Certification Authority cannot use certificate template

Certification Authority cannot use certificate template

Secure Home | Search | About
 Microsoft Applications Security    Post an article   get this group's latest topics as an RSS feed add this group's latest topics to your My MSN content add this group's latest topics to your My Yahoo content add this group's latest topics to your Google content
Subject Author Date
Certification Authority cannot use certificate template Carma Trepp 06-12-2007
Posted by Martin Rublik on June 14, 2007, 2:58 am
If you were  Registered and logged in, you could reply and use other advanced thread options
Hi,

perhaps you could use certreq utility to submit the request to CA in this way:

On CA run

certreq -submit -attrib "CertificateTemplate:WebServer" <request_file> e.g.

certreq -submit -attrib "CertificateTemplate:WebServer" request.p10

Regards

Martin


Carma Trepp wrote:
> "Brian Komar" wrote:
>
>> For a Web server certificate, have you tried using the Web Server
>> certificate request wizard in IIS Manager. This will allow you to populate
>> the subject information, make the request based on the right template, and
>> submit the request to the CA>
>>
>> Also, at the CA, ensure that the Web server certificate template is
>> available at the CA.
>> Since you are running standard edition, you cannot do any certificate
>> template customization (only enterprise edition supports the issuance of v2
>> certificate templates). But, Web Server is a v1 template
>>
>> Brian
>>
>
>
> The Webserver Template is also available on the CA.
> But was a good idea with the IIS wizard. I try now a Workaround to use the
> Wizard to create the Certificate for the linux Webserver.
>
> I m go in holiday this evening, and cant read this tread futher.
> Thanks for the help.

Posted by =?Utf-8?B?Q2FybWEgVHJlcHA=?= on June 14, 2007, 8:59 am
If you were  Registered and logged in, you could reply and use other advanced thread options
"Martin Rublik" wrote:

> Hi,
>
> perhaps you could use certreq utility to submit the request to CA in this way:
>
> On CA run
>
> certreq -submit -attrib "CertificateTemplate:WebServer" <request_file> e.g.
>
> certreq -submit -attrib "CertificateTemplate:WebServer" request.p10
>
> Regards
>
> Martin
>

Thanks! Its works well. But I dont get the privat key.

Posted by Martin Rublik on June 14, 2007, 9:45 am
If you were  Registered and logged in, you could reply and use other advanced thread options
Hi,

My response will be simplified and hopefully suited for your environment.

Private key is not part of the standard PKCS#10 request, either it is not part
of a certificate.

If you are not archiving key for recovery purposes there is no need for CA to
posses end user's private key in any form.

The only output that CA gives after signing a certificate is certificate itself.

After the certificate is issued you have to "install" it onto your web server or
other device such as SSL accelerator or ISA server or other.

The private key is generated prior to the request. The most probable place to
start looking for your private key is on the device that was used to generate a
request.

I would need more information about your environment, the process how you
generate a request and software you use.

Regards

Martin

Carma Trepp wrote:
> "Martin Rublik" wrote:
>
>> Hi,
>>
>> perhaps you could use certreq utility to submit the request to CA in this way:
>>
>> On CA run
>>
>> certreq -submit -attrib "CertificateTemplate:WebServer" <request_file> e.g.
>>
>> certreq -submit -attrib "CertificateTemplate:WebServer" request.p10
>>
>> Regards
>>
>> Martin
>>
>
> Thanks! Its works well. But I dont get the privat key.

Posted by Brian Komar on June 14, 2007, 3:28 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
On Wed, 13 Jun 2007 23:25:00 -0700, Carma Trepp wrote:

> "Brian Komar" wrote:
>
>> For a Web server certificate, have you tried using the Web Server
>> certificate request wizard in IIS Manager. This will allow you to populate
>> the subject information, make the request based on the right template, and
>> submit the request to the CA>
>>
>> Also, at the CA, ensure that the Web server certificate template is
>> available at the CA.
>> Since you are running standard edition, you cannot do any certificate
>> template customization (only enterprise edition supports the issuance of v2
>> certificate templates). But, Web Server is a v1 template
>>
>> Brian
>>
>
>
> The Webserver Template is also available on the CA.
> But was a good idea with the IIS wizard. I try now a Workaround to use the
> Wizard to create the Certificate for the linux Webserver.
>
> I m go in holiday this evening, and cant read this tread futher.
> Thanks for the help.

You have now provided the missing information.
If you are using a Linux Web Server, you need to generate the request at
the Linux Web server, then submit that request through the Certsrv Web
pages (indicating the Web Server certificate template on the page).

Depending on the Web Server, you will probably use OpenSSL to generate the
request and private/public key pair.
After the certificate is issued, you will need to link the certificate back
to the private key.
See the Linux MAN files for details
Brian

Posted by =?Utf-8?B?Q2FybWEgVHJlcHA=?= on June 15, 2007, 4:45 am
If you were  Registered and logged in, you could reply and use other advanced thread options
Thank you for your answers. I will verificate that after my holidays.

Similar ThreadsPosted
Which certification authority to use July 18, 2005, 4:02 pm
Getting rid of my Certification Authority April 25, 2008, 3:56 pm
Microsoft Certification Authority May 17, 2006, 1:03 pm
The certification authority denied the request. October 11, 2005, 3:08 am
How to clean AD from enterprise certification authority July 10, 2006, 4:53 pm
Certification Authority 0x8009480f error April 25, 2008, 9:15 am
Certification Authority remote calls problem February 10, 2006, 11:41 am
what type of certificate authority? June 16, 2005, 4:08 pm
Certificate Authority type June 16, 2005, 6:01 pm
Problem with certificate authority January 27, 2006, 9:03 am

The site map in XML format XML site map

Contact Us | Privacy Policy