Today I had a challenge to find out how I can request a certificate from a Windows 2003 Server CA with a "free-style" subject name. MS CA is supporting and enforcing those attributes, enabled by default are EMail, CommonName, OrganizationalUnit, Organization, Locality,State, DomainComponent and Country. Optional you can allow Title, GivenName, Initials, Surname, StreetAddress, UnstructuredName, UnstructuredAddress and DeviceSerialNumber.
First I was wasting time to find a way how to extend that list, later I got an tipp that I can disbale the checking. to do so run Certutil –setreg ca\crlflags +CRLF_REBUILD_MODIFIED_SUBJECT_ONLY (see also http://support.microsoft.com/kb/928016).
Now every subject name is accepted. :-)
Subscribe to:
Post Comments (Atom)
No comments:
Post a Comment