[x]
Posted via EE Mobile

Search, ask, and monitor your questions on the go with EE Mobile. Visit Experts Exchange from your mobile device and never be out of touch again.
Question
[x]
Attachment Details
[x]
The Solution Rating System

With so many solutions, how can you tell which solutions are most likely to help you and which ones are not? To provide you with a tool to use, we rate our solutions based on various elements that most accurately determine if a solution is a quality solution. To explain what factors affect the solution rating, here are the elements we take into consideration when formulating our solution rating.

  • The Grade of the Solution
  • The Zone Rank of the Expert Providing the Solution
  • The Number of Author and Expert Comments
  • The Number of Experts Contributing
  • The Feedback of the Community

Your Input Matters
Because of the way the system is set up, the most important variable in this equation is you. As a member of Experts Exchange, you are able to cast your vote on the quality of the solutions in regard to how complete, accurate, helpful and easy to understand each solution is. When you provide your feedback, each rating is adjusted accordingly. So, if you see a solution that has a poor rating that you think is a good solution, let us know by rating it. As you do, the rating will be adjusted and will become more accurate for other members of our site.

If you have any suggestions that you would like to make for our rating system, please ask a question in the Suggestions Zone of Community Support.

Thank you!
6.4

Microsoft Certificate Authority - "You have a private key that corresponds to this certificate." is missing on all certificates except one.

Asked by andrewjohnblackey in Windows Network Security, Miscellaneous Security, Active Directory

Tags: Microsoft CA, Microsoft Security, PKI, Domain Controllers, IAS

Microsoft Certificate Authority - "You have a private key that corresponds to this certificate." is missing on all certificates except one.

Hi,

I am trying to create a computer certificate to be installed on  IAS ( Microsoft  Internet Authentication Service ) server.

VPN client cannot connect using PEAP and I have been told that it may be because the certificates installed do not have a private key associated.

According to :


http://technet.microsoft.com/en-us/library/cc728239(WS.10).aspx

Certificates on the Authenticating Servers
For the computer certificates installed on the authenticating servers (either the VPN servers or the IAS servers), the following must be true:
"      They must be installed in the Local Computer certificate store.
"      They must have a corresponding private key.

And also according to :

http://technet.microsoft.com/ru-ru/library/cc755923(WS.10).aspx


To verify that the computer certificate for the IAS server meets all requirements
1.      From the Certificates console, double-click the certificate to open it.
2.      On the General tab, confirm that You have a private key that corresponds to this certificate appears.
3.      On the Details tab, under Field, click Enhanced Key Usage, and then confirm that there is an object identifier for Server Authentication (1.3.6.1.5.5.7.3.1).
4.      On the Details tab, under Field, click Subject Alternative Name, and then confirm that the fully qualified domain name (FQDN) of the computer account for the IAS server (for example, DNS Name=IASServerName.TestDomainName.com) appears.
5.      On the Certification Path tab, confirm that a valid certification path appears and that the statement This certificate is OK appears.


The only certificate that has this private key that corresponds to it is one that was issued by a stand-alone Microsoft certification authority in the DMZ on September 12.
Unfortunately, that certificate that has the private key also has an empty subject field and that makes it invisible for the IAS server Protected EAP Properties window.
Since I am a beginner with CAs I thought that I should install an Enterprise Root CA for making the certificate visible to the IAS server ( I did not realize that the missing subject field may be the cause).

So later I tried to  install  an Enterprise Root CA and none of the certificate issued by this new CAs have this "You have a private key that corresponds to this certificate." Message in the general tab of the certificates, regardless of the certificate template chosen.


Any help in understanding why all the certificates issued by this Enterprise Root CA are missing this private key would be appreciated.

Thank you.

[+][-]09/24/09 05:34 AM, ID: 25412551Accepted Solution

View this solution now by starting your 30-day free trial. Setting up your free trial is quick, easy, and secure. We will return you to this solution, unlocked, when you're done.

About this solution

Zones: Windows Network Security, Miscellaneous Security, Active Directory
Tags: Microsoft CA, Microsoft Security, PKI, Domain Controllers, IAS
Sign Up Now!
Solution Provided By: andrewjohnblackey
Participating Experts: 0
Solution Grade: A
 
[+][-]09/24/09 05:36 AM, ID: 25412574Author Comment

Often, when Experts are collaborating with members who have asked questions, they will request additional information about the problem. Askers respond with an author comment like this one.

Start your 30-day free trial to view this Author Comment or ask the Experts your question.

 
 
Loading Advertisement...
20091111-EE-VQP-89 - Hierarchy / EE_QW_3_20080625