Quantcast
Channel: Security forum
Viewing all articles
Browse latest Browse all 12072

AD CS red X under Enterprise PKI, reinstalled OS still shows

$
0
0

So I have a fresh install of 08R2 joined to the domain and I went to install AD CS for the first time. I haven't really messed with AD CS before.  I created an Enterprise Root CA on this server called CA1.  By the way these are all VMs.  I then had another fresh install of 08R2 joined to the domain called CA2 that I installed AD CS on as well but this time I choose Enterprise Subordinate CA.  I had things working it seemed but I noticed that the root CA was giving out Certs to client computers and I just wanted those to come from the subordinate as I thought would happen and I also read it's best practice to issue from the Subordinate CA.  I found a bit more information online about how it's best practice to have, In my case, CA1 be a Standalone Root CA and then have CA2 be an enterprise subordinate. 

Here is where I messed up.  So I wanted to change everything. I figured well I would need to revoke the certs so I browsed to Issued Certificates, highlighted them all and chose revoke.  Then I right clicked, chose all tasks and stopped the service.  I then uninstalled the AD CS roll on both servers since I just wanted to start over from scratch and I also wanted to change the common name for this CA anyways which was domain-ca1-ca.  I reinstalled the rolls and found out I had a red X on the Enterprise PKI all the way down the tree.  I thought crap so I figured well maybe if I reinstall the OS that would clear it.  So I did that and created the same server name, joined it to the domain and tried again but I still have a red X under Enterprise PKI with the old common CA name which was domain-ca1-ca and I wanted to change the name of it to domainCA and have CA2 be called DomainIssuingCA.  Of course If I try to manage the CA it says the specified service does not exist as an installed service 0x424 (win32: 1060) and Just clicking on it says CA Offline. 

How do I go about fixing this?  Am I correct for best practices in that I should have AD CS with two servers, CA1 being the Standalone Root CA and CA2 being an Enterprise Subordinate CA?

Thanks.


Viewing all articles
Browse latest Browse all 12072

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>