Collaborate Disseminate
When you have more than 1 Client Authentication certificate in your user certificate store, Windows will prompt on (appropriately configured) wireless connection to allow you to select desired certificate to be used for connection.
In Wind… Continue reading Windows: select default certificate for Enterprise Wifi connection [migrated]
When creating CSR on Windows (using built-in certificate store), I found some weird behaviors:
When I use enrollment policy, but then extract CSR and sign it somewhere else, on import the certificate is not linked with the private key.
Wh… Continue reading How/when does Windows link private key to imported certificate?
Have a look here: https://letsencrypt.org/2018/08/06/trusted-by-all-major-root-programs.html
First paragraph says: "As of the end of July 2018, the Let’s Encrypt root, ISRG Root X1, is directly trusted by Microsoft products."
I h… Continue reading Where is ISRG Root X1 certificate on Windows 10?
It’s about Windows ADCS.
The problem: we want to get S/MIME certificates from external vendor, but the local law obligates us to keep encryption keys so we can decrypt any company data in case of any investigation.
We figured that we can c… Continue reading Re-use autoenrolment CSR to obtain another certificate
If I want to find the actual signing certificate for OCSP responder, how can I go about it? Is it possible to get it anywhere in .pem format?
Continue reading PKI: how to get OCSP Signing certificate information?
I have more and more cases (let’s say, 5-10 per day) in my organization (100k+ PCs) where people suddenly can’t connect to VPN, and the reason is because the private key of their certificate no longer exists. What’s interesting, when you o… Continue reading Investigate private key corruption in certificate store
I’m struggling to find relevant section in RFCs, and I hope someone here can help me.
How does – per specification – subCA revocation affect leaf certificates issued from this CA prior to revocation? I don’t only mean TLS certificate, but … Continue reading PKI: How does CA certificate revocation affect leaf certificates?
I’m trying to crack the following nut: I have a contract with Digicert for S/MIME certificates for my org. Digicert allows to use their API for cert issuance.
Unfortunately I can’t let users self-enroll, because I need to st… Continue reading Get S/MIME from Digicert, store in escrow on on-prem CA
Currently I’m using certreq to prepare CSRs for S/MIME certificates. I want to move away from it and start using OpenSSL for key/CSR generation.
My .inf file looks like this:
[Version]
Signature=”$Windows NT$”
[NewRequest]… Continue reading What should be OpenSSL .cnf file equivalent of certreq .inf for S/MIME?
I have a few hundred systems that are not AD-joined, for which I’d like to issue RDP certificates from an internal hierarchy (built with ADCS).
I can do it manually, by generating CSRs, then signing with ADCS CA, then install… Continue reading How to distribute RDP certificates from ADCS to non-domain members? [migrated]