255 questions
1 answer
ECDSA Template
How to create ECDSA template for adcs environment ca server 2019, what are the prerequisites with detail step by step for template creation. so it has to be used for VPN gateway, and also it has to be used for internal web application aswel.
Windows for business | Windows Server | Directory services | Certificates and public key infrastructure (PKI)
asked
2026-11-02T03:27:12.1233333+00:00
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(131.20000000000002, 41%, 22%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ESK%3C/text%3E%3C/svg%3E)
Sanjit Kumar
0
Reputation points
commented
2026-11-05T02:32:07.4633333+00:00
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(304, 38%, 39%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EDH%3C/text%3E%3C/svg%3E)
Daphne Huynh (WICLOUD CORPORATION)
2,540
Reputation points Microsoft External Staff
Moderator
2 answers
Issue to FTP SSL
Hi, How to resolve it below regarding FTP SSL?
Windows for business | Windows Server | Directory services | Certificates and public key infrastructure (PKI)
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(316.8, 97%, 40%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EJ%3C/text%3E%3C/svg%3E)
1 answer
ADCS Cert Cleanup
Hi everyone, Currently I'm assessing ADCS environment of one of my clients. They have not maintained the ADCS environment properly now they want me to perform the cleanup of the certificates. Could you please let me know what are the best practices to…
Windows for business | Windows Server | Directory services | Certificates and public key infrastructure (PKI)
asked
2026-10-28T08:35:25.87+00:00
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(134.4, 69%, 23%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EGV%3C/text%3E%3C/svg%3E)
G Vedavyas
0
Reputation points
commented
2026-10-29T11:30:41.93+00:00
Chance Maurice Niyonzima
825
Reputation points
Independent Advisor
3 answers
How to setup automation with Ansible to manage certificate lifecycle
Hi Everyone, Can someone please help me on how we can setup automation using Ansible on ADCS server for CSR generation, Cert renewal, Cert installation, etc. If you have any article links or guides, feel free to share for reference. Thank you.
Windows for business | Windows Server | Directory services | Certificates and public key infrastructure (PKI)
asked
2026-10-27T13:34:41.17+00:00
G Vedavyas
0
Reputation points
answered
2026-10-27T15:00:01.8733333+00:00
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(240, 87%, 33%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EMD%3C/text%3E%3C/svg%3E)
Marie Dominique
85
Reputation points
Independent Advisor
2 answers
NDES PKI Server Migration from Windows 2016 to Windows 2022
Hi team, As windows 2016 server is getting deprecated, we are in process of migrating the NDES server from 2016 to 2022. Please let me know what are the best practices to follow and if you have any guides, please feel free to share. Looking forward for…
Windows for business | Windows Server | Directory services | Certificates and public key infrastructure (PKI)
asked
2026-10-26T13:26:25.2833333+00:00
G Vedavyas
0
Reputation points
answered
2026-10-26T14:04:05.0166667+00:00
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(275.2, 16%, 36%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EV%3C/text%3E%3C/svg%3E)
VPHAN
47,355
Reputation points
Independent Advisor
1 answer
IIS blocks ACME challenge path during automated SSL renewal
Automated SSL certificate renewal fails with a 403 Forbidden error because IIS blocks requests to the .well-known/acme-challenge/ path. How can we configure IIS request filtering or URL authorization rules to allow ACME challenge requests while keeping…
Windows for business | Windows Server | Directory services | Certificates and public key infrastructure (PKI)
asked
2026-10-08T07:27:43.28+00:00
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(310.4, 97%, 40%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ESS%3C/text%3E%3C/svg%3E)
Sahil Soni
100
Reputation points
answered
2026-10-08T08:00:17.8966667+00:00
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(284.8, 33%, 37%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EDV%3C/text%3E%3C/svg%3E)
Domic Vo
36,745
Reputation points
Independent Advisor
2 answers
Old KDC cert still used
2016 DC the old cert is still being presented for authentication. The new KDC cert is installed on all 2016 servers however only a few servers are using it. I did check the enumeration on the DCs that are affected and the older cert is listed as #1,…
Windows for business | Windows Server | Directory services | Certificates and public key infrastructure (PKI)
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(201.6, 30%, 29%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EMP%3C/text%3E%3C/svg%3E)
1 answer
One of the answers was accepted by the question author.
Windows Web Services communication failure saying 503 Service Unavailable
Our microservices hosted on IIS/Windows Servers are failing to communicate with each other, returning 503 Service Unavailable errors. This appears to be caused by an expired Windows Root/Intermediate CA certificate breaking the HTTPS/mTLS mutual…
Windows for business | Windows Server | Directory services | Certificates and public key infrastructure (PKI)
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(214.4, 84%, 30%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EM%3C/text%3E%3C/svg%3E)
1 answer
how to fix error encountered while signing in my pc
hi, in my pc showing every time whenver dsc singing that time showing as " Error encountered while signing: SET The Windows CryptographicService Provider reported an error: ASN1 bad tag value met. Error Code: 2148086027 " please resolve it
Windows for business | Windows Server | Directory services | Certificates and public key infrastructure (PKI)
asked
2026-09-27T01:54:39.73+00:00
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(96, 78%, 19%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EDM%3C/text%3E%3C/svg%3E)
DEVA M
0
Reputation points
answered
2026-09-27T16:13:16.9666667+00:00
Allan Solomon Mejia
10,640
Reputation points
3 answers
How do I remove the DeltaCRL location from an intermediate certificate
Our Intermediate CA shows that a there is a DeltaCRL like. It references a list that is not copied over to the webserver host the crl because we have blocked smb file sharing. So my questions are: Should I remove the DeltaCRL is should it be kept? …
Windows for business | Windows Server | Directory services | Certificates and public key infrastructure (PKI)
asked
2026-09-23T21:30:45.73+00:00
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(195.2, 67%, 28%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EDK%3C/text%3E%3C/svg%3E)
Daniel Kaliel
1,441
Reputation points
commented
2026-09-25T12:45:04.8+00:00
James Gamble
335
Reputation points
1 answer
CVE-2026-54121 (Certighost) July 2026 update - what happens after install, any disadvantages, and pre-install checks?
We're planning to install the July 14, 2026 security update for CVE-2026-54121 (Certighost) on our Enterprise CA servers, which currently have EDITF_ENABLECHASECLIENTDC enabled. What will happen if we install this update? Are there any disadvantages of…
Windows for business | Windows Server | Directory services | Certificates and public key infrastructure (PKI)
asked
2026-09-14T11:44:37.3333333+00:00
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(6.4, 59%, 10%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ERA%3C/text%3E%3C/svg%3E)
Rajesh Alda
125
Reputation points
answered
2026-09-14T12:17:49.9366667+00:00
Harry Phan
35,965
Reputation points
Independent Advisor
1 answer
Renew Certificate
I push dot1x certificate from intune and the certificate itself generated by our internal microsoft ca server. If the certificate will be expired on 2 months then how we can renew the certificate to make sure the dot1.x is not interuppted.
Windows for business | Windows Server | Directory services | Certificates and public key infrastructure (PKI)
asked
2026-09-07T13:10:23.72+00:00
Handian Sudianto
7,636
Reputation points
commented
2026-09-12T07:59:04.8533333+00:00
Handian Sudianto
7,636
Reputation points
2 answers
Windows service 2025 AD CS - I am not able to create PQ CA based on ML-DSA
Hello, I'd like to create a new CA based on PQ algorithm ML-DSA on the Windows Service 2025 server. I am using the version which you can see on the screen below. According to my information it should be sufficient enough to use the ML-DSA algorithm.…
Windows for business | Windows Server | Directory services | Certificates and public key infrastructure (PKI)
asked
2026-08-31T12:19:28.7266667+00:00
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(160, 12%, 25%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ETJ%3C/text%3E%3C/svg%3E)
Tadeáš Janků
0
Reputation points
commented
2026-09-03T15:36:15.06+00:00
Tadeáš Janků
0
Reputation points
2 answers
searching lost certificate of mta
searching lost certificate of mta Searching lost certificate of mta is there any file that save in database microsoft for my MTA certificate
Windows for business | Windows Server | Directory services | Certificates and public key infrastructure (PKI)
asked
2026-08-29T17:39:21.6566667+00:00
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(166.4, 10%, 26%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EFZ%3C/text%3E%3C/svg%3E)
faizal zuli
0
Reputation points
answered
2026-08-31T05:42:27.9366667+00:00
Daphne Huynh (WICLOUD CORPORATION)
2,540
Reputation points Microsoft External Staff
Moderator
2 answers
Enterprise root CA certificate is nearing expiration. I need help on how to renew without breaking existing trust chains
Our root CA certificate is set to expire 9/8/26. I need help on how to renew without breaking existing trust chains
Windows for business | Windows Server | Directory services | Certificates and public key infrastructure (PKI)
asked
2026-08-27T17:12:24.61+00:00
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(60.8, 35%, 15%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EBK%3C/text%3E%3C/svg%3E)
Budhram, Kevon-admin
0
Reputation points
answered
2026-08-28T00:41:39.5733333+00:00
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(153.6, 9%, 24%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EHL%3C/text%3E%3C/svg%3E)
Hoang Le
6,445
Reputation points
Independent Advisor
0 answers
[ARTICLE] Check secureboot CA 2023 certificates are installed on Windows 11
Open powershell application, type following commads one by one ([System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI kek).bytes) -match ‘Microsoft Corporation KEK 2K CA 2023’) ([System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI db).bytes)…
Windows for business | Windows Server | Directory services | Certificates and public key infrastructure (PKI)
asked
2026-03-11T16:43:41.01+00:00
VARADHARAJAN K
9,731
Reputation points
Volunteer Moderator
commented
2026-08-27T11:14:32.8466667+00:00
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(80, 57.99999999999999%, 17%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EAG%3C/text%3E%3C/svg%3E)
Alex Gopkal
0
Reputation points
5 answers
certificate Auto enrollment is not working
Dears, I’m facing an issue on multiple devices, but not all of them, where AD certificates are not being automatically enrolled from the CA server. I have already tried gpupdate /force along with several other troubleshooting commands, but the issue is…
Windows for business | Windows Server | Directory services | Certificates and public key infrastructure (PKI)
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(275.2, 87%, 36%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ESW%3C/text%3E%3C/svg%3E)
2 answers
Generate Device Cerificate
Cuurenly we deploy device certificate from intune where intune will contact CA server on onprem and intune push the deployment to the endpoint. Now for testing purpose i want to deploy the certificate to non intune device, so how we can generate the…
Windows for business | Windows Server | Directory services | Certificates and public key infrastructure (PKI)
asked
2026-08-12T14:46:59.0866667+00:00
Handian Sudianto
7,636
Reputation points
commented
2026-08-14T14:49:08.8+00:00
Allan Solomon Mejia
10,640
Reputation points
1 answer
One of the answers was accepted by the question author.
Certificate Error - Subject Alternative Name
Dear, We are receiving the following message/error!!!. It is a Default Web Site in a IIS. In different forums, it is indicated that the error is because the URL names to be resolved in the certificate do not match. How do we verify this on the…
Windows for business | Windows Server | Directory services | Certificates and public key infrastructure (PKI)
asked
2026-07-31T19:15:32.95+00:00
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(118.4, 21%, 21%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ELP%3C/text%3E%3C/svg%3E)
Lucas Peñaloza
731
Reputation points
accepted
2026-08-12T14:35:05.72+00:00
Lucas Peñaloza
731
Reputation points
1 answer
How to fix AD CS auto-enrollment stalls and Event ID 64 on domain clients, and how to debug proxy endpoints and clear stale RPC keys?
How to fix AD CS auto-enrollment stalls and Event ID 64 on domain clients, and how to debug proxy endpoints and clear stale RPC keys?
Windows for business | Windows Server | Directory services | Certificates and public key infrastructure (PKI)
asked
2026-08-10T05:49:30.5866667+00:00
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(6.4, 45%, 10%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EIB%3C/text%3E%3C/svg%3E)
Isabella Brown
20
Reputation points
edited an answer
2026-08-11T01:16:36.1633333+00:00
Allan Solomon Mejia
10,640
Reputation points