...security certificate has expired ..." message.
Why is my browser not getting the updated CA certificates from WLS?
Any help you can provide is much appreciated.
Michael An

HT5012 Can I install two root certificates with the same name in iPad?

Can I install two root certificates with the same name in iPad?

Antaeus00 wrote:
I tried sending a request for help,
But did you succeeed in sending a request for help?
Did you receive a response? How long has it been since you sent a request?
but I need someone with more authority to talk to.
There is no one with more authority than iTunes store support. We herem are only users.

How to import a Root Certificate Authority for signing

How can I import a Root Certificate Authority in order to use it with Certificate Assistant as a CA to sign other certs?
I have the CA cert imported in keychain along with it's associated private key (from a .p12), it's got the gold icon and is recognized as a Root certificate authority, yet Certificate Assistant will not list it as an available Root CA in the "Set Default CA" action dialog, the "Add..." dialog seems only interested in a ".certAuthorityConfig" plist file.
Do I have to generate a certAuthorityConfig for the CA? I can't seem to find a way to do that. No clues from certtool & security CLI utils even.
Any info/leads on how to get this to work would be much appreciated.
Regards,
-david

Hi Alex,
From ACE perspective, it doesn't make differences if you are using certificates issued by your local or a "well known" CA. Moreover, if not mistaken, you have to configure authentication group whatever you are doing client or server authentication.
http://www.cisco.com/en/US/partner/docs/app_ntwk_services/data_center_app_services/ace_appliances/vA4_1_0/configuration/ssl/guide/certkeys.html#wp1043643
Thanks,
Olivier

Renew root certificate

Similar Messages

Maybe you are looking for