Trusted root certification authority.

Hello,
I notice with every server and client machine in our organisation, that some how 2 root certificates (purpose: All) are getting added automatically.
These root certificates are already expired and not related to our current enterprise CA server.
I checked RSOP.html on client machine and or GPO's on DC, but could not figure out the source.
Any help greatly appreciated.
Thanks.

Hi,
You are welcome.
You may enable CAPI2 log to monitor certificate store operations, which is under Applications and Services Logs\Microsoft\Windows\CAPI.
After you enable CAPI2 log, delete those 2 root certificates, wait to see whether they will be added again. If they do, check CAPI2 log to find detailed information.
More information for you:
Enable CAPI2 event logging to troubleshoot PKI and SSL Certificate Issues
http://blogs.msdn.com/b/benjaminperkins/archive/2013/10/01/enable-capi2-event-logging-to-troubleshoot-pki-and-ssl-certificate-issues.aspx
Best Regards,
Amy
Please remember to mark the replies as answers if they help and un-mark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact [email protected]

Similar Messages

Dspublish -f or GPO for trusted root certification?

Hi,
I've currently configured a GPO and applied it to several of my main OUs using "\Computer Configuration\Windows Settings\Security Settings\Public Key Policies\Trusted Root Certification Authorities" with the root CA cert.
I believe I can get my domain clients to accept the root CA by using dspublish instead (which may be better as my domain has a lot of blocked inheritance OUs). I can run the commands below to achieve this:
certutil -f -dspublish <Root CA Cert.cer> RootCA
certutil -f -dspublish <Root CA CRL.crl> SubCA
What I'm not sure about is why I would want one method over the other? If I was to use both (as I've already applied a GPO), could it cause any issues?

with the GPO method, you can make the CA trusted granularly for specific sets of computers depending on their OU location. You may also enforce the GPO which will pass even through the blocked GPO inheritance.
You can apply GPOs to either domain level, or to any lower OU level. If you operate only a single domain, this is enough.
You cannot apply GPOs to the whole forest, although you could apply GPOs to AD sites. But this might not be always so easy due to some firewall constraints.
When you publish the certificates into AD, you publish them into Configuration partion. This is forest wide partition, so the certificates will be trusted on all computers from the whole forest automatically.
Also, if you want to make an ISSUING CA to be trusted as NTAuth certification authority, the only option is to do it through AD. I do not thing there is a way how to achieve NTAuth with GPO, although I might be mistaken - you could probably make do
with Preferences - Registry, but I didn't try it myself yet.
NTAuth issuing CAs are those, which can issue DC certificates and user logon certificates (smart card logon OID, client authentication OID). Note that NTAuth trust is meant for ISSUING CAs and not for ROOT CAs so if you are concerned only about root CA here,
do not bother with the NTAuth thing.
ondrej.

Why do other browsers ( IE, Chrome, Opera,Safari) list StartCom Class 2 Primary Intermediate Server CA as a Trusted Intermediate Certification Authority but Firefox doesn't?

We are setting up registrations for a paid event and have bought a SSL certificate for our site. Everything works fine when the registration page is accessed through IE, Chrome, Opera or Safari (which list StartCom Class 2 Primary Intermediate Server CA as a Trusted Intermediate Certification Authority), but when I click on that link in Firefix I get the "This Connection is Untrusted" page because only StartCom Class 1 is listed as trusted.
Why is that?

It is always the responsibility of a website to send the complete certificate chain.
You can check the certificate chain of breastfeedingconference.asn.au and see that the server doesn't send the intermediate certificate.
* http://www.networking4all.com/en/support/tools/site+check/

Install Trusted Root Certification certificate using ZCM

Trying to figure out how to install into Trusted Root Certification Authorities a certificate for a local server. We have several that we created local certificates and want to prevent the users from geting the error message or having to do the steps to import.
Has anyone accomplished this? Its very possible I am just way over thinking it, so feel free to wack me in the head if so...
Matt

Use Microsofts CertMgr.exe from a bundle.
On 1/20/2014 4:56 PM, medust wrote:
>
> Trying to figure out how to install into Trusted Root Certification
> Authorities a certificate for a local server. We have several that we
> created local certificates and want to prevent the users from geting the
> error message or having to do the steps to import.
>
> Has anyone accomplished this? Its very possible I am just way over
> thinking it, so feel free to wack me in the head if so...
>
>
> Matt
>
>

Windows 2012 root certification authority in a 2003 Domain/ Forest level

Hello,
We are currently on Windows 2003 Domain & Forest Functional Level. Our Root CA is also currently on Windows 2003 DC.
If we have to setup a new Root/Issuing CA ( not exporting the current 2003 CA cert) on Windows 2012 R2 servers, is it then mandatory to first upgrade Domain & Forest levels to 2012 R2 ? Can we have a PKI infrastructure with
Enterprise CA's on a Windows 2012 Platform but the Domain/Forest levels still on 2003 level ? i understand it will be good to have everything on 2012 R2 , but can a mix of 2003 domain level and 2012 CA work ?

Hi,
Look at below tread it might help:
https://social.technet.microsoft.com/Forums/windowsserver/en-US/fa8cac92-0f71-426c-ac95-e89e90e1c8d1/certificate-authority-and-forestdomain-functional-level?forum=winserversecurity
Basically the answer is yes you can have CA on 2012 R2 and DFL/FFL still on 2003.
Regards,
Calin

No "Allow users to select new root certification authorities (CAs) to trust" option in GPO

Hello,
We have a Windows 2008 R2 standard server, which is the domain controller
I copied a policy and wanted to clear unneeded properties in that newly copied policy. There are few properties below "Computer Configuration\Policies\Windows Settings\Security Settings\Public Key Policies/Trusted Root Certification Authorities"
that are shown in Group Policy Object Settings, but not in GP Editor! Maybe it is a property coming from our old 2003 domain controller, as I saw in a technet page that those properties were available in 2003 active directory policies.
How can I remove those properties from the policy?
Thanks, Dominic

Hi Dominic,
Based on your description, we can check the scenario 1 and scenario 2 described in the following hotfix, and we can install the hotfix if one of these two scenarios
represents our situation.
The "Trusted Root Certification Authorities" setting cannot be removed from a GPO in Windows 7 or Windows Server 2008 R2
http://support.microsoft.com/kb/2842986/en-us
Hope it helps.
Best regards,
Frank Shen

A question about the "Third-Party Root Certification Authorities" X509 store

Hello All
Can someone please help me with the following question.
Reading some MS documentation I see MS have a program called 'Microsoft Root Certification Program" where by if a third party ACME for example create a Root CA and it passes this program then MS will add the CA Cert to Windows Update for downloading
to the clients "Third-Party Root Certification Authorities" X509 store, correct so far?
if so when a client is building a certificate chain for a cert I understand it first checks its local store for relevant certificates (e.g. Trusted Root Certification Authorities etc..) then if not their checks the AIA extension so locate the cert.
Question does the client (e.g. clients using CAPI/CAPI2) also check the "Third-Party Root Certification Authorities" X509 store or do the Certs in this logical store also reside (get copied to) the "Third-Party Root Certification
Authorities" X509 store. In other words are these store names in the GUI just logical partitions for human viewing but actually reside in the same location in the registry and therefore checked by the client
Thanks All
AAnotherUser__
AAnotherUser__

> does the client (e.g. clients using CAPI/CAPI2) also check the "Third-Party Root Certification Authorities" X509 store or do the Certs in this logical store also reside (get copied to) the "Third-Party Root Certification Authorities"
X509 store
yes. Trusted Root CAs container is an aggregated container for all trusted root CAs (for natively trusted CAs and for Root Certification Program members).
Vadims Podāns, aka PowerShell CryptoGuy
My weblog: en-us.sysadmins.lv
PowerShell PKI Module: pspki.codeplex.com
PowerShell Cmdlet Help Editor pscmdlethelpeditor.codeplex.com
Check out new: SSL Certificate Verifier
Check out new:
PowerShell File Checksum Integrity Verifier tool.

Having 2 Certificate Authority Trust Root Certificates

I have two domains that share a one way trust. Domain A has the CA server. The CA server certificate expires in 2015 so I went ahead and renewed. Now when I go into the properties of the CA, it lists under the General tab, Certificate #0 which expires
in 2015 and Certificate #1 which expires in 2019.
On Domain B, I can not get out the the CA's site to install the Trusted Root CA so I have to download them manually from a server in Domain A and then copy them to the server in Domain B.
On Domain B server, I noticed I can now get to the CA's site when I import Certificate #0 which expires in 2015 and my SCOM agent can now communicate to Domain A. But if I only import Certificate #1, I still can not get out to the CA's site and my SCOM agent
still can not communicate to Domain A.
Why does Certificate #0 work and not #1?

Both agent and MS need to trust the same CA.
Jonathan Almquist | SCOMskills, LLC (http://scomskills.com)

Windows Root Certificate authority questions.

hello,
I have 2 questions with regards to Offline ROOT CA in a 2 TIER Hierarchy :
(1) Is it necessary to to ” map the Namespace of Active Directory to an Offline CA’s Registry Configuration” ? I didn’t do this step in my lab env and find this in some but
but not all the online posts as well. what happens if we don't run this command on offline CA ?
For instance: certutil.exe –setreg ca\DSConfigDN CN=Configuration,DC=lab,DC=com
(2) What happens if i do not publish the ROOT CA certificate via "certutil -dspublish -f xxx.cer ROOTCA " command but instead just push the root certificate using Default Domain Group Policy Object to "Trusted Root Auth" store
on all the domain machines ? What are the pros/cons of using the certutil method vs the GPO method ?
Thanks
Neeraj

> Is it necessary to to ” map the Namespace of Active Directory to an Offline CA’s Registry Configuration” ?
it is necessary only if you configure LDAP URLs for CRL Dsitribution Points and Authority Information Access extensions on Root CA (not recommended).
> What are the pros/cons of using the certutil method vs the GPO method ?
different scopes. When publishing in Active Directory, it is downloaded to all
*forest* members, while GPO covers only limited scope (domain, site or OU).
Vadims Podāns, aka PowerShell CryptoGuy
My weblog: en-us.sysadmins.lv
PowerShell PKI Module: pspki.codeplex.com
PowerShell Cmdlet Help Editor pscmdlethelpeditor.codeplex.com
Check out new: SSL Certificate Verifier
Check out new:
PowerShell File Checksum Integrity Verifier tool.

Usefullness of Certification Authority Web Enrollment?

If a deployment has Certificate Enrollment Web Service and
Certificate Enrollment Policy Web Service installed is there still a need for
Certification Authority Web Enrollment? This Windows Server 2012 CA design has an offline root CA, two Enterprise Subordinate CAs in a cluster, and two web servers hosting AIA/CDP/OCSP/CES and CEP behind a load balancer. There is
also a standalone NDES server.
Thanks

Starting with Windows Server 2008, web enrollment become useless as it allows only user certificates, therefore you should avoid web enrollment installation whenever it is possible. As for CEP/CES, there is a dependency that only Windows 7+ supports it.
My weblog: http://en-us.sysadmins.lv
PowerShell PKI Module: http://pspki.codeplex.com
Check out new:
PowerShell FCIV tool.

What is the certification authority, the third party that can confirm the digital signature?

I created a nice electronic signature, that I now regularly use and add to every document. I was told that a signature needs to be issued by a verification authority, a third party that is able to verify the signature, certificate. I created a free certificate at CAcert.org and tried to combine it with the adobe signature certificate file, but it doesnt support .cer and .crt files. Is the Adobe the certification authority in this case since i created signature in the Adobe software? Its not a big deal, I just want everything to be correct since I use the signature in official documents now (instead of scanning a signed document) ... Thanks for any info, ideas or help.
Jacob

Each Digital Certificate has a pair of private and public keys used for encryption/decryption. The private key belongs to the certificate owner and should be kept secret. It is protected by a password. The public key can be used by anyone. Digital certificates come in two flavors: one that contains both private and public key and one that contains only public key.
When you create a digital signature the signing process uses the private key to encrypt the signed content digest and the public key is used to decrypt it. So, only you can encrypt signed content with your certificate that has both private and private keys and anyone can decrypt it to validate the signature using certificate that has only public key. Usually, this certificate with the public key only is embedded in the digital signature, so that anyone can use it for decryption.
The .cer certificate contains only public key. Certificates with both private and public keys usually have extensions .pfx or .p12. You need one of those to sign.
CAcert.org issues only public key certificates. so you cannot use its certificates for digital signing.
Adobe is not a general purpose certification authority. It issues some certificates for internal use only.
Acrobat has a feature that allows you to create so-called self-signed certificates with both private and public keys but these certificates can be used only in a limited way. They do not provide the means to authenticate the real certificate owner nor revoke a certificate if it is stolen.
Generally, a digital signature asserts three main features:
1. Document integrity (document has not been changes since it had been signed),
2. Authentication (the signer is indeed what the certificate says)
3. Non-repudiation (the signature author cannot deny that he signed it: this is achieved via certificate revocation mechanism).
A self-signed certificate (of the type that Acrobat produces) can be used only for #1. It cannot be used for ##2 and 3. The latter two come only when a certificate (with private key) is issued by a reputable Certificate Authority which is trusted (like VeriSign, Symantec, etc.).

Certification Authority Web Enrollment Install Error

Hello
We have moved our certification authority from "Windows Server 2008" to "Windows Server 2008 R2" according this blog entry:
http://www.scottfeltmann.com/index.php/2010/03/02/move-root-ca-from-w2k3-to-w2k8/
It works perfectly. After that we wanted to install "Certificate Authority Web Enrollment" in Server Manager, but the following error appears:
"Cannot install Certification Authority Web Enrollment, Active Directory Certificate Services setup failed with the following error: The parameter is incorrect. 0x80070057 (WIN32: 87)"
Thanks for any help!
Regards
netbit

Hello Marcin
Thanks for your answer. The CA is now on a single server without any roles installed.
There are no events in the eventvwr for this error or anything else.
Just for clarification: If i try to select "Certificate Authority Web Enrollment" in the servermanager the error appears:
Screenshot: http://giezi.com/public/servermanager-error.PNG
Thanks!
Regards
Reto

What value/text to be entered in the trusted point- certification chain space

What value/text to be entered in the trusted point- certification chain space

Yes the certificate is signed by the root CA.
I have two certificates in the certificate chain which was downloaded from the CA.
I have pasted both the certificate in the trusted point and the certificate sections and unable to access UCSM ...invalid certificate error.
The value entered in trusted point and certitificate tabs are same?

Issue generating a subordinate certificate - The certification authority's certificate contains invalid data

Other recipients:
Hi Guys, I have a root CA and a sub CA. I want to generate another Sub CA certificate from my current sub CA however when I try to do so either via web or csr file I get the below error: The certification authority's certificate contains
invalid da
<input role="presentation" style="width:1px;height:1px;opacity:0;" tabindex="-1" type="text" />
Hi Guys,
I have a root CA and a sub CA both windows 2008 R2 ent. I want to generate another Sub CA certificate from my current sub CA however when I try to do so either via web or csr file I get the below error:
The certification authority's certificate contains invalid data. 0x80094005 (-2146877435). Denied by policy module.
I have confirmed that the basic constraint attribute for my current subca is none so I should be able to generate a certificate for a new subca.
Any assistance is greatly appreciated.
Thanks.

Hi,
According to your description, you want to build a new CA which is under an existing sub CA (one of your two working sub CAs) to issue certificates to other devices, am I right?
Based on my research, to achieve this, we need to install another
Subordinate Certification Authority. During the installation process, this new sub CA will generate a certificate request to its parent CA.
“The subordinate CA cannot be used until it has been issued a root CA certificate and this certificate has been used to complete the installation of the subordinate CA”, I quoted this
sentence from the article I posted in my last reply.
Therefore, in your case, the process flow should be like:
Install a new sub CA.
Generate a certificate request to its parent CA during installation.
The parent CA approves this request.
Installation of the subordinate CA has completed.
The new sub CA issues new certificates to other devices.
Please feel free to let me know if this method is not working.
Best Regards,
Amy Wang

Using Hyper-V 2012 r2, connecting to the console results in: A certification authority could not be contacted for authentication.

I'm having some trouble with authentication to guests from my Hyper-V console.
If I try to connect from the Hyper-V Manager to the console of any guest, I get the error:
"A certification authority could not be contacted for authentication. If you are using a Remote Desktop Gateway with a smart card, try connecting to the remote computer using a password. For assistance, contact your system administrator or technical support."
I'm not using an RDG and smart card.
I have 2 virtual networks. The first is Production, the second is Isolated. Production has 2 NICs attached to the Production LAN, the second has 2 NICs in our DMZ. The host is a member server of the production domain. I can use MSTSC from the LAN or the DMZ
to gain access to each Guest and the Host.
The issues start if I try "Connect" from Hyper-V Manager in an attempt to use the console of any Guest. Each attempt fails with the above error. If I use an incorrect password, I get a different error: "The credentials that were used to connect
to {Server FQDN} did not work. Please enter new credentials."
Taking a look at the the event logs, I can see the session successfully authenticating to the Guest (4776 Credential validation and 4624 Logon), and the fact I get a different error if I enter an incorrect password show I get some way along the line. However
if I take a look at the logs on the Host, however I get:
An account failed to log on.
   Subject:
       Security ID:       NULL SID
       Account Name:       -
       Account Domain:       -
       Logon ID:       0x0
   Logon Type:           3
   Account For Which Logon Failed:
       Security ID:       NULL SID
       Account Name:
       Account Domain:
   Failure Information:
       Failure Reason:       An Error occured during Logon.
       Status:           0xC000006D
       Sub Status:       0xC000005E
   Process Information:
       Caller Process ID:   0x0
       Caller Process Name:   -
   Network Information:
       Workstation Name:   -
       Source Network Address:   -
       Source Port:       -
   Detailed Authentication Information:
       Logon Process:       Kerberos
       Authentication Package:   Kerberos
       Transited Services:   -
       Package Name (NTLM only):   -
       Key Length:       0
   This event is generated when a logon request fails. It is generated on the computer where access was attempted.
   The Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.
   The Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).
   The Process Information fields indicate which account and process on the system requested the logon.
   The Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.
   The authentication information fields provide detailed information about this specific logon request.
       - Transited services indicate which intermediate services have participated in this logon request.
       - Package name indicates which sub-protocol was used among the NTLM protocols.
       - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Which looks to me like a blank authentication request is being sent? (I've not deleted any machine/domain names, they're just not present)
Any suggestions? Do you think I'm barking up the wrong tree?
Thoughts and comments gratefully received

Hi,
What’s your guest system platform, base on my experience that must be the not supported guest system issue, the generation 2 vm only support the Windows 8 or 8.1 platform.
The related KB:
Generation 2 Virtual Machine Overview
http://technet.microsoft.com/en-us/library/dn282285.aspx
Hope this hleps.
We
are trying to better understand customer views on social support experience, so your participation in this
interview project would be greatly appreciated if you have time.
Thanks for helping make community forums a great place.

Trusted root certification authority.

Similar Messages

Maybe you are looking for