SSL connection to Active Directory - Standalone Certificate Authority

From: Hayim S. Hendeles (hayim.hendeles@ca.com)
Date: 05/31/02 

From: hayim.hendeles@ca.com (Hayim S. Hendeles)
Date: 31 May 2002 12:47:28 -0700

Although Microsoft does an excellent job documenting
how to setup Active Directory with SSL (see Q247078) ---
this documentation is only useful for sites with an
Enterprise Certificate Authority. Unfortunately, in
the real world, installations are loath to use an
Enterprise authority, and must use a Standalone Authority.

Question: How do I setup SSL on my Active Dir. machine
with a standalone certficate authority?

The documented procedure (to get a certificate)
http://localhost/CertSrv, while it can be
used to generate a certificate, does not allow the
ability to generate a certificate suitable for domain
controllers (e.g. as documented in Q291010).

I assume if I could get such a certificate, then it would
be a simple matter of installing that certificate
SOMEPLACE, and then informing the client machine that the
signing Certificate Authority is to be trusted. (Where is
that SOMEPLACE?)

Thank you in advance for any help.
Hayim S. Hendeles

Relevant Pages

  • Re: How to tell if Certificate Authority is root, stand-alone or?
    ... I'm using Microsoft 2003 with Certificate Services (Authority). ... Is there any way in which I can tell if this is installed as an Enterprise ... the certificiate is a root ...
    (microsoft.public.windows.server.security)
  • Re: X.509 and ssh
    ... by the 60s you were starting to see business countermeasure to this scenario in the offline market, where business checks had a maximum value limit printed on the check. ... The consumer would do a transaction with the merchant ... ... and the merchant would forward the transaction to the responsible (certifying authority) institution for authentication and authorization. ... instead of actually issuing a certificate ... ...
    (comp.security.ssh)
  • Re: Forms Authentication via SSL question
    ... Have you tried installing your Certificate Authority as a trusted CA in the ... "Trusted Root Ceritifcation Authorities" for your local machine (ie. both ... > Server Error in '/IRWebAdmin' Application. ...
    (microsoft.public.dotnet.framework.aspnet)
  • Re: Forms Authentication via SSL question
    ... Have you tried installing your Certificate Authority as a trusted CA in the ... "Trusted Root Ceritifcation Authorities" for your local machine (ie. both ... > Server Error in '/IRWebAdmin' Application. ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • Re: Digitally sign my own DLL?
    ... This is the reason why we use our own CA certificate. ... - it may be strange that MS let you install silently a new CA into to the list of trusted CA but this is logical: if you trust someone enough to execute its code, you can trust its CA (Certification Authority). ... This is easy, but because the cert was produced by an untrusted root authority, any app signed by it will have the signature ignored by anyone you give your app to. ...
    (microsoft.public.vc.mfc)