|
Posted by neo [mvp outlook] on April 9, 2008, 7:53 am
Please log in for more thread options Since I run Windows 2003 Enterprise Edition, what I did was create a copy of
the existing Web Server certificate template and configured it so that the
information would be supplied in the request. Once I allowed the new
template to be used, I used the web interface (http://server/certsrv) to
request the certificate.
If you wish to support Subject Alternate Names (SAN) under Windows 2003
Certificate Services, you need to turn the option on. Note, this isn't a
setting on the certificate template. You actually have to use certutil to
turn the feature on and the stop/start certificate services. The commands
are...
certutil -setreg policy\EditFlags +EDITF_ATTRIBUTESUBJECTALTNAME2
net stop certsvc
net start certsvc
Once you do this, you can request certificates that include the SAN
attribute.
> Thank you neo but how do you request a certificate for another domain
> names than "mycompany.local" ? Through the configuration of Subject
> Alternative Name ?
>
> Thanks
>
>> Yes, you can issue certificates for other domain names other than
>> "mycompany.local".
>>
>> Correct, if issuing self-signed certificates then a copy of the CA
>> certificate has to be installed on non-domain member workstations and
>> servers. (Member workstation/servers automatically get a copy installed
>> at the time of joining the active directory domain.) Once this is done,
>> no more prompts because a certificate can be verified back to the CA
>> certificate.
>>
>>> Hello,
>>>
>>> another question ;-)
>>>
>>> If I am installing an enterprise Windows certificate authority, the
>>> delivered certificates have to be delievered only for the same domain
>>> name as my active directory domain name ?
>>>
>>> For example, if my domain is "mycompany.local", does it mean that only
>>> certificates for *.mycompany.local can be delivered or I can deliver a
>>> certificate for "www.mywebsite.com" ?
>>>
>>> If I can deliver a certificate for www.mywebsite.com and I install the
>>> root certificate of my enterprise CA in the client computer, this
>>> computer will not have any warning message, so ?
>>>
>>> Thank you
>>>
>>> -- Pascal
>>>
>>>
>
> --
> Pascal
>
>
| 
XML Sitemap