Internal cert

[MS2011]

Morning all,

 

We have an internal CA server. I have renewed SSL cert for one the member server.

 

All the steps done correctly, but when I open the website, still says that cert is not valid.

 

Although new cert is bind.

 

Pls advise

[MS2011]

Anyone out there to help me ?

[3s-gtech]

Is the CA showing is trusted when you look at the cert details?

[Julian]

Can you please vertfy;

The cert server has issued a certificate to itself, and then you have used Group policy, to tell every other computer in your domain, to accept that server as a "Trusered Root Certificate server".

That you have added Microsoft updated server templates, to the cert server templates, note there is a special requirement for DC.

That you have bound the server to use the new certificate, and removed the old certificate.

 

Sorry to be pedantic, but server certificates requirements are not simple.

[Julian]

Please see the links below for more details abot the certificate template versions

 

https://www.gradenegger.eu/en/description-of-the-generations-of-certificate-templates/

https://learn.microsoft.com/en-us/archive/technet-wiki/13303.windows-server-2012-certificate-template-versions-and-options

 

For DC;s

https://dirteam.com/sander/2022/09/14/todo-upgrade-the-certificates-for-your-windows-server-2016-based-domain-controllers-and-up-to-enable-windows-hello-for-business-hybrid-scenarios/

[MS2011]

Can you please vertfy;

The cert server has issued a certificate to itself, and then you have used Group policy, to tell every other computer in your domain, to accept that server as a "Trusered Root Certificate server".

That you have added Microsoft updated server templates, to the cert server templates, note there is a special requirement for DC.

That you have bound the server to use the new certificate, and removed the old certificate.

 

Sorry to be pedantic, but server certificates requirements are not simple.

 

CA server has issued a certificate for the webserver.

 

Website published through iis, internally only.

[chaplic]

As julian implies.

 

The CA Issuing a cert does not magically make any clients trust it. You also need to ensure the name you are referring to it and the certificate name are on-and-the-same.

 

As a test, I would look at the cert properties, export it to file and transfer to test PC. From there run mmc as admin and run certificate services as the computer and import the certifcate into trust root CAs

 

IF the browser is now happy then it implies the computer doesnt trust the CA. If it still doesnt then it may be a naming problem.

[MS2011]

As julian implies.

 

The CA Issuing a cert does not magically make any clients trust it. You also need to ensure the name you are referring to it and the certificate name are on-and-the-same.

 

As a test, I would look at the cert properties, export it to file and transfer to test PC. From there run mmc as admin and run certificate services as the computer and import the certifcate into trust root CAs

 

IF the browser is now happy then it implies the computer doesnt trust the CA. If it still doesnt then it may be a naming problem.

 

Many thanks !!

 

Will try this.

[MS2011]

I have tried above but having same issue. Even on the server, where I renew the cert, having same error

[free780]

Check the SAN for the correct DNS entries.

[k-strider]

Check the SAN for the correct DNS entries.

This...

and