Failing to publish CRL into AD

-

hi,

i'm implementing brand new pki.

i've been following mspress windows server 2008 pki , certificate security book intently , have been implementing verbatim situation fits mine i'm deploying 2 tier pki, offline root , pair of issuing/policy ca's , intents , purposes i'm on page 133 of book.

my offline root standard edtn\standalone ca, lets use rootca it's hostname. second tier dc's in 2 locations.

my friendly name ca newrootca

these make easy obscure real identities , keep consistent throughout troubelshooting thread.

my issue when using commands :-

certutil -dspublish -f rootca_newrootca.crt rootca
certutil -dspublish -f newrootca.crl

the second command trying publish crl fails following error:-

c:\>certutil -dspublish -f newrootca.crl
ldap:///cn=newrootca,cn=rootca,cn=cdp,cn=public key services,cn=services,
dc=unavailableconfigdn?certificaterevocationlist?base?objectclass=crldistributionpoint?certificaterevocationlist

ldap: 0xa: 0000202b: referr: dsid-031007ef, data 0, 1 access points
        ref 1: 'unavailableconfigdn'

certutil: -dspublish command failed: 0x8007202b (win32: 8235)
certutil: referral returned server.

if browse ad using sysinternals adexplorer, see both

cn=newrootca,cn=certification authorities,cn=public key services,cn=services,cn=configuration,dc=domain,dc=internal
cn=newrootca,cn=aia,cn=public key services,cn=services,cn=configuration,dc=domain,dc=internal

nothing under

cn=cdp,cn=public key services,cn=services,cn=configuration,dc=domain,dc=internal

in head @ least - believe it's naming crl trying insert data :

ldap:///cn=newrootca,cn=rootca ,cn=cdp,cn=public key services,cn=services,.........

rather than

ldap:///cn=newrootca,cn=cdp,cn=public key services,cn=services,..........

though see text (in bold)

ldap:///cn=newrootca,cn=rootca,cn=cdp,cn=public key services,cn=services,
dc=unavailableconfigdn ?certificaterevocationlist?base?objectclass=crldistributionpoint?certificaterevocationlist

in part of error , doesn't fill me confidence.

could please me out predicament?

regards

paul.

hi paul --

follow these steps:

http://technet.microsoft.com/en-us/library/cc737740%28ws.10%29.aspx

after restarting certificate services on ca, manually publish new crl, publish crl active directory.

hope helps,

jonathan stephens

this posting provided "as is" no warranties, , confers no rights. please remember click “mark answer” on post helps you, , click “unmark answer” if marked post not answer question. can beneficial other community members reading thread.


Windows Server  >  Security



Comments

Post a Comment

Popular posts from this blog

Error: 0x800f080c - Feature name NetFX3 is unknown

-
i trying install .net framework 3.5 on windows server 2012 standard using command below: ps c:\users\administrator> dism.exe /online /enable-feature /featurename:netfx3 /source:f:\sources deployment image servicing , management tool result: version: 6.2.9200.16384 image version: 6.2.9200.16384 error: 0x800f080c feature name netfx3 unknown. a windows feature name not recognized. use /get-features option find name of feature in image , try command again. the dism log file can found @ c:\windows\logs\dism\dism.log option install .net framework not appear in server manager. how can .net framework 3.5 install? seems impossible install .net framework 3.5 have tried suggested solutions dism /online /cleanup-image /restorehealth, without success.  have run get-windowsfeature , .net framework 3.5 not appear: display name                                ...
Read more

Checkedlist box

-
hi all, i tired creating checkedlistbox allow users selecting multiple inputs simultaneously. trying perform on check/check activity starting displaying selected item user. below sample code created. code not working believe have not selected correct onclick activity. great if can suggest me correction. $colourlistbox = new-object system.windows.forms.checkedlistbox $colourlistbox.location = new-object system.drawing.size(1,20) $colourlistbox.size = new-object system.drawing.size(140,50) $colourlistbox.sorted = $true $colourlistbox.backcolor = "lightgray" $colourlistbox.forecolor = "blue" $colourlistbox.checkonclick = $true $colourlistbox.height = 50                                         [void] $colourlistbox.items.add("red")   ...
Read more

server manager error: ADAM.events.xml could not be enumerated.

-
firewall off isnt it. rerun ldap wizard:?  why?  will screw exchange server running on machine?  ldap wizard asks questions don't understand. please dont send generic links to: http://social.technet.microsoft.com/wiki/contents/articles/13444.windows-server-2012-server-manager-troubleshooting-guide-part-ii-troubleshoot-manageability-status-errors-in-server-manager.aspx thanks, john hi john, >> ok. server manager app. these questions refer this. nothing else 2.  do need create app dir or not?  this server manager, shouldnt done? (why did break in first place?) how check if app dir exists server manager or not. 3.  if "lightweight" implementation of anything, sure hate see "heavyweight" version. the waring events can't enumerated. , cause not completing configuration of ad lds. ad lds not related server manager. used provide flexible support directory-enabled applications. if not implementing such application...
Read more