?
Solved

CA Server Issue - CAS Crashed/RADIUS Errors

Posted on 2012-03-11
3
Medium Priority
?
651 Views
Last Modified: 2012-03-13
Hi Guys

I've run into a bit of an issue, my CA server crashed (No backup!)  a while back and I thought there wouldn't be any issues, but a few days back the certificate on the PDC expired and now any user trying to connect to the wireless is unable too, due to the RADIUS. It seems that because the certificate expired the RADIUS server has stopped working.

Any idea what the best solution is to get the wireless working again?
Setting up another CA?
Setting up a self signed certificate (using IIS) for the RADIUS?
If I do not setup another CA will there be any further consequences? All servers have been popping up auto enrollment certificate errors.

Any feedback will be great. Thanks!
0
Comment
Question by:YOlanie_Visser
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 2
3 Comments
 
LVL 26

Accepted Solution

by:
Leon Fester earned 2000 total points
ID: 37706922
It's hard to rebuild a CA, especially if you didn't back it up properly.
A self signed cert does not offer the same solutions as a CA would and you'd probably get some issues because the CRL cannot be completed.

I'd suggest deleting the OLD CA information, and then rebuild your CA and you can then reissues your certs the "normal" way.

This is what you needed to do before the CA fell over.
http://blogs.technet.com/b/pki/archive/2010/04/20/disaster-recovery-procedures-for-the-active-directory-certificate-services-adcs.aspx

These are the instructions you're looking for:
Basically, remove broken CA.
Install new CA.
Re-issue certs, your Servers should automatically enroll once the CA is present, so possibly only your RADIUS server may need a manual re-issue.

You should start with removing the decommissioned CA from your domain.
http://support.microsoft.com/kb/889250

Have a read about CA's and decide if you still don't need it.
http://www.kurtdillard.com/StudyGuides/70-640/6.html

How to install a CA
http://technet.microsoft.com/en-us/library/aa998956(v=exchg.65).aspx
0
 

Author Comment

by:YOlanie_Visser
ID: 37714191
dvt_localboy

I'm in the process of doing the cleanup, any idea how I will work around the RADIUS issue? Could I use a self signed cert just for the RADIUS? That would be the only reason why I would setup another CA,,,
0
 
LVL 26

Expert Comment

by:Leon Fester
ID: 37714633
No a self signed certificate in the Radius server won't help you.
The simple reason: the Certificate Authority for that self signed certificate will not be found.

You also need to remember that the basis of PKI is that there is always an Authority that can verify a the validity of a certificate. Have a look at a valid certificate and check out the Certificate Path....it's needed for establishing if your Certificate is valid.
http://technet.microsoft.com/en-us/library/cc731853.aspx

Reasons for installing a CA
http://technet.microsoft.com/en-us/library/cc776679(v=ws.10).aspx

Additional reading that may interest you:
http://social.technet.microsoft.com/wiki/contents/articles/987.windows-pki-documentation-reference-and-library.aspx
http://technet.microsoft.com/en-us/library/cc772670(v=ws.10).aspx
http://www.trainsignal.com/blog/active-directory-certificate-services
0

Featured Post

Get real performance insights from real users

Key features:
- Total Pages Views and Load times
- Top Pages Viewed and Load Times
- Real Time Site Page Build Performance
- Users’ Browser and Platform Performance
- Geographic User Breakdown
- And more

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Scenerio: You have a server running Server 2003 and have applied a retail pack of Terminal Server Licenses.  You want to change servers or your server has crashed and you need to reapply the Terminal Server Licenses. When you enter the 16-digit lic…
While rebooting windows server 2003 server , it's showing "active directory rebuilding indices please wait" at startup. It took a little while for this process to complete and once we logged on not all the services were started so another reboot is …
Visualize your data even better in Access queries. Given a date and a value, this lesson shows how to compare that value with the previous value, calculate the difference, and display a circle if the value is the same, an up triangle if it increased…
In this video, Percona Solution Engineer Dimitri Vanoverbeke discusses why you want to use at least three nodes in a database cluster. To discuss how Percona Consulting can help with your design and architecture needs for your database and infras…
Suggested Courses

777 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question