Sequential Certificate Serial Numbers using Windows 2008 R2

It appears that Windows Server 2003 Certificate Services supports sequential certificate serial numbers.  This was an undocumented feature that could be turned on using the certutil command or modifying the CA registry. 
The certutil command line is: certutil –setreg ca \HighSerial “nn” where ’nn’ is a two digit hex number where at least one of the digits is an alpha character.
We are standing up OCSP and the ramdon serial numbers are causing difficulty in setting up the OCSP responder. 
Is this configuration supported on 2008 R2?  Can the same certutil command be used? 

Thanks for the responses.
I completed quite a bit of testing on this since posting the question.  Here is what I found:
Our 2008 R2 CA was upgraded/migrated from 2003 Enterprise Edition (32-bit).  There was a registry setting of 'ca\HighSerial = 00'.  The CA was issuing certificates with 10 byte serial numbers.  The serial numbers had a random component. 
Example:'4d8e5068000000000794'
Changing the registry to 'ca\HighSerial = 3f' and restarting resulted in a 19 byte certificate serial number that began with '3f'.  This did not correct the problem I was working because there was a random 10 bytes in the middle of the cert serial number. 
Example: '3F0000079C594AB5A5DB42C09D00000000079C'
Changing the registry to 'ca\HighSerial = 10' and restarting also resulted in a 19 byte certificate serial number.  Same result as '3f' but the certificate SN started with '10'. Example: '10000007AA9C90775F1967F8D30000000007AA'
I then used certutil.exe.  This time I  ran 'Certutil -setreg ca\HighSerial 0xffffffff'.  This updated the registry to 'ffffffff'.  After restarting certificate services and issuing a certificate, the serial numbers were shorter (only
14 bytes).  I also noticed that the registry setting was changed to a random 8 byte string.  The registry setting was changed from 'ffffffff' to 'e07c453ae9d4131a’
and the certificate serial numbers were similar.  Additionally, the last 6 bytes were sequential.  Example: '607c453ae9d4131a0000000007b0'
From there, I shortened the registry entry to 4 bytes (removing pairs of characters from the middle).  This resulted is a 10 byte certificate serial number where the first 4 bytes were the same and the last 6 bytes were sequential.  Example: '607c3a1a0000000007c4'

Similar Messages

  • When I try to print using Windows 2008 print server I have to use the generic print drivers supplied. If I use the OEM driver the printer locks up. I have tried a HP 4 plus and a Canon Copier.

    When I try to print using Windows 2008 print server I have to use the generic print drivers supplied. If I use the OEM driver the printer locks up. I have tried a HP 4 plus and a Canon Copier.

    A number of vendor drivers written for OS X cannot be used when connecting via SMB to a printer that is shared by Windows. This is due to limitations of the driver.
    In some cases, if you were to enable the LPD Print Service in Windows, you can connect to the share using the same syntax as SMB but on the Mac you would use the LPD as the protocol.
    If you can reply with the brand and model of printer you have then we may be able to provide more information.

  • RMA with reference to Serial Numbers using oe_order_pub.process_order

    Hi,
    Can any one pls let me know how to create RMA with reference to Serial Numbers using oe_order_pub.process_order API.
    Thanks,
    Praveen
    Edited by: user11186474 on Feb 19, 2010 6:00 AM

    We need to pass the following parameters when doing RMA with reference to Serial numbers.
    l_line_tbl (1).return_reason_code := 'WRONG PRODUCT';--RETURN REASON CODE
    l_line_tbl (1).reference_line_id :=390744;--Sales order Line ID
    l_line_tbl (1).reference_header_id :=193001;--Sales Order Header ID
    l_line_tbl(1).return_context := 'SERIAL';--REFERENCE TYPE
    l_line_tbl(1).return_attribute1 := '215990';--ITEMID FOR RMA
    l_line_tbl(1).return_attribute2 := 'RMA_TEST-9';--SERIALNUMBER
    Thanks,
    Praveen

  • Build Novell 6 on virtual machine using windows 2008 r2?

    Hello.It will work this configuration?Somebody tried this?i have a novell 6 server using a IBM machine and i bought a new DELL machine with windows 2008 R2 enterprise.I want to put Novell server on a virtual machine build with 2008 R2.Will work novell on virtual machine?or i will have problem with workstation to "see" the TREE?i heard that this could be a problem, that putting a novell on a virtual machine, workstations won't see the built TREE.I also have a problem with my actual Novell:when i puuted it with IP, it didn't work, so i let it with IPX/SPX.But i have windows 7 workstation and i cannot connect them to my NOVELL network.Please help me.

    On 30/11/2011 07:56, shtou wrote:
    > Hello.It will work this configuration?Somebody tried this?i have a
    > novell 6 server using a IBM machine and i bought a new DELL machine with
    > windows 2008 R2 enterprise.I want to put Novell server on a virtual
    > machine build with 2008 R2.Will work novell on virtual machine?or i will
    > have problem with workstation to "see" the TREE?i heard that this could
    > be a problem, that putting a novell on a virtual machine, workstations
    > won't see the built TREE.I also have a problem with my actual
    > Novell:when i puuted it with IP, it didn't work, so i let it with
    > IPX/SPX.But i have windows 7 workstation and i cannot connect them to my
    > NOVELL network.Please help me.
    By "Novell 6" do you perhaps mean NetWare 6 (Novell is the company not
    the product)? Does "6" imply 6.0 or 6.5? The latter is more suited to
    being virtualised.
    HTH.
    Simon
    Novell Knowledge Partner (NKP)
    Do you work with Novell technologies at a university, college or school?
    If so, your campus could benefit from joining the Novell Technology
    Transfer Partner (TTP) program. See novell.com/ttp for more details.

  • How to set up fax solution using Windows 2008 R2 Fax server role and Exchange 2007

    Hello, 
    I don't know if this is the right forum to post this but since it is related to Exchange I thought it might be. If this is not the right place, please direct me to the forum where my post would be more appropriate.  
    I'm looking to set up a Fax solution for the company that I work for as we are moving away from analog phone lines to VoIP using SIP. My original thought was to set up a Windows 2008 R2 server with Fax server role installed and have it route the fax message
    to Exchange 2007 SP3 so the fax message can be delivered to each user's inbox. I was reading a little bit on the Windows Fax server role and from what I saw it looks like it can only route fax messages to one email address. This not ideal for my company. Is
    there a way to have the fax server role route the email to each user's inbox? If so, how can I achieve this?
    How can implement this for this sending outgoing faxes as well?
    I don't know if this releveant or not but I will be using Asterisk as a media gateway between our SIP trunks and the Windows Fax server. 
    Any help is appreciated. Thanks!

    Please find the below url for the complete Fax configuration in Exchange 2007 Unified Messaging
    http://blogs.technet.com/b/exchange/archive/2007/04/18/3401950.aspx
    The article is so easy to understand with detail procedure and guideliness
    Exchange Queries

  • Using Windows 2008 R2 RD Session Hosts in Windows 2012 RD Deployments

    Just a couple of observations from our attempt to deploy Windows 2008 R2 RD Session Hosts as part of a Windows 2012 RD Deployment. Hopefully these save someone the angst of not finding answers in other documentation.
    1. Our first hurdle was trying to add a Windows 2008 R2 server (RD02) as a Session Host in the Remote Desktop Services area in Server Manager on our Windows 2012 RD Deployment server (RDCB01), which had the Connection Broker, Web Access and Session
    Host role services installed. After some side-tracking through AD issues, we eventually discovered that we had to manually add RD02 to the list of servers to manage in Server Manager on RDCB01. Then it was visible and could be selected.
    2. Now that we could, we tried to actually add the RD02 Windows 2008 R2 Session Host to the 2012 Deployment. This failed the previously unheard of compatibility tests with the error "Compatibility check failed" "The server is not running at least {0}". A
    list of requirements is shown:
    You will not be able to proceed with the installation unless ALL the following criteria are met:
    The server must be available by using Windows PowerShell remotely.
    The server must be running at least Windows Server 2012.
    The currently logged on user must be a member of the local Administrators group on the server.
    The server must not have a pending start.
    We were also concerned that we could not change many of the properties of Published Applications on our 2012 Publishing server. In our case changing an icon was critical for user acceptance to distinguish between application functions.
    It seems RDS is an all or nothing approach between 208 R2 and 2012 versions. The only thing we were able to get going in time was some limited Published Application capability.
    I agree with other posters in their assessments of wholesale changes to RDS in 2012, and a lack of readily available definitive information. 

    Hi,
    It seems that no official documents suggest that 2008 r2 could be involved with the 2012 rds infra.Even on the server 08 and 08r2,i don't suggest mixing them for potential incompatibility.
    Any further discussions about this issue are welcomed here for all of you.
    Regards,
    Clarence
    TechNet Subscriber Support
    If you are
    TechNet Subscription user and have any feedback on our support quality, please send your feedback
    here.
    Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

  • Outlook client in different subnet unable to connect to Exchange 2010 CAS using Windows 2008 R2 NLB multicast mode

    Hi all,
    need urgent assistance on the following issue
    this is my Exchange 2010 setup
    2 x CAS/Hub servers with HP network teaming, and load balanced using Windows NLB multicast mode. There are 2 VIPs on the NLB, one for outlook anywhere, one for autodiscover
    2 DNS records were created for the 2 VIPs
    Clients use Outlook Anywhere (HTTPS) to connect to the CAS servers from external segment via a Palo Alto firewall, which also acts as a layer 3 router
    static arp was set on the Palo Alto firewall, with both virtual MACs pointing to the primary virtual MAC used by the NLB. 
    Observations
    1. within same segment - no issue accessing Exchange servers, even when one CAS node is offline
    2. external segment (via firewall)
    a. when both nodes are up
    outlook client able to connect to Exchange CAS VIP on 443, but will disconnect after around 30 seconds. Client will retry and the pattern will repeat
    Exchange CAS RPC logs shows client connections and disconnections to the outlook anywhere VIP address
    Firewall logs shows allowed traffic from client to the VIPs
    unable to complete profile creation
    b. with only CAS2 (CAS1 stopped/deleted from NLB cluster)
    no issues accessing Exchange servers, creating profiles etc
    c. with only CAS1
    same behaviour as (a)
    reinstalled NLB, but doesn't resolve
    deleted CAS1 from NLB cluster, and re-add. issue remain
    Q1. is teaming supported? Teaming is currently set to automatic mode, instead of specified Fault Tolerant
    Q2. are there additional settings we need to set or verify on the Palo Alto firewall, since the issue only happen to external segment? Thanks!

    Yes - I've been scarred with this for many years :(
    If it is just CAS 1 that is causing issues, then focus in on that.  The support statement for Win 2008 R2 is that NLB is still a 3rd party component and support may ask for it to be disabled.
    http://support.microsoft.com/kb/278431 
    Does CAS1 and CAS2 have the same NICs (firmware as well), driver, teaming software, and teaming config? 
    I also want to ask what the network team did for configuring the switch ports on the servers?  This will vary from vendor to vendor  - did they do the same config on both?
    Cheers,
    Rhoderick
    Microsoft Senior Exchange PFE
    Blog:
    http://blogs.technet.com/rmilne 
    Twitter:   LinkedIn:
      Facebook:
      XING:
    Note: Posts are provided “AS IS” without warranty of any kind, either expressed or implied, including but not limited to the implied warranties of merchantability and/or fitness for a particular purpose.
    Thanks Rhoderick, issue still persists
    can you also help clarify what you meant by "configuring the switch ports on the servers"?
    thanks again

  • How to generate Serial numbers using JAVA SCRIPT

    how to generate serial numbers(incrementing by 1) using JAVA SCRIPT
    thanking you,
    pola pradeep

    i am afraid that whether ur looking for this. bcoz its a simple for loop
    <script language="JavaScript">
    //count = limit value for u
    for(i=0;i<count;++i){
         alert(i);
    </script>
    or if ur looking for something else, pls mention ur requrment precisely
    aleena

  • How To Select serial Numbers using SDK

    Hi Experts,
    I am trying to add an inventory transfer document which is managed serially using DI PI . I need functionality of auto serial number select for that item. As when we do this from front end the serial number selection window is opened an we choose serial number or select auto method . Same thing i need in my scenario using SDk.
    Thanks
    Amit

    i am afraid that whether ur looking for this. bcoz its a simple for loop
    <script language="JavaScript">
    //count = limit value for u
    for(i=0;i<count;++i){
         alert(i);
    </script>
    or if ur looking for something else, pls mention ur requrment precisely
    aleena

  • How can I create digital signatures for my users using Windows 2008 Active Directory Certificate Services?

    Hi,
    I need to create local digital signatures for my users. How can I do that using W2k8 Active Directory Certificate Services? We are gonna sign Office 2010 documents.
    What company offers cheap digital signatures solutions?
    Thanks in advanced

    Consider the following:
    if you use your local CA server to issue digital signature certificates, there is no cost, because you are eligible to issue so many certificates as you need. However, documents signed by these certificates will be considered trusted only within your AD
    forest and other machines that explicitly trust your local CA. Any external client will not trust your signatures.
    If you want to make your signature trusted outside your network (say, in worldwide), you need to pruchase a certificate from trusted commercial CA (VeriSign, GoDaddy, GlobalSign, StartCom, etc) according to respective vendor price list. In that case you
    don't need to have your local CA server, because it is not used. All certificate management is performed by the external CA. A most common scenario is to purchase signing certificate for particular departament principals (head managers) or few certificates
    for a whole company (all documents are revised by a responsible person or persons who holds signing certificate and sign them after review).
    so, it is not clear from your post what exactly you need.
    My weblog: http://en-us.sysadmins.lv
    PowerShell PKI Module: http://pspki.codeplex.com
    Windows PKI reference:
    on TechNet wiki

  • Accessing client using Windows 2008 Terminal Service - Web Access?

    Dear experts,
    We are developing a network infrastructure solution for our new customer's B1 8.8 implementation.
    Our customer would like to utilize Windows Server 2008 Terminal Service to connect B1 client in remote branch with server in head office area. And they want to use Terminal Service - WEB ACCESS. Base on our experience, we successfully implement B1 using Remote Desktop Connection or Citrix to support B1 client in the remote area.
    My question is, Has SAP already support to utilize windows "Terminal Service - Web Access" to access B1 client?
    If Yes then what are possible issues and solutions?
    Thanks,
    Indra

    Hi,
    when we said to customer that it is better to use citrix, they will see some concerns as follows:
    1. Investment to buy citrix server
    2. License of citrix
    3. installation time for ICA client
    4. maintenance cost for citrix and its server
    The benefits are as follows:
    1. Reduce cost to purchase B1 license. Remote and LAN users can access B1 through citrix
    2. The connection speed. Citrix is more faster than RDC or terminal services either web access or not
    3. The security reason. Check this link:
    http://www.virtualizationadmin.com/articles-tutorials/terminal-services/management-tools/terminal-services-internet-information-server.html
    In the support platform, there is no windows terminal services web access info. You may check it here:
    http://service.sap.com/smb/sbo/platforms
    The supported hosted environments are using citrix or windows terminal service. For remote users, the citrix is used for web access and windows terminal services are using IP and the connection is using internet (do not use VPN).
    The citrix is not very expensive. We must make them realize the benefit.
    Kita harus pastikan citrix itu bagus dan tidak mahal2 amat kok. Beli dari reseller citrix yang diauthorized  tetapi tidak big company agar tidak mahal sekali. SAP AG menyarankan menggunakan citrix karena memang sangat bagus.
    (in english : we must convince the customer about the citrixs benefit. it is not too expensive. The citrix could be buy from small reseller company so that its price is acceptable. SAP AG suggested to use citrix because it is very best web access).
    I know bhs because I am from Indonesia hehehe....
    JimM

  • Is it possible to use windows 2008 R2 for installing the groupware 5 32bit?

    I am not quite sure why there is no 64bit version and also why there is no version for crm 70
    Any help is appreciated.

    This is now supported from CRM 7.0, SP8. Please refer to note  1549802.
    Best regards,
    Brian.

  • How to deactivate serial numbers PEPE10

    I Restored my computer to its factory defaults. when reinstalling  PEPE10, Accidentally installed disc 1, I should have installed disc 2 for windows 7 x64bit.The uninstaller tells me to deactivate and remove serial numbers used when installing on my machine.  Question is how do I do that? Please help.
    Message was edited by: cease4tea 07/07/2014 1:05 AM mt

    Well to deactivate, you just need to launch Editor. Go to Help menu, and click on Deactivate button.
    Deactivation is for the purpose that you can use your license on 2 computers, and remove the license from the ones you don't use right now. So you should always deactivate you PEPE version before formatting your machine.

  • Error connecting to the SAP SRV on Windows 2008 Server platform

    Hi All
    We have a problem with one of our clients they bought a new sbs windows server 2008 and we loaded sql 2005 and sap b1 SP01 PL07.
    When we did the SBO install we experience connection issues and we created odbc connection on the server using named pipes and tcp/ip (used both server name and Ip address).
    We also configured the server in configuration manager and we managed to login and solved the slow system connection issue. We also created odbc connection on the client machines. (Machine are on a workgroup and users have administration access on all machines),we also installed native client on all machines.
    After the first batch of client installs we managed to have connection, they were other computers which were left out during the first client install and now the client want to do the remaining machines connected to SBO. On every machine that we install now we get the same error :-
    *Connection failed:
    SQLState:'08001'
    SQl Server error:10060
    [Microsoft][SQL Native Client] TCP Provider: A connection attempt failed because the connected party didnot properly repsond after a period of time, or established connection failed because connected host has failed to respond.
    Connectioin failed:
    SQLState:'HYT00'
    SQL Server Error:0
    [Microsoft][SQL Native Client]Login timeout expired
    Connection failed:
    SQLState:'08001'
    SQL Server Error: 10060
    [Microsoft][SQL Native client] An error has occurred while establishing a connection to the server. When connecting to the sql server 2005, this failure may be cause by the that*
    Please help as most user who need access can't login and they are the main users.
    rgds,
    Bongani Dlamini

    Hi Eric,
    yes we are using Windows 2008 SBS for the SAP EHP4 FOR SAP ERP 6.0/NW7.01 installation.
    we tried to create the key but it says access is denied.
    Actual thing is we got the server with Windows 2008 server 64 bit SBS (standard FE) with Domain Controller (DC) configuration.
    We have removed the DC using dcpromo to convert into Wokgroup and tried the SAP installation.
    I hope you got the idea and please let me know any further suggestions or it is the problem with the license.
    Thanks & Regards,
    Prabhu Reddy.

  • Windows 2008 Server Configuration - Help

    Hello All,
    I am not an expert in configuring servers and I have just started to learn. Please forgive me if I am doing something funny!
    I have a router with static IP address and DHCP enabled on the router. The router had the following configuration as shown below and the clients were obtaining IP address from the router and using the internet without a problem.
    Router Configutaion:
    Basic Setting:
    IP Address : 122.165.60.160 (My Wan Static IP)
    IP Subnet Mask : 255.255.252.0
    Gateway IP: 122.165.60.1
    DNS Address:
    Primary DNS : 203.145.184.32
    Secondary DNS: 203.145.184.13
    Lan TCP/IP Setup:
    IP Address: 192.168.2.1 (Router IP)
    IP Subnet Mask: 255.255.255.0
    DHCP Enabled:
    Statring IP : 192.168.2.11 
    Ending IP: 192.168.2.100
    Now, I have installed Windows 2008 R2 Server with Active Directory, DNS and DHCP, IIS. I have created a few users and did nothing more than that in the server.
    Server IP Settings
    Server IP: 192.168.2.5
    Subnet : 255.255.255.0
    Gateway : 192.168.2.1
    DNS: 127.0.0.1
    And when I tried to join the domain i created... corp.globe.com the clients were not able to find the domain I therefore changed the following settings in the router.
    DNS Address:
    Primary DNS : 203.145.184.32
    Secondary DNS: 192.168.2.5 (Server IP)
    After this change the clients were able to join the domain and login as well. However the clients were getting the IP from the router. I am facing a lot of problems as listed below.
    1. I am not able to ping the clients using the computer name from the server.
    2. Clients cannot ping other clients or server using name. (Suppose if I try... PING SYS1 .... It looks like it is trying to ping some 92.x.x.xx IP address) even if SYS1 IP address is 192.168.2.13
    3. Clients can access Internet, but I cannot browse anything in the server.
    Please help me in the configuration, or point me to some guide which describes the same. I tried to set up and enable the DHCP server using Windows 2008 machine and I disabled it DHCP on the router, clients where able to get the IP address from Windows 2008
    server, but they were not able to use internet. Please advise.
    Thanks for your time.

    Hi,
    And you cannot ping the clients using the computer name from the server?
    Did you turn off the firewall on server and client?
    If you are having problems connecting to Active Directory and you have already successfully verified network connectivity, there might be a name resolution problem. For more and detail information, please refer to:
    http://technet.microsoft.com/en-us/library/cc961921.aspx
    Regards.
    Vivian Wang

Maybe you are looking for