Self Generated certificate validity issue in ACS 4.0 for Windows

Hi,
Is there any solution to extend the validity time of self generated certificate on ACS, by default the validity is set for one year.
As the server certificate on one of the ACS which is CA has expired and need to renew it.
Is it possible only one certificate from third party can be used both as a server certificate and certificate from CA for other ACS servers.
Thanks in Advance
Regards,
Ahmed

Other solution would be to create an in house(Microsoft probably) CA, and get a certificate for your ACS server. Go through the installation steps of Microsoft CA before, as the validity date for Server Certificate(i guess) is configured during initial install of CA.
Regards,
Prem

Similar Messages

CA and Certificate Issue in ACS 4.0 For Windows 2003 Enterprise Server

Hi,
I have configured Microsoft CA server on the same ACS 4.0 for Windows 2003 enterprise server which was configured earlier using the self generated certificates for EAP and PEAP authentications.
After I change the certificate from self generated to the new CA certificate that can be viewed under install ACS certificate option on ACS server but having the following problems
1. SSL is not functioning while internet browser access to the ACS server and going through http instead of https.
2. Wireless clients are authenticated successfully even after the certificate is uninstalled.
Any help on these problems will be appreciated.
Thanks
Best Regards,
Ahmed

Hi Rohit,
Thanks for reminding the HTTPS option under Administration Control on ACS.
I have some doubts pertaining to installation of certificates on Wireless clients though it is optional for Self Generated Certificates but what in case of Mirosoft CA as I tested wireless client authentications even after removing the certificate from microsoft supplicant WindowsXP SP2 having installed the patch KB885453 for PEAP. How the certificate on wireless client works.
Is it mandatory or optional to keep certificate on Wireless Clients as they could able to get authenticated through ACS after removing the certificate.
Thanks
Best Regards,
Ahmed

Certificate issues in ACS 4.0 for Windows

Hi,
One of the ACS is configured as CA using third party Certificate, But the server certificate on ACS was self generated and is expired.
I tried using the same third party certificate to replace the existing expired server certificate on ACS both by generating CSR on ACS and install new certificate using local storage and read from file options but failed.It gives the following error while using CSR generated private key
"private key doesnt fit for this certificate"
Next assuming that the installed third party certificate with its own private key can be used to install certificate from the storage gives the following error:
"Cannot get the private key from certificate. It's absent or not marked as exportable"
Again assuming that third party certificate has multi server/seat licences.
Any solution to this issue will be of great help.
Thanks
Regards,
Ahmed

Re-installing the certificate may resolve this issue.
Install CA Certificate on your Appliance
===============================
A. Go to System Configuration > ACS Certificate Setup > ACS Certification Authority
Setup
B. Click "Download CA certificate file"
C. Type the IP address or hostname of the FTP server in the FTP Server field
D. Type a valid username that Cisco Secure ACS can use to access the FTP server in the
Login field
E. Type the above user's password in the Password field
F. Type the relative path from the FTP server root directory to the directory containing
the CA certificate file in the Remote FTP Directory field
G. Type the name of the CA certificate file in the Remote FTP File Name field
H. Click Submit
I. Verify the filename in the field and click Submit
J. Restart the ACS services in System Configuration > Service Control

CA certificate issue in ACS 4.0 for Windows

Hi,
How to generate lost private key .pvk file on ACS which is also configured as CA Server, As I would like to register all the available ACS's Servers to CA Server using the same certificate from CA Server. Need a step wise procedure on obtaining certificate from ACS CA server.
your kind response will be of great help.
Thanks in advance
Best Regards,
Ahmed

Windows Server 2003 with SP1, Enterprise Edition, is used so that auto-enrollment of user and workstation certificates for EAP-TLS authentication can be configured. This is described in the EAP-TLS Authentication section of this document. Certificate auto-enrollment and auto-renewal make it easier to deploy certificates and improve security by automatically expiring and renewing certificates.

Install self generated certificates

Hi all,
Can anyone advise on how to install a self generated certificates as a trusted server/client server?
Regards
Ken

Hi Ken,
Which version of WebServer are you using?
The following docs for WebServer 6.1 sp5 gives all of the information that you should need about installing certificates:
http://docs.sun.com/source/819-0130/agcert.html#wp1004981
Hope this helps

Directory Caching issue with Cisco Jabber client for Windows

Hi ,
I am facing cache issue with Cisco Jabber client for Windows. If I do any change related to modification or deletion of contacts in Active Directory/ Callmanager, it does not reflect in the Jabber. Because jabber takes the contacts from the locally stored cache file in the Windows system.
Every time I have to remove the cache file to overcome this issue, practically it's not possible to do the same with all the Widows users. As, if any employee leaves the company and still I can see his contact appears in the "Cisco Jabber client". I have not seen this issue with Android/Apple iOS.
Is there any automated way to remove the cache file?
Here is the detail of CUCM,Presence and Jabber.
CUCM version: 9.1.x
Presence : 9.1.X
Jabber : 10.5 and 10.6

Hello
On our environment we had to install a dedicated Microsoft Certificate Authority "just for Cisco Jabber usage" to house the
Network Device Enrollment Service.
Our certificate for the CUPS were generated on this Certification Authority too.
I discussed this certificate matter with my colleagues this afternoon and nobody seems to remember how these certificates were deployed into the
Enterprise Trust store for the users.
But I think they asked all 400 users to accept the 3 certificates by answering "yes" to the popup instead of using a script deployed by GPO...
I wish you success with that deployment and really hope you have a technical partner that *Knows* this subject.
Our partner left us alone with that unfortunately.
Florent
EDIT: If the "Certutil script method" works, please let me know. This could be useful in our own deployment.

ACS 3.2 for Windows and MS Windows AD Directory Integration Problem

Dear all,
We have some issues while integrating Windows AD with ACS 3.2 for Windows.Currently we have done the following:
1. Installed ACS 3.2 for Windows on Windows 2003 Enterprise with SP1
2. ACS and Domain Controller are configured on the same server
Checked and verified the following configurations
1. created a domain user "csacs" selected Act as a part of operating system and log on as a service enabled for this user.
2. Enabled all the CS services to log on as a user csacs.
But I noticed CS services are not respdonding and gives the error as "Could not able to start the service with service specific error ..." while trying to start services manually on ACS.
Kindly help me through this integration part
An easy and handy Step wise procedure on configuring integration of AD with ACS 3.2 on both Domain Controller and on Member server will be of great help.
Thanks
Kind Regards,
Ahmed

I have no issues running Cisco ACS version 3.2 on Windows
Server 2003 with SP2:
1) create user test1 in MS Active Directory and put test1
in users group with dial-in access granted,
3) Create a group called "LDAP". Actually I renamed
group name "group 1" to "LDAP".
3) in ACS external user database configuration, I specified
domain "CCIE" as for this. unknow user policy is to use
Windows Database configuration,
4) Configure the database configuration in ACS to point
to "CCIE" windows domain,
5) setup the ACS to authenticate one of your Cisco devices
and log in using the MS windows account,
By the way, mgurwara, you are wrong. I run Cisco
ACS 3.2 on windows 2003 Enterprise Edition with Service
Pack 2. I am running it on a Dell Optiplex Gx240
(1.7 GHz with 512MB of RAM) and it is running fine.
I use it to manage about 20 cisco devices and
about 200 Wireless LEAP user(s). Furthermore, I am also
running ACS 4.1 on another identical hardware. It has
nothing to do with the hardware. I don't know where
you get that information from.

CiscoSecure ACS v2.4 for Windows NT Upgrade

We still have two ancient instances of CiscoSecure ACS v2.4 for Windows NT running on our network. ACS1 (primary) and ACS2 (secondary). I would like to upgrade these, not only because of how old they are but because of an issue trying to replicate the user and group database from ACS1 to ACS2. When trying to replicate the user and group database the logs say it's successful but the databases don't match. ACS2 is missing some of the users that are in ACS1. I have successfully replicated the interface database. But for whatever reason, the user and group database will not replicate.
First, is there any other way I can get the user and group database copied from ACS1 to ACS2? Other than using the built in database replication tool?
Second, is there any way I can get these upgraded? I read that the recommended upgrade path is 2.4->2.6->3.0->3.2. But Cisco no longer has version 2.6 available for download. I really would like to upgrade rather than starting from scratch.
Thanks!

ACS 2.4 - wow! That hasn't been sold for over 11 years. (reference)
Think about it - would you want to try to upgrade Windows 98 to Windows 7? That's about an equivalent span of software product timeline.
The current product is so different that even if you could upgrade it would not be advisable to do so. While painful, it would be much better option to make a clean break with the old and move onto a current platform (e.g ACS 5.3).

HT1926 iTunes will not install on my computer (Windows 8) and i tried everything in "Issues installing iTunes or QuickTime for Windows" but nothing worked. any help?

iTunes will not install on my computer (Windows 8) and i tried everything in "Issues installing iTunes or QuickTime for Windows" but nothing worked. any help?

Many thanks.
Error 7 (Windows error 127)
Try the following user tip:
Troubleshooting issues with iTunes for Windows updates

Advice for Buying Cisco Secure ACS 3.3 for Windows

Just need advice on what other things I NEED to order apart from the Windows server when I want to iplement ACS and I want to use CISCO SECURE ACS 3.3 FOR WINDOWS
Hope someone will help

Hi,
This is all what you require:
Supported Operating System
Cisco Secure ACS for Windows Servers 3.3 supports the Windows operating systems listed below. Both the operating system and the service pack must be English-language versions.
Windows 2000 Server, with Service Pack 4 installed
Windows 2000 Advanced Server, with the following conditions:
with Service Pack 4 installed
without features specific to Windows 2000 Advanced Server enabled
Windows Server 2003, Enterprise Edition
Windows Server 2003, Standard Edition
Note The following restrictions apply to support for Microsoft Windows operating systems:
We have not tested and cannot support the multi-processor feature of any supported operating system.
We cannot support Microsoft clustering service on any supported operating system.
Windows 2000 Datacenter Server is not a supported operating system.
Please refer to the following link for more information:
http://www.cisco.com/univercd/cc/td/doc/product/access/acs_soft/csacs4nt/acs33/win33sdt.htm
Thanx & Regards

Using Tabs in Generated Pages - Validation Issue

Hi,
We're using JHS 10.1.3.0.97 and are using the "stacked" regions functionality
to make the form less cluttered.
The problem we're having now is that whenever a user wants to
view the items on a tab (that is not currently the selected one),
a validation issue is thrown saying that all the mandatory fields need to be entered first.
Is there a way to avoid this message and postpone the validation until the
user clicks on the "Save" button?
Regards,
Cliff

Cliff,
I am sorry, in the 10.1.3.1 release we switch off server-side model validation on a partial page request.
It is not possible to switch off the client-side validation, because the only way to do this, is by setting immediate=true on the tabs. However, with this setting JSF will skip the Model Update phase, which means that any changes you made to the tab region you are going to leave by clicking another tab, would be lost.
The only alternative is by creatign a custom templates and generating the required items with showRequired="true" instead of required="true" which means required items are never checked client-side.
Steven Davelaar,
JHeadstart Team.

Generate certificates valid for smart card (Windows logon) with third party PKI (not Microsoft)

Hello everyone
today I am working on a mounted on a Red Hat Enterprise PKI
Linux Server release 5.5 (Tikanga) is Easycert 5.2.2.15. We need to know what are the necessary data that we have to go to the PKI so it can generate certificates of users in Active Directory for use with a USB Token (ACOS5-64 CHIP CRYPTO) functioning as Smart
Card to make the login of users on computers.
On the other hand also we need to know the necessary settings between the third party pki and the domains controllers (Windows 2012).
Greetings and I hope for you response.
TechCach

> It is for Windows 2012.
nothing changed since Windows Server 2003. Here is a KB article:
http://support2.microsoft.com/kb/281245
> Is
the
scenario
supported
by
microsoft?
yes, of course. See KB article above.
My weblog: en-us.sysadmins.lv
PowerShell PKI Module: pspki.codeplex.com
PowerShell Cmdlet Help Editor pscmdlethelpeditor.codeplex.com
Check out new: SSL Certificate Verifier
Check out new:
PowerShell FCIV tool.

User-changeable Passwords issue f/ ACS 4.0 on Windows Server 2003

I am having an issue with the UCP website not functioning correctly. I have installed it from the ACS 4.0 CD, following the instructions from the Cisco.com website, but cannot get past the Login page. Users can get to the Login page, but after they enter their information (username / password) and click Login, the server returns the following error page: "CGI Error. The apecified CGI application misbehaved by not returning a complete set of HTTP headers."
I cannot get past this page. I have verified that the website is installed as outlined in the Cisco procedure, and have re-installed twice to verify. I have granted Everyone Write and Execute permissions to the site directories, and granted the Virtual Directories Script and Executable access.
Any help on this would be greatly appreciated. I am evaluating ACS 4.0 for deployment in our company, and UCP not working is a major stumbling block.
Additional configuration information:
Windows Server 2003 SP1, patched current to 8/29/06
The ACS server is also running on this server; it was installed and tested first, before installing UCP.
Thanks,
John

Change the user that runs CSusercgi.exe to Administrator.Refer the following steps Install UCP 4 on a machine that runs IIS server,Open IIS manager,Locate Default Web Site, Double click on the virtual name 'securecgi-bin',Right click on CSusercgi.exe and choose Properties,Choose 'File Security' tab,Choose 'Edit' in 'Authentication and access control' area,Change username from IUSR_ to 'Administrator' and enter his password.

Delete proxy config on Cisco Secure ACS 4.1 for Windows ?

We have a pair of ACS 4.1 servers (Windows Server 2003 R2). Let's call them ACS1 and ACS2.
We don't want either one of them to proxy to any AAA server, including each other. We're using mostly TACACS authentication.
While troubleshooting a general problem, I'm guessing that one of us did this on ACS1:
pressed the Network Configuration button,
saw the Proxy Distribution Table
clicked (Default)
moved ACS1 from the AAA Servers column to the Forward To column.
So, essentially, we're telling ACS1 to proxy all requests to itself, which doesn't seem to make sense. I don't know for sure whether it should work when configured to "self proxy," but in that state, it does not authenticate anyone and gives merely "Internal error" as the reason.
If I change the configuration so that "ACS2" appears in the Forward To column, and I move "ACS1" back to AAA Servers and restart, ACS1 starts responding correctly to TACACS requests. Of course, ACS1 is just proxying all requests to ACS2, so having two servers isn't doing much good.
I cannot simply remove ACS1 from the Forward To column and leave it empty. The interface complains that it can't forward to zero servers. Of course, on ACS2, there are no servers in the Forward To column, since we never touched the Proxy Distribution Table there.
Is there any way to return the Proxy Distribution Table to its default setup, that is, no servers appear in the "Forward To" column?
We're planning to upgrade to version 4.2 very soon, so this question is mostly academic, unless the same problem exists in 4.2.
For full disclosure, I should mention that the problem we were troubleshooting was loss of connectivity to our Windows Domain Controllers from our ACS servers. We had missed adding some exceptions in our firewalls to allow for four new DCs. As far as we can tell from testing, connectivity to the DCs is now fine. The firewall rules group ACS1 and ACS2 together, so connectivity should be the same, and ACS2 authenticates users correctly.

Hello Jeffrey,
By default the ACS 4.x Proxy Distribution Settings should have the ACS entry for itself on the Forward To box. Your ACS1 entry should be on the Forward To box.
The Internal Error message on the ACS should be highligthing a different issue on your ACS1. Also, the message stating that we cannot have zero servers on the "Forward To" box is expected.
Set your ACS1 for Full Logging Detail (System Configuration > Service Control) and configure the ACS1 entry under the Forward To box. Recreate the authentication issue and collect a package.cab file. If you have an ACS for Windows, under the ACS Installation folder look for the CSAuth folder > Logs and share the auth.log file with a failure timestamp for us to review the ACS logs when failing with Internal Error.
If this was helpful please rate.
Regards.

ACS 4.2 For Windows DB Replication

Hi Folks.
I have a pair of ACS for windows 4,2 and we also have a few mappings (ACS Group --> AD Group)
The replication process was configured and it replicates all the seetings, but the Group Mappings.
Is this the way it's supposed to be or it should replicate the group mappings as well?
Best regards,
AL

The following items cannot be replicated:
•IP pool definitions (for more information, see About IP Pools Server).
•ACS certificate and private key files.
•Unknown user group mapping configuration.
•Dynamically-mapped users.
•Settings on the ACS Service Management page in the System Configuration section.
•RDBMS Synchronization settings.
User guide
http://www.ciscosystems.com/en/US/docs/net_mgmt/cisco_secure_access_control_server_for_windows/4.2/user/guide/SCAdv.html#wp756078
Regards,
Jatin
Do rate helpful posts-

Self Generated certificate validity issue in ACS 4.0 for Windows

Similar Messages

Maybe you are looking for