You are viewing limited content. For full access, please sign in.

Question

Question

STS must be authorized by the same issuer that issued the certificate used by Directory Server

Administration Security Directory Server
Updated October 4, 2019
asked on October 3, 2019 • Show version history

In the online help file it states, "Directory Server and the STS do not need to use the same certificate. However, the certificate for the STS must be authorized by the same issuer that issued the certificate used by Directory Server."

Does the same hold true for an STS in a DMZ? It does not specify so I want to clarify if it does or not.

1 0

Answer

SELECTED ANSWER
replied on October 3, 2019

Yes, the certificate used by the internal LFDS and the certificate used by the DMZ STS must both be issued by a common certificate authority.

0 0
View 4 previous replies
replied on October 3, 2019

So this also ties into my other question you replied on. Can an internal CA create an SSL certificate for a server in a DMZ if it is not a member of the domain?

0 0
replied on October 3, 2019

Indeed it can. All that needs to be done is ensure the certificate CN matches the DMZ machine and ensure that the DMZ machine trusts the root CA or a CA in the trust chain. It's my understanding that the only time communication between the DMZ machine and the internal CA matters is for CRLs

1 0
replied on October 3, 2019

That is good to know. So on top of that, since the DMZ STS needs to verify the internal STS's certificate, do you know how we can do that since it's not on the domain?

0 0
replied on October 3, 2019

Basically what happens is this: DMZ STS trusts "ExampleCA" (a copy of the CA cert is kept in its trusted root store). When it sees the internal LFDS's certificate was issued by "ExampleCA", it knows that machine is to be trusted. The same happens the other way around. Domains won't come into play here.

1 0
replied on October 4, 2019

So the CA's root certificate needs to be exported and imported into the DMZ's trusted root store, correct?

0 0
replied on October 4, 2019

Yes, that's correct. It doesn't necessarily have to be the root certificate, it could be an intermediate certificate as well.

1 0
replied on October 4, 2019

This has been extremely helpful Chase. Thank you for your time.

1 0

Replies

You are not allowed to reply in this post.
You are not allowed to follow up in this post.

Sign in to reply to this post.

Details
Related Posts
Loading ...