Removal of old CA server stale data
Hi, I'm rebuilding some DC's and figured I'd tidy everything up before doing so as I've come into this with a messy environment. from this, I found an old Trusted Root CA, the certificate authority server was decommissioned in 2021 and all certificates have had an expiry date from 2021. its still being pushed out to domain devices such as servers and desktops. I tried running the 'certutil -dsdelca' command however this comes back with invalid command. I guess the best option is just to remove the class objects from the ADSI edit? as there is a class in AIA, CDP, Certification Authorities, KRA with the certificate name
Windows integrated CA - Certificates are not usable for any browser NET::ERR_CERT_INVALID
Hi all, a Windows integrated CA on Windows Server 2025. I have published web server certs on IIS (should be for Exchange on prem). Did this couple of times. But all Certificates released by this CA are not usable for any browser: NET::ERR_CERT_INVALID. Tried with different browser and different server. Cert is valid surely. root cert also in place. error detail: "normally uses encryption to protect your information. When Google Chrome tried to connect to localhost this time, the website sent back unusual and incorrect credentials. This may happen when an attacker is trying to pretend to be localhost, or a Wi-Fi sign-in screen has interrupted the connection. Your information is still secure because Google Chrome stopped the connection before any data was exchanged. You cannot visit localhost right now because the website sent scrambled credentials that Google Chrome cannot process. Network errors and attacks are usually temporary, so this page will probably work later." Any hints what is wrong? Thanks for hints Gernot
MS Word and Excel Mail Merge Certificates (advanced)
I need to run a mail merge (using Word and Excel) for certificates where per Course each student has a unique number of competencies they have achieved, example code attached. I cant manipulate or add data to the excel content with additional columns. I need one certificate per student each with their related competency achievement(s). Has anyone else found a solution without having to use an add in? Ive seen a template where the creator used the "next if" rule and the "if" condition is if the student ID is equal to, but i cant recreate it.
Same RSA certificate in local store and smart card
Hi, On Windows 10 I noticed this strange behavior with certificate management: an RSA certificate, and the relative private key, is locally stored in the machine. If the private key is copied and imported in a smart card, the certificate in the local store is overwritten and marked as "smart card certificate". When a certificate is locally available this is the selector: When I connect the smart card with the same certificate, the selector change: And now the local certificate became inaccesible, even if the smart card is disconnected. Is this behavior by desing? Preventing the private key from being locally accessible if it is present on smart card?
Differences with X509Certificate2 between Powershell and PWSH Core (Windows)
Hi all, I wrote some code that loads a certificate from a crt file and it works so far. But with PWSH (7.5.1) some properties (like DnsNameList) are empty. With Windows Powershell the properties are filled. This is true, even when using static LoadCertificateFromFile class under PWSH. (Otherwise I load the certificate with [ X509Certificate2]::new( thebytes )) The validity of the certificate makes no difference so far. It would be nice if anyone has a suggestion how I can work around that issue. THX in advance and best regards!PKIVIEW download error
We are deploying a 2-tier PKI with an offline Root CA and an Enterprise SubCA. After deploying the Root CA with CRL and AIA pointing to a web server http://crl.company.com we copied there the Root CA's Certificate and CRL. From the subordinate CA server we're able to open the publishing web site and load the crl and crt via Web browser. However when using PKIVIEW to check the setup we saw a "Download error" for both the Root and Subordinate CA. is there anyone that can help on this ? thanksIntune Certificate Connector and OID 1.3.6.1.4.1.311.25.2
Hi, Way back in May when update KB5014754 broke cert auth for so many orgs it was identified that whilst RPC auto-enrolled certificates will get the new required OID the Intune certificate connector can't do the same. As the timeline on the KB (https://support.microsoft.com/en-us/topic/kb5014754-certificate-based-authentication-changes-on-windows-domain-controllers-ad2c23b0-15d8-4340-a468-4d4f3b188f16) states that enforcement will happen from updates released on February 14th 2023 is there any indication that a fix will be deployed for the intune certificate connector ahead of that time? We have many customers using intune enrolled certificates to authenticate for AOVPN, WiFi and more which will stop working once this change is enforced. February doesn't seem like a long time away when a solution likely means needing to get the connectors updated and other possible changes.
