Removal of old CA server stale data
Hi, I'm rebuilding some DC's and figured I'd tidy everything up before doing so as I've come into this with a messy environment. from this, I found an old Trusted Root CA, the certificate authority server was decommissioned in 2021 and all certificates have had an expiry date from 2021. its still being pushed out to domain devices such as servers and desktops. I tried running the 'certutil -dsdelca' command however this comes back with invalid command. I guess the best option is just to remove the class objects from the ADSI edit? as there is a class in AIA, CDP, Certification Authorities, KRA with the certificate name
Windows integrated CA - Certificates are not usable for any browser NET::ERR_CERT_INVALID
Hi all, a Windows integrated CA on Windows Server 2025. I have published web server certs on IIS (should be for Exchange on prem). Did this couple of times. But all Certificates released by this CA are not usable for any browser: NET::ERR_CERT_INVALID. Tried with different browser and different server. Cert is valid surely. root cert also in place. error detail: "normally uses encryption to protect your information. When Google Chrome tried to connect to localhost this time, the website sent back unusual and incorrect credentials. This may happen when an attacker is trying to pretend to be localhost, or a Wi-Fi sign-in screen has interrupted the connection. Your information is still secure because Google Chrome stopped the connection before any data was exchanged. You cannot visit localhost right now because the website sent scrambled credentials that Google Chrome cannot process. Network errors and attacks are usually temporary, so this page will probably work later." Any hints what is wrong? Thanks for hints Gernot
PKIVIEW download error
We are deploying a 2-tier PKI with an offline Root CA and an Enterprise SubCA. After deploying the Root CA with CRL and AIA pointing to a web server http://crl.company.com we copied there the Root CA's Certificate and CRL. From the subordinate CA server we're able to open the publishing web site and load the crl and crt via Web browser. However when using PKIVIEW to check the setup we saw a "Download error" for both the Root and Subordinate CA. is there anyone that can help on this ? thanks
User Certificate Template by Group Policy
I'm looking for a way to specify a certificate template to be autoenrolled for a set of users. What we did so far is : - defined a new user specific template. - defined the template security for the specific AD group the users belongs to with read,enroll,autoenroll. - defined a GPO to enable the autoenroll for the specific group. However the autoenroll, at login, does not work and a pop up notification appear saying that the user has to complete the enrollment. If the autoenroll is made manually it works, the template is shown and works fine
Server 2019 no "Server Hello" when using TLS_RSA_WITH_AES_ ciphers (TLS1.2) schannel 36874
Hi Hoping someone might have come across something similar as the support forum entries are filled with irrelevant responses and tumbleweed. A recently migrated CA cluster is not sending any TLS conversation completion when the client uses a cipher from the TLS_RSA_WITH_AES_* type (so TLS_RSA_WITH_AES_128_CBC_SHA256 or similar). This also seems to be negatively impacting RPC certificate enrolment from Windows 7 systems. Using Nartac tools and manually (double, triple, quadruple) checking the registry settings myself I can see that the ciphers are present in the list of supported/available ciphers. I can see that TLS1.2 is working. As soon as a client offers TLS_ECDH_* the server responds like an enthusiastic puppy. using TLS_RSA_WITH_AES_ it ignores the traffic (no server hello or attempt to negotiate) and logs Schannel Errors 36874 in the server event log. I have verified this using wireshark on client and server. Whilst these are hosted in azure there shouldn't be any network layer kit interfering with the connection. There is a standard load balancer which single routes all traffic to the active AD CS cluster node. No inspection or TLS termination should be occurring. There are no GPOs controlling anything to do with TLS or communication security (checked with gpresult and gpmc, along with repeated verification of the registry settings) has anyone seen anything like this before? yes I have been through the enabling TLS 1.2 articles a bajillion times and know where to enable TLS 1.2 for both schannel and .net In need of more straws to clutch at.
RDS broker certificate warning
I am establishing a multiserver RDS setup. All users are domain users, but most clients are non-domain Windows and Macs, so I have a public 3rd party SAN certificate. It is not a .local domain. The SAN certificate Subject: desktop.mydomain.com SAN: rdsgateway.mydomain.com (gateway and web access server) rdsbroker.mydomain.com (broker) rds1.mydomain.com (desktop host) rds2.mydomain.com (desktop host) rds3.mydomain.com (desktop host) I have attached the SAN certificate to all roles in the deployment properties, and they all have a level of Trusted and status OK. Still, when i open the desktop collection rdp file in RDweb, i am prompted to accept the certificate for rdsbroker.mydomain.com. It is the correct certificate (desktop.mydomain.com) but it does not seem to accept the alternate name rdsbroker.mydomain.com.
2008 Certificate CA Server - Upgrade, Toss, Azure?
We have an Old Windows 2008 R2 VM that has a CA installed on it. It has been giving out <domain>\<Machine>$ and <domain>\<User> Certs. Nothing else on the Machine. I've never been a Fan of Upgrading Servers vs Fresh installs. There are no Certs on here besides the ones that it gave to the PCs and Users. No Special Templates or anything. I May have used it for an Exchange Server, though have a Wildcard Cert for that now. What is best to replace this CA. Do I need to replace it? Thanks!