243 questions
243 questions with Windows for business | Windows Server | Directory services | Certificates and public key infrastructure (PKI) tags
2 answers
Windows service 2025 AD CS - I am not able to create PQ CA based on ML-DSA
Hello, I'd like to create a new CA based on PQ algorithm ML-DSA on the Windows Service 2025 server. I am using the version which you can see on the screen below. According to my information it should be sufficient enough to use the ML-DSA algorithm.…
Windows for business | Windows Server | Directory services | Certificates and public key infrastructure (PKI)
asked 2026-08-31T12:19:28.7266667+00:00
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(160, 12%, 25%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ETJ%3C/text%3E%3C/svg%3E)
Tadeáš Janků
0
Reputation points
commented 2026-09-03T15:36:15.06+00:00
Tadeáš Janků
0
Reputation points
2 answers
searching lost certificate of mta
searching lost certificate of mta Searching lost certificate of mta is there any file that save in database microsoft for my MTA certificate
Windows for business | Windows Server | Directory services | Certificates and public key infrastructure (PKI)
asked 2026-08-29T17:39:21.6566667+00:00
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(166.4, 10%, 26%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EFZ%3C/text%3E%3C/svg%3E)
faizal zuli
0
Reputation points
answered 2026-08-31T05:42:27.9366667+00:00
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(304, 38%, 39%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EDH%3C/text%3E%3C/svg%3E)
Daphne Huynh (WICLOUD CORPORATION)
1,225
Reputation points Microsoft External Staff
Moderator
2 answers
Enterprise root CA certificate is nearing expiration. I need help on how to renew without breaking existing trust chains
Our root CA certificate is set to expire 9/8/26. I need help on how to renew without breaking existing trust chains
Windows for business | Windows Server | Directory services | Certificates and public key infrastructure (PKI)
asked 2026-08-27T17:12:24.61+00:00
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(60.8, 35%, 15%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EBK%3C/text%3E%3C/svg%3E)
Budhram, Kevon-admin
0
Reputation points
answered 2026-08-28T00:41:39.5733333+00:00
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(153.6, 9%, 24%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EHL%3C/text%3E%3C/svg%3E)
Hoang Le
3,935
Reputation points
Independent Advisor
0 answers
[ARTICLE] Check secureboot CA 2023 certificates are installed on Windows 11
Open powershell application, type following commads one by one ([System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI kek).bytes) -match ‘Microsoft Corporation KEK 2K CA 2023’) ([System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI db).bytes)…
Windows for business | Windows Server | Directory services | Certificates and public key infrastructure (PKI)
asked 2026-03-11T16:43:41.01+00:00
VARADHARAJAN K
9,711
Reputation points
Volunteer Moderator
commented 2026-08-27T11:14:32.8466667+00:00
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(80, 57.99999999999999%, 17%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EAG%3C/text%3E%3C/svg%3E)
Alex Gopkal
0
Reputation points
5 answers
certificate Auto enrollment is not working
Dears, I’m facing an issue on multiple devices, but not all of them, where AD certificates are not being automatically enrolled from the CA server. I have already tried gpupdate /force along with several other troubleshooting commands, but the issue is…
Windows for business | Windows Server | Directory services | Certificates and public key infrastructure (PKI)
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(275.2, 87%, 36%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ESW%3C/text%3E%3C/svg%3E)
2 answers
Generate Device Cerificate
Cuurenly we deploy device certificate from intune where intune will contact CA server on onprem and intune push the deployment to the endpoint. Now for testing purpose i want to deploy the certificate to non intune device, so how we can generate the…
Windows for business | Windows Server | Directory services | Certificates and public key infrastructure (PKI)
asked 2026-08-12T14:46:59.0866667+00:00
Handian Sudianto
7,421
Reputation points
commented 2026-08-14T14:49:08.8+00:00
Allan Solomon Mejia
7,585
Reputation points
1 answer
One of the answers was accepted by the question author.
Certificate Error - Subject Alternative Name
Dear, We are receiving the following message/error!!!. It is a Default Web Site in a IIS. In different forums, it is indicated that the error is because the URL names to be resolved in the certificate do not match. How do we verify this on the…
Windows for business | Windows Server | Directory services | Certificates and public key infrastructure (PKI)
asked 2026-07-31T19:15:32.95+00:00
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(118.4, 21%, 21%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ELP%3C/text%3E%3C/svg%3E)
Lucas Peñaloza
671
Reputation points
accepted 2026-08-12T14:35:05.72+00:00
Lucas Peñaloza
671
Reputation points
1 answer
How to fix AD CS auto-enrollment stalls and Event ID 64 on domain clients, and how to debug proxy endpoints and clear stale RPC keys?
How to fix AD CS auto-enrollment stalls and Event ID 64 on domain clients, and how to debug proxy endpoints and clear stale RPC keys?
Windows for business | Windows Server | Directory services | Certificates and public key infrastructure (PKI)
asked 2026-08-10T05:49:30.5866667+00:00
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(6.4, 45%, 10%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EIB%3C/text%3E%3C/svg%3E)
Isabella Brown
20
Reputation points
edited an answer 2026-08-11T01:16:36.1633333+00:00
Allan Solomon Mejia
7,585
Reputation points
1 answer
Public Key Infrastructure (PKI) CA Private Key HSM Communication LossRoot CA Stops Publishing CRLs After HSM Network Outage
Hi everyone, We have an offline enterprise Root CA whose private key is protected by a network-attached HSM. During a scheduled CRL publication window, the HSM network interface briefly went down while our network team was performing…
Windows for business | Windows Server | Directory services | Certificates and public key infrastructure (PKI)
asked 2026-08-10T09:01:52.91+00:00
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(134.4, 59%, 23%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EMH%3C/text%3E%3C/svg%3E)
Mikko Hämäläinen
20
Reputation points
edited an answer 2026-08-11T01:11:56.5+00:00
Allan Solomon Mejia
7,585
Reputation points
1 answer
One of the answers was accepted by the question author.
PKCS Device Certificate
Is UPN can work if the PKCS set to device certificate?
Windows for business | Windows Server | Directory services | Certificates and public key infrastructure (PKI)
asked 2026-08-09T23:59:05.2666667+00:00
Handian Sudianto
7,421
Reputation points
accepted 2026-08-10T23:58:30.02+00:00
Handian Sudianto
7,421
Reputation points
1 answer
Adding new OCSP online responder server to already running array controller.
I'm in a process of adding a newly build server running on windows 25 as a array member directly from array controller but repeatdely getting error RPC server not available. Want to know the ports and protocal involved in adding a newly build OCSP server…
Windows for business | Windows Server | Directory services | Certificates and public key infrastructure (PKI)
asked 2026-08-06T04:27:59.4133333+00:00
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(44.800000000000004, 91%, 14%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EAS%3C/text%3E%3C/svg%3E)
Aditya Singh
0
Reputation points
answered 2026-08-10T01:32:50.2133333+00:00
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(284.8, 33%, 37%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EDV%3C/text%3E%3C/svg%3E)
Domic Vo
31,575
Reputation points
Independent Advisor
1 answer
Windows Server 2025 AD CS certsrv.msc displays random Unicode characters in empty rows after Refresh
Environment: Windows Server 2025 (24H2) updated July 2026 ISO image Active Directory Certificate Services installed Certification Authority MMC snap-in (certsrv.msc) Issue: After adding a certificate request (Pending Requests / Issued Certificates…
Windows for business | Windows Server | Directory services | Certificates and public key infrastructure (PKI)
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(182.40000000000003, 28.999999999999996%, 27%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ES%3C/text%3E%3C/svg%3E)
1 answer
Using RSA Token for RDP instead of Windows password
I am currently trying to configure our rdp sessions to prompt for RSA instead of a windows password, I tried registry edits and local GPO, is there something I'm missing, I assumed this would be a simple setup
Windows for business | Windows Server | Directory services | Certificates and public key infrastructure (PKI)
asked 2026-08-06T15:25:18.6666667+00:00
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(192, 90%, 28%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EJ%3C/text%3E%3C/svg%3E)
Johnny
0
Reputation points
answered 2026-08-07T01:23:59.74+00:00
Allan Solomon Mejia
7,585
Reputation points
1 answer
One of the answers was accepted by the question author.
Safe PKI Issuing CA OS Migration (2019 to 2022): Backup/Restore Strategy Without Deleting Old CA First
Hi Everyone, I am planning an in-place upgrade/migration of an Active Directory-Integrated Enterprise Issuing CA running on Windows Server 2019 to a new Windows Server 2022 virtual machine. Key Requirements & Constraints: Quick Rollback: I want…
Windows for business | Windows Server | Directory services | Certificates and public key infrastructure (PKI)
asked 2026-07-28T07:16:47.07+00:00
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(153.6, 93%, 24%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ESR%3C/text%3E%3C/svg%3E)
Sreeram Raju
40
Reputation points
commented 2026-08-04T00:16:06.7266667+00:00
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(307.2, 70%, 39%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ESN%3C/text%3E%3C/svg%3E)
Steven Nguyen (WICLOUD CORPORATION)
415
Reputation points Microsoft External Staff
Moderator
1 answer
Can a single NDES server support multiple certificate templates?
Hello Team, My internal PKI team mentioned that a Network Device Enrollment Service (NDES) server can only be configured to issue one certificate template, and that supporting multiple templates on a single NDES instance isn't possible. Is this statement…
Windows for business | Windows Server | Directory services | Certificates and public key infrastructure (PKI)
asked 2026-07-30T05:20:39.4266667+00:00
Sreeram Raju
40
Reputation points
answered 2026-07-30T07:01:22.6066667+00:00
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(57.599999999999994, 72%, 15%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EIB%3C/text%3E%3C/svg%3E)
Ivy Bui (WICLOUD CORPORATION)
515
Reputation points Microsoft External Staff
Moderator
1 answer
One of the answers was accepted by the question author.
Do I need to renew/re-sign the Issuing CA certificate after changing CDP/AIA URLs?
Hello, I have a Microsoft two-tier PKI with the following architecture: Offline Root CA Enterprise Issuing Subordinate CA I am changing the PKI architecture by adding a dedicated IIS server that will host: CRL Distribution Points (CDP) Authority…
Windows for business | Windows Server | Directory services | Certificates and public key infrastructure (PKI)
asked 2026-07-29T11:12:51.83+00:00
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(156.8, 34%, 25%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EYE%3C/text%3E%3C/svg%3E)
Yassine El Yakoubi
20
Reputation points
commented 2026-07-30T06:29:53.91+00:00
Yassine El Yakoubi
20
Reputation points
1 answer
Server 2022 certificate logon fails with "hash algorithm not supported on server"
Hi, I have a Windows Server 2022 in our domain where I want do log onto via RDP. Authentication should be handled via smartcard/certificate. The certificate was created as a smartcard certificate on the local CA which is trusted by the server. Whenever I…
Windows for business | Windows Server | Directory services | Certificates and public key infrastructure (PKI)
asked 2026-07-27T10:18:53.47+00:00
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(198.4, 62%, 29%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ESS%3C/text%3E%3C/svg%3E)
Stefan Strasser
0
Reputation points
commented 2026-07-30T06:23:53.2+00:00
Stefan Strasser
0
Reputation points
1 answer
Work Folders sync failing with sync relationship error
When a subset of users tries to sync Work Folders, they cannot access the sync options because it fails with "sync relationship could not be established." What's the certificate / AD FS dependency check for Work Folders?
Windows for business | Windows Server | Directory services | Certificates and public key infrastructure (PKI)
asked 2026-07-28T17:27:41.7033333+00:00
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(256, 66%, 34%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EDB%3C/text%3E%3C/svg%3E)
David Brown
20
Reputation points
answered 2026-07-28T20:02:17.2866667+00:00
Allan Solomon Mejia
7,585
Reputation points
3 answers
One of the answers was accepted by the question author.
Cert private key permission changes
Hello, We're implementing a new Windows Event Collector using HTTPS. I have followed various online guides from Microsoft and others and I have a working environment. The only issue I ran in to was having to assign the NETWORK SERVICE account read only…
Windows for business | Windows Server | Directory services | Certificates and public key infrastructure (PKI)
asked 2026-04-13T19:13:26.4+00:00
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(51.2, 76%, 14%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EHL%3C/text%3E%3C/svg%3E)
Hardwick, Lewis
20
Reputation points
answered 2026-07-27T15:26:24.8266667+00:00
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(44.800000000000004, 73%, 14%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EJM%3C/text%3E%3C/svg%3E)
Joseph Miller
0
Reputation points
1 answer
One of the answers was accepted by the question author.
ADFS Token-Signing Cert Expired (Auto-rollover bypassed) / Need safe manual rollover steps
Hi team, We have a P1 incident on ADFS. The automated token-signing certificate rollover failed to trigger, and current cert is already expired. Federated login for all integrated apps is currently down. We need to execute a manual certificate renewal…
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(96, 94%, 19%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EL%3C/text%3E%3C/svg%3E)