Third Party Certificate, 802.1X and Intermediate Certificate

Hi Guys,
Quick question:
Have 802.1x setup with Windows Radius Server - Installed a Godaddy certificate which came with an intermediate root certificate.
I would like clients to validate the certificate to connect to the 802.1x, -
Question: Do i need to rollout the intermediate root certificate to all windows devices - laptops to validate the godaddy certificate thats presented to the wireless clients? The trusted root on the intermediate root certificate is already installed on windows
desktops.
THanks

Hi,
1. When you deploy 802.1X authenticated wired access that uses smart cards or other digital certificates for client authentication, you must deploy a private CA on your network
by using AD CS.
2. Purchasing certificates from a public CA, such as VeriSign, that is already trusted by Windows-based clients. This option is typically recommended for smaller networks.
Advantages:
Installing purchased certificates does not require as much specialized knowledge as deploying a private CA on your network, and can be easier to deploy in networks that have
only a few NPS servers.
Using purchased certificates can prevent specific security vulnerabilities that can exist if the proper precautions are not taken when deploying a private CA on your network.
Disadvantages:
This solution does not scale as well as deploying a private CA on your network. Because you must purchase a certificate for each NPS server, your deployment costs increase
with each NPS server you deploy.
Purchased certificates have recurring costs, because you must renew certificates prior to their expiration date.
The related KB：
PEAP-MS-CHAP v2-based Authenticated Wireless Access Design
http://technet.microsoft.com/zh-cn/library/dd348500(v=ws.10).aspx
EAP-TLS-based Authenticated Wired Access Design
http://technet.microsoft.com/zh-cn/library/dd378869(v=ws.10).aspx
Hope this helps.
We
are trying to better understand customer views on social support experience, so your participation in this
interview project would be greatly appreciated if you have time.
Thanks for helping make community forums a great place.

Similar Messages

Generate CSR for Third-Party Certificates

Hi All,
i have an issue when i tried to Generate CSR for Third-Party Certificates,
i follow step by step in the document of cisco until this step:
3.
Now that your CSR is ready, copy and paste the CSR information into any CA enrollment tool.
In order to copy and paste the information into the enrollment form, open the file in a text editor that
does not add extra characters. Cisco recommends that you use Microsoft Notepad or UNIX vi. Refer
to the website of the third−party CA for more information on how to submit the CSR through the
enrollment tool.
After you submit the CSR to the third−party CA, the third−party CA digitally signs the certificate and
sends back the signed certificate via e−mail.
4.
Copy the signed certificate information that you receive back from the CA into a file.
This example names the file CA.pem.
my issue is where i sould copy and paste the CSR information into any CA enrollment tool. i just have done create mykey.pem and myreq.pem in my folder OpenSSL\bin
Please help and Thanks you.
Regards,
Jasa

you have to do more steps using openssl.
before you obtain the third−part certificate, you have to copy that on a notepad text, and you have to obtain an intermediate and root certificate from the company that gives you the certificate.
Then you have to copy and paste on a notepad or gedit:
SSL (the certificate that they give you)
Intermediate (the certificate that you obtain from the company that gives you the certificate)
Root (the certificate that you obtain from the company that gives you the certificate)
name the text file like: allcerts.pem
then... you have to run this commands:
C:\OpenSSL\bin>openssl pkcs12 -export -in allcerts.pem -inkey mykey.pem -out All-certs.p12 -clcerts -passin pass:yourpassword -passout pass:yourpassowrd
C:\OpenSSL\bin>openssl pkcs12 -in All-certs.p12 -out finalcert.pem -passin pass:yourpassword -passout pass:yourpassword
Then you are going to have a file named: finalcert.pem, thats the one you have to update to the WLC. please note that on those lines "yourpassword" is the password you use when you create the certificate and its going to be the same that you have to use for upload to WLC.
Note that you have to use openssl version 0.9.8 because its the only version thats WLC support
If you have doubts please contact me.
Have fun!

Install third party certificate on MAC os X

Hello,
I have installed leport 10.5.X on my machine. I am new bie for MAc and want to install intermediate certificate for my domain from Digicert. I have registered from Digicsert. Please help me to how can I install on the machine. I also need to create a new certificate but when I tried to add it shows an error message like this.
"There are no valid root or intermediate certificate authorities available to sigh certificates. Use the "create certificate Authority" option to create a certificate authority."
Can anybody please help me to what should be the next step.
And how can I install third party certificate.
Thanks in advance.

There is a product called VolumeWorks that is supposed to do this. I looked at the demo, but I could not get it to see the extra space so I ended up backing it all up and erasing the Raid and doing a block copy with Carbon Copy Cloner.

Third party Certificate not showing up in SQL configuration manager drop down box

Hi,
I have an SQL instance that needs to use a third party SSL certificate for all communications to that SQL instance. I have installed my third party certificate via MMC and it is showing under the Personal Folder.
However, when i go into the SQL configuration manager and right click the instance name > Properties > Certificates, it is not showing in the drop down box.
I am currently using MS SQL Server 2008 R2, which is installed on Windows Server 2012.

Hi,
If the certificate cannot be used for SQL Server and hence will not be visible in SQL Configuration manager. Check the validity of the installed certificate. It may not has the correct DNS name.
I suggest you request a new third party certificate from the vendor with the correct DNS name. Install it on SQL Server environment, then you should see certificate form the configuration manager dropdown box.
Thanks.
Tracy Cai
TechNet Community Support

Error While importing third party certificate

Hi,
In my application I'm using HTTPS for secure connectivity.For that purpose I signed my midlet using a third Party certificate (GoDaddy's Certificate).But when I'm hitiing the url it is not working.
I've done this with generating my own certificate with Tomcat.It is working fine there.I followed the following topic to create Certificate for TomCat
http://143.129.203.3/s/sitter/sl2nap/javaSSLprogr.htm
but when i'm hitiing some live url then it is not working!
Please provide me proper help if possible
Thanx in advance

Slawrence,
It appears that in the past few days you have not received a response to your
posting. That concerns us, and has triggered this automated reply.
Has your problem been resolved? If not, you might try one of the following options:
- Do a search of our knowledgebase at http://support.novell.com/search/kb_index.jsp
- Check all of the other support tools and options available at
http://support.novell.com.
- You could also try posting your message again. Make sure it is posted in the
correct newsgroup. (http://support.novell.com/forums)
Be sure to read the forum FAQ about what to expect in the way of responses:
http://support.novell.com/forums/faq_general.html
If this is a reply to a duplicate posting, please ignore and accept our apologies
and rest assured we will issue a stern reprimand to our posting bot.
Good luck!
Your Novell Product Support Forums Team
http://support.novell.com/forums/

SSL with third party certificate

Hi All,
I followed the configuration mentioned in the white paper
Oracle Forms Services 10g: Configuring Transport Layer Security with SSL An Oracle White Paper July 2005 (frm10gss.pdf). That is working fine.
I have a third party certificate (file format - .der, I got .cer from that).
With this certificate i need to configure the Application Server 10g. For this certificate i didn't created certificate request and sent to the third party.
In the steps motioned in the frm10gss.pdf where i have to make changes to include the third party certificate and not to consider the default oracle OCA certificate. Or with that Certificate how can i configure the SSL.
Any suggestions please…

Hi All,
I followed the configuration mentioned in the white paper
Oracle Forms Services 10g: Configuring Transport Layer Security with SSL An Oracle White Paper July 2005 (frm10gss.pdf). That is working fine.
I have a third party certificate (file format - .der, I got .cer from that).
With this certificate i need to configure the Application Server 10g. For this certificate i didn't created certificate request and sent to the third party.
In the steps motioned in the frm10gss.pdf where i have to make changes to include the third party certificate and not to consider the default oracle OCA certificate. Or with that Certificate how can i configure the SSL.
Any suggestions please…

Replace Self-Signed FAST Search Certificate with Third Party Certificate

We are trying to replace the Self-Signed FAST Search Certificate with Third Party Certificate in our SP 2010 environment. And are facing issues while enabling the SSL communication between the FAST servers and the corporate servers.
Our FAST search servers are in a different farm than that of the Corporate Servers.
The details of the certificate we received is as follows:
Issued to : FastSearchCert
Issued By: Issuer Name
Valid From: 4/21/2015 to 4/20/2017
We were able to successfully renew the certificate on the FAST Search Server by following the below steps:
1. Login to the Administrative and the Non-Administrative nodes
of the FAST server. Go to Windows Service and stop the FAST Search for SharePoint and the FAST Search for SharePoint Monitoring services in both the servers.
Follow the below steps in the Administrative Node followed by the Non-Administrative Node
2.
Install the certificate in the following paths in the certificate store:
“Certificates(Local Computer)\Personal”
“Certificates(Local Computer)\Trusted Root Certification Authorities”
3. Ensure that the user account configured for the “FAST Search Server 2010 for SharePoint” has access to the private key of the certificate.
4. Go the Administrative node of the FAST farm and follow the below steps:
Go to the certificate store.
Expand the Personal folder and then click the Certificates folder. Double-click the third party signed FAST certificate.
Open the Details tab and then click Thumbprint. Note down this thumbprint.
5. Next, open
Microsoft FAST Search Server 2010 for SharePoint with Administrator
Privileges.
6.
Navigate to the directory, “D:\FASTSearch\installer\scripts” and execute the below command to replace the current certificate with the newly created
third party signed FAST certificate.
.\ReplaceDefaultCertificate.ps1 -thumbprint "certificate thumbprint".
7. The FAST certificate was renewed successfully.
Once the certificate has been renewed successfully in both the nodes, follow the below step:
8. Start the FASTSearch for SharePoint and the FAST Search
for SharePoint Monitoring services in the administrator server.
Next, while enabling the SSL communication between the FAST servers and the other corporate servers, we follow the below steps:
1.
Copy the new certificate from any of the FAST servers to all the web-front end and application servers in the corporate farm, in order to enable SSL communication between these servers and the FAST farm.
2. Also, copy the script
‘SecureFASTSearchConnector.ps1’ from the location “%FASTSearchFolder%\installer\scripts” in the FAST servers
to the web-front end and application servers of the corporate farm.
3. Follow the below steps on each of the servers in the corporate farm:
Open ‘SharePoint 2010 Management Shell’ with administrator privileges and navigate to the directory in which
SecureFASTSearchConnector.ps1’ script is located.
And then, execute the below command:
.\SecureFASTSearchConnector.ps1 -certThumbprint "certificate thumbprint" –ssaName “FASTCibtebtSSA” –username “DOMAIN\SP_Farm”
Where,
-certThumbprint
- Thumbprint of the certificate
-ssaName – FAST Content SSA
-username – The account configured to run the SharePoint
Search Service
On execution of the above command, we receive an error message stating that the "Connection to the Content Distributor servername.corp.abc.org: 14391 could not be validated...instance of FAST search server backend is running"
Please help us resolve this issue. We have not been able to find the cause of the above error for a long time.
Any help is much appreciated.

Your tip on exporting from eDir to locate a missing private key was very helpful. Here are my steps to renew an expired third party certificate when the private key, generated 30 months ago in my case, could not be located.
In iManager, browse the tree and locate the likely certificate object. The Attributes for the object show Subject Name = webmail.acme.com. Selected the certificate and exported to webmailcert.pfx.
Then, the openssl commands in TID 7004039, "How to convert a SSL PFX to a PEM file", were run against the .pfx file to create cert.pem, key.pem and server.key files.
TID 7015500, "How to determine if private key belongs to public key (certificate)", was followed to determine if the public key (downloaded from third party) and private key (just retrieved from iManager) match - they did - that is, the private key converted from webmailcert.pfx matches the downloaded certificate.
TID 7013103, "How to create a .pem File for SSL certificate Installations", was followed to manually create a server.pem file using openssl.
TID 7010584, "How to setup SSL Certificate for Apache", part labeled "Additional Information" was followed to modify /etc/apache2/vhosts.d/vhost-ssl.conf file. Server.pem file created above copied to /etc/apache2/ssl.crt/ and /etc/ssl/servercerts/ directories as specified in vhost-ssl.conf.
Restarted apache2.
www.digicert.com has an SSL Certificate Checker that can be used to verify the installation is successful.

How do i use Third Party certificates when setting up Lync 2013

Hi,
I'm currently installing a trial of Lync 2013 for my company and it has got to the stage of adding in certificates. My company have no wish to add in a Certificate Authority unless its vital, they have asked if its possible to use a third party certificate
provider. I have no idea how to go about this and would appreciate any help on where to get a certificates from as well as how to import these into Lync.
Many thanks
John

Yes it is possible. Thankfully Lync makes it very easy. When you deploy Lync one of the steps in the Lync Deployment Tool is to Request and Assign Certificates.
It's a wizard that will create the CSR for you and basically include all the required names.
You will however need UCC certificates for most things (that support multiple Subject Alternate Names) so it may get a little expensive.
The CA you choose is really up to you, but GoDaddy do some pretty reasonably priced UCC certificates. Digicert is also another commonly used CA
If this helped you please click "Vote As Helpful" if it answered your question please click "Mark As Answer" | Blog
www.lynced.com.au | Twitter
@imlynced

Try to implement SSL for OMS console - Third Party Certificate

Using 10.2.0.5.0 of Grid control. 11.1.0.7.0 DB
Internet Explorer (or any browser)
enter
https://hostname.com:1159/em/
gets
There is a problem with this website's security certificate.
The security certificate presented by this website was not issued by a trusted certificate authority.
Security certificate problems may indicate an attempt to fool you or intercept any data you send to the server.
We recommend that you close this webpage and do not continue to this website.
Click here to close this webpage.
Continue to this website (not recommended).
I have tried to follow instructions in Method 2
http://download.oracle.com/docs/cd/B16240_01/doc/em.102/e10954/security2.htm
emctl secure oms -trust_certs_loc <loc of trusted_certs.txt>
completes without error
I have a third party certificate from GEOTRUST. I have downloaded the Root CA certificate from GEOTRUST and placed them both in a file called trusted_certs.txt
I have also imported both certificates in Oracle Wallet Manager. I can see the details within OWM and they are correct.
I followed instructions in metalink How to provide HTTPS browser access to the Grid Control Console using a third party certificate? [ID 736103.1]
When I view the certificate from IE after 'opmnctl startall', the cert is from grid control not GEOTRUST.
It seems like the 'emctl secure oms ...' overwrites the wallet in $OMS_HOME/sysman/wallets/oms_hostname
SSL is a part of Oracle's Best Practices for Grid Control but has anyone gotten it to work?
Thanks in advance.

These Certifications Authorities are supposed to work out of the box:
Class 1 Public Primary Certification Authority by VeriSign, Inc.
■ Class 2 Public Primary Certification Authority by VeriSign, Inc.
■ Class 3 Public Primary Certification Authority by VeriSign, Inc.
■ Secure Server Certification Authority by RSA Data Security, Inc.
■ GTE CyberTrust Root by GTE Corporation
■ GTE CyberTrust Global Root by GTE CyberTrust Solutions, Inc.
■ Entrust.net Secure Server Certification Authority by Entrust.net ((c) 1999
■ Entrust.net Limited, www.entrust.net/CPS incorp. by ref. (limits liab.))
■ Entrust.net Certification Authority (2048) by Entrust.net ((c) 1999
■ Entrust.net Limited, www.entrust.net/CPS_2048 incorp. by ref. (limits liab.))
■ Entrust.net Secure Server Certification Authority by Entrust.net ((c) 2000
■ Entrust.net Limited, www.entrust.net/SSL_CPS incorp. by ref. (limits liab.))
Has anyone used these with OEM?
Verisign is $600 year - ouch
Entrust is $200

CDN Third party certificate

When will CDN on azure support SSL for custom domain. Its almost so long we are discussing and facing a huge impact on our sales and support queries. Our entire application sits on azure. We need a solution ASAP. It has been a long wait.

hi,
Thanks for posting!
As far as I know, It may be not supported that you use the Third party certificate to custom CDN domain. You could vote this feature request on this link (http://feedback.windowsazure.com/forums/169397-cdn/suggestions/1332683-access-to-cdn-over-ssl-https
). Also, I will report this issue.
Thanks.
Regards,
Will
We are trying to better understand customer views on social support experience, so your participation in this interview project would be greatly appreciated if you have time. Thanks for helping make community forums a great place.
Click
HERE to participate the survey.

WLC526 third party certificate?

Hi!
Is it possible to install a third party certificate on the WLC526 Controller?
Would be great for Web Authentication for my Guest Wlan!
Thankx
David

Hi,
If the certificate cannot be used for SQL Server and hence will not be visible in SQL Configuration manager. Check the validity of the installed certificate. It may not has the correct DNS name.
I suggest you request a new third party certificate from the vendor with the correct DNS name. Install it on SQL Server environment, then you should see certificate form the configuration manager dropdown box.
Thanks.
Tracy Cai
TechNet Community Support

After upgrading to Mavericks on my MacBook, I'm not able to download third party applications like Dropbox and MyCleanMac 2. After clicking the download button, the screen just turns dark and is frozen. Any idea what is happening?

After upgrading to Mavericks on my MacBook, I'm not able to download third party applications like Dropbox and MyCleanMac 2. After clicking the download button, the screen just turns dark and is frozen. Any idea what is happening?

Launch the Console application in any of the following ways:
☞ Enter the first few letters of its name into a Spotlight search. Select it in the results (it should be at the top.)
☞ In the Finder, select Go ▹ Utilities from the menu bar, or press the key combination shift-command-U. The application is in the folder that opens.
☞ Open LaunchPad. Click Utilities, then Console in the icon grid.
Make sure the title of the Console window is All Messages. If it isn't, select All Messages from the SYSTEM LOG QUERIES menu on the left. If you don't see that menu, select
View ▹ Show Log List
from the menu bar.
Click the Clear Display icon in the toolbar. Then try the action that you're having trouble with again. Select any messages that appear in the Console window. Copy them to the Clipboard by pressing the key combination command-C. Paste into a reply to this message (command-V).
When posting a log extract, be selective. In most cases, a few dozen lines are more than enough.
Please do not indiscriminately dump thousands of lines from the log into this discussion.
Important: Some private information, such as your name, may appear in the log. Anonymize before posting.

I bought a macbook air and iMac from third party with preinstalled ilife and iworks

I bought a macbook air and iMac from third party with preinstalled ilife and iworks, can I update to the latest ilife and iworks without being charged even though i did not purchase ilife and iworks on my preowned Macs. I have no CD's or license for those products?
thanks

No, you will not be able to do that.

Are there any good third party or otherwise apps and/or plugins for imovie'11?

Are there any good third party or otherwise apps and/or plugins for imovie'11?

Re: Plugins for iMovie 11
Someone just asked this question yesterday. So I am cutting and pasting the answer From Bengt Warleby
Hi
You can not.
Nor to iMovie'08 or 09 or 11 - They do not accept any Plug-ins.
How about FinalCut Pro X - I don't know but i regard to Apple way of progress - I doubt
For iMovie up to HD6 and FinalCut Express and FinalCut Pro up to 7.0 - there are plenty.
Yours Bengt W

Iphone and third party vendors like Bose and ihome

Do the third party vendors like Bose and iHome plan to make adapters so the iphone can be used in those systems?

Bose and iHome already work with iPhone. I have used both plenty of times. It helps to have airplane mode on so that there is no interference from data but they work fine now.

Third party certificate and mobility express 526

Hi!
I want to get rid of the certificate warning for my guest users using webauthentication. With my 2100 controller i have the option to upload a trusted certificate but can´t find anything on this controller.
Is it even possible on this controller?

Hello,
Kindly note that mobility express 526 controller have limted features and does not support 3rd party certificate.
you can refer to this link for supported features on this model.
http://www.cisco.com/en/US/docs/wireless/controller/526/1.5/configuration/guide/A3_feature_list.html
Hope this answers your question.
Best regards
Talal
===
Don't forget to rate answers that you find useful

Third Party Certificate, 802.1X and Intermediate Certificate

Similar Messages

Maybe you are looking for