Quantcast
Channel: Security forum
Viewing all articles
Browse latest Browse all 12072

Renew Subordinate CA (Core) Certificate

$
0
0

I'm Back! :) Again.

I have  feeling it's going to be Mark Cooper who answers this one.

I've been fighting with a PKI project for about a month now and it's been extremely painful for ONE major factor; CORE!

I love optimizing but in this case it has been really, really painful. Such as this bug which I've seen reported online for a long time. (Thanks Mark)

Then I had to fix a mistake I made in my Offline-Root-CA which showed a wrong CDP location in my PKI from the issued Sub-CA.

I'm actually currently working on fixing this issue and the reason for this post.

1) I first tried to simply take the existing CSR, and re-issue it, no issues on the re-issue (lol). However attempting to install the new issued cert on the Sub CA resulted in the following:

CertUtil: -installcert command FAILED: 0x8007139f (WIN32: 5023 ERROR_INVALID_STATE)
CertUtil: The group or resource is not in the correct state to perform the requested operation.

At this point I had assumed it was due to the service being up and running, So from a remote mgmt machine via the CA snap-in MMC tool, shutdown the services, as well as from the Sub-CA ran "CertUtil -Shutdown"

*SIDE QUESTION* What exactly does "CertUtil -shutdown" do? Does it simply stop the cert services on the local machine, or all AD Cert services? How do you revert this command? I couldn't find a CertUtil -Start or any equivalent command.

Having failed here due to my ignorance, I decided to google in hopes of a solution. Sadly the best I could find was this.

First thing to note is Yet more bugs in the CA Snap-in Tool remotely, on top of the "Install CA Cert" literally not doing anything, once you install the cert via "CertUtil -installCert" The SubCA services come up fine up, but will be missing context menus, in this case "Renew CA Certificate".

So I decided to try the other suggested workaround "CertUtil RenewCert ReuseKeys", However they would receive an error as follows:

   CertUtil: -renewCert command FAILED: 0x80070003 (WIN32: 3)
   CertUtil: The system cannot find the path specified.

I however get the following error:

   CertUtil: -renewCert command FAILED: 0x80092004 (-2146885628 Crypt_E_NOT_FOUND)
   CertUtil: Cannot find object or property.

I'm a bit stumped right now... How do I accomplish this task?


Viewing all articles
Browse latest Browse all 12072

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>