Get more info about an IP address or domain name, such as organization, abuse contacts and geolocation.
One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.
COURSE of the MONTH
10 days, 22 hours left to enrollBecome a Premium Member and unlock a new, free course in leading technologies each month.
Solved
Internal CA - managing certificates
Posted on 2011-03-08
Hi all,
We have an Internal CA issuing certificates. However, there are some servers, such as Edge services and a few others that have expired certificates.
How can we manage this from the Internal CA? Is there a console or alerting system to be able to send out alerts of certificates expiring at any point?
Also, should servers that connect directly to the CA auto renew?
Thanks,
Mark
We have an Internal CA issuing certificates. However, there are some servers, such as Edge services and a few others that have expired certificates.
How can we manage this from the Internal CA? Is there a console or alerting system to be able to send out alerts of certificates expiring at any point?
Also, should servers that connect directly to the CA auto renew?
Thanks,
Mark
[X]
Welcome to Experts Exchange
Add your voice to the tech community where 5M+ people just like you are talking about what matters.
- Help others & share knowledge
- Earn cash & points
- Learn & ask questions
3-
2
5 Comments
You could find information for the CA to send email alerts here:
http://technet.microsoft.com/en-us/library/cc773129%28WS.10%29.aspx
But i think you cannot monitor the nearly expired certificates, unless you set reminders in your own Outlook for them. I've always proceed with this way, especially for DMZ servers such Edge or IIS which don't have access directly to the CA.
For auto renew, sure, you could auto renew for internal servers. It wouldn't be a security issue.
http://technet.microsoft.com/en-us/library/cc773129%28WS.10%29.aspx
But i think you cannot monitor the nearly expired certificates, unless you set reminders in your own Outlook for them. I've always proceed with this way, especially for DMZ servers such Edge or IIS which don't have access directly to the CA.
For auto renew, sure, you could auto renew for internal servers. It wouldn't be a security issue.
Active 2 days ago
How do certificates auto enroll anyway?
Is it an automated task via the HTTP page of the CA?
for example:
Exchange edge has an internal certificate on it.
It can get to http://internalca/certsrv
but not https://internalca/certsrv
Does auto renewal use the HTTP method or is it normally done differently?
The certificate was generated manually, so how does this fair in terms of auto renewing?
Sorry for all the questions!
Is it an automated task via the HTTP page of the CA?
for example:
Exchange edge has an internal certificate on it.
It can get to http://internalca/certsrv
but not https://internalca/certsrv
Does auto renewal use the HTTP method or is it normally done differently?
The certificate was generated manually, so how does this fair in terms of auto renewing?
Sorry for all the questions!
automatic enrollment usually rely on DCOM and RPC protocol.
you can renew certificate with http, but only manually (unless you use 2008R2 and Windows 7 clients: http://technet.microsoft.com/en-us/library/dd759245.aspx)
if you cannot access https, either you have a firewall blocking port 443 from your edge to the internal CA, either the web enrollment site hasn't been configured to use https.
i think in your case the certificate won't update automatically
there's information here about port used and renewal methods :
http://technet.microsoft.com/en-us/library/cc784758%28WS.10%29.aspx
http://technet.microsoft.com/en-us/library/cc738405%28WS.10%29.aspx
you can renew certificate with http, but only manually (unless you use 2008R2 and Windows 7 clients: http://technet.microsoft.com/en-us/library/dd759245.aspx)
if you cannot access https, either you have a firewall blocking port 443 from your edge to the internal CA, either the web enrollment site hasn't been configured to use https.
i think in your case the certificate won't update automatically
there's information here about port used and renewal methods :
http://technet.microsoft.com/en-us/library/cc784758%28WS.10%29.aspx
http://technet.microsoft.com/en-us/library/cc738405%28WS.10%29.aspx
Featured Post
Question has a verified solution.
If you are experiencing a similar issue, please ask a related question
New Windows 7 Installations take days for Windows-Updates to show up and install. This can easily be fixed. I have finally decided to write an article because this seems to get asked several times a day lately.
This Article and the Links apply to…
This article provides a convenient collection of links to Microsoft provided Security Patches for operating systems that have reached their End of Life support cycle. Included operating systems covered by this article are Windows XP, Windows Server…
- Ransomware
- Experts Exchange
- Windows XP
- Windows OS
- Windows Server 2008
- Windows Server 2003, Security
To efficiently enable the rotation of USB drives for backups, storage pools need to be created. This way no matter which USB drive is installed, the backups will successfully write without any administrative intervention.
Multiple USB devices need t…
This tutorial will walk an individual through setting the global and backup job media overwrite and protection periods in Backup Exec 2012.
Log onto the Backup Exec Central Administration Server. Examine the services. If all or most of them are stop…
Suggested Courses
Course of the Month10 days, 22 hours left to enroll
770 members asked questions and received personalized solutions in the past 7 days.
Join the community of 500,000 technology professionals and ask your questions.