Quantcast
Channel: Security forum
Viewing all articles
Browse latest Browse all 12072

Import a CA-certificate into issuing Enterprise CA error

$
0
0

Hello,
I am deploying two-tier hierarchy (Root CA - Standalone Root, Issuing CA - Enterprise CA on Active Directory).

Root CA CAPolicy.inf
[Version]
Signature= "$Windows NT$"
[certsrv_server]
RenewalKeyLength=4096
RenewalValidityPeriodUnits=20
RenewalValidityPeriod=years
CRLPeriod=weeks
CRLPeriodUnits=26
CRLOverlapPeriod=weeks
CRLOverlapUnits=2
CRLDeltaPeriodUnits=0
CRLDeltaPeriod=days

Sub CA CAPolicy.inf
[Version]
Signature = "$Windows NT$"
[PolicyStatementExtension]
Policies = SomeCompany
Critical = FALSE
[SomeCompany]
Notice=SomeCompany Certification Practice Statement
URL = http://cert.companydomain/pki/policies
OID = 2.5.29.32.0 ; All Issuance Policy
[certsrv_server]
RenewalKeyLength = 4096
RenewalValidityPeriodUnits = 5
RenewalValidityPeriod = years
CRLPeriodUnits = 1
CRLPeriod = weeks
CRLOverlapUnits = 1
CRLOverlapPeriod = days
CRLDeltaPeriodUnits = 12
CRLDeltaPeriod = hours

Root CA Config Script
certutil -setreg CA\DSConfigDN CN=Configuration,DC=<domain>

certutil -setreg CA\CRLPublicationURLs "65:%WINDIR%\system32\CertSrv\CertEnroll\%3%8%9.crl\n2:http://cert.companydomain/pki/<name>%8.crl"
certutil -setreg CA\CACertPublicationURLs "1:%WINDIR%\system32\CertSrv\CertEnroll\%1_%3%4.crt\n2:http://cert.companydomain/pki/<name>%%4.crt\n32:http://cert.companydomain/ocsp"

certutil -setreg CA\ValidityPeriodUnits 20
certutil -setreg CA\ValidityPeriod "Years"
certutil -setreg CA\CRLPeriodUnits 26
certutil -setreg CA\CRLPeriod "Weeks"
certutil -setreg CA\CRLDeltaPeriodUnits 0
certutil -setreg CA\CRLDeltaPeriod "Days"
certutil -setreg CA\CRLOverlapUnits 2
certutil -setreg CA\CRLOverlapPeriod "Weeks"

certutil -setreg CA\AuditFilter 127

certutil -v -setreg policy\editflags +EDITF_ENABLEOCSPREVNOCHECK

net stop certsvc & net start certsvc

certutil –CRL

I then copied the root CA certificate and CRL to Issuing CA and using the following commands
certutil –addstore –f Root rootca.crt
certutil –addstore –f Root rootca.crl
certutil -dspublish -f rootca.crt RootCA
certutil -dspublish -f rootca.crl RootCA

All steps to deploying looks fine but if we trying to install CA certificate on Issuing CA  *.p7b (early successfully issued and exported on Root CA) when appears error:
"The new Certification Authority certificate cannot be installed because the CA Version extension is incorrect.The most recently generated request file should be used to obtain the new certificate:
C:\****-CA(1).req The data is invalid. 0x8007000d (WIN32: 13 ERROR_INVALID_DATA)"
and application error event 27:
"Active Directory Certificate Services did not start: Hierarchical setup is incomplete.  Use the request file in C:\***-CA.req.req to obtain a certificate for this Certificate Server, and use the Certification Authority administration tool to install the new certificate and complete the installation."

Part of request file:
.........
Request Attributes: 2
  2 attributes:

  Attribute[0]: 1.3.6.1.4.1.311.13.2.3 (OS Version)
    Value[0][0], Length = d
        6.3.9600.2.

  Attribute[1]: 1.2.840.113549.1.9.14 (Certificate Extensions)
    Value[1][0], Length = 129
    Unknown Attribute type
Certificate Extensions: 6
    1.3.6.1.4.1.311.21.1: Flags = 0, Length = 3
    CA Version
        V0.0

    2.5.29.14: Flags = 0, Length = 16
    Subject Key Identifier
        7e 17 22 b1 40 7c 24 f3 4b 8f d1 f5 5f 04 d0 23 43 f5 c1 cd

    2.5.29.32: Flags = 0, Length = b0
    Certificate Policies
        [1]Certificate Policy:
             Policy Identifier=All issuance policies
             [1,1]Policy Qualifier Info:
                  Policy Qualifier Id=User Notice
                  Qualifier:
                       Notice Text=SomeCompany Certification Practice Statement
             [1,2]Policy Qualifier Info:
                  Policy Qualifier Id=CPS
                  Qualifier:
                      http://cert.companydomain/pki/policies

    1.3.6.1.4.1.311.20.2: Flags = 0, Length = c
    Certificate Template Name (Certificate Type)
        SubCA

    2.5.29.15: Flags = 0, Length = 4
    Key Usage
        Digital Signature, Certificate Signing, Off-line CRL Signing, CRL Signing (86)

    2.5.29.19: Flags = 1(Critical), Length = 5
    Basic Constraints
        Subject Type=CA
        Path Length Constraint=None
...............

If I trying to start Certification Authority service on Issuing CA appears error: "The certificate for the CA "Company Sub CA" on domainhostname is missing. Do you want to install this certificate?" and when after selecting the certificate appears error with incorrect CA version.

So, if anyone can help me to resolve the problem I would be very grateful.
Many thanks in advance. Have a nice day)


Viewing all articles
Browse latest Browse all 12072

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>