bunny-lab/docs
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Update deployments/services/authentication/Active Directory/Certificate Services.md
Automatic Documentation Deployment / Sync Docs to https://kb.bunny-lab.io (push) Successful in 6s
Details

Browse Source
This commit is contained in:
Nicole Rappe
2026-07-23 14:31:19 -06:00
parent c2836359f5
commit 4061eb57c4
1 changed files with 1 additions and 29 deletions
Download Patch File Download Diff File Expand all files Collapse all files
deployments/services/authentication/Active Directory/Certificate Services.md
+1 -29
View File
@@ -615,66 +615,38 @@ Recommended operational tasks:
- Monitor issuance and renewals with audit logs and scripts.
## Export the LDAPS Certificate for Third-Party Applications
Some applications do not automatically trust your internal PKI and require you to manually install the certificate used by your domain controllers for LDAPS. In most cases, you should export the issuing CA certificates rather than the individual domain controller certificate. Only export the domain controller certificate if the third-party application explicitly requires it.
### Export the Root and Subordinate CA Certificates
The Root CA and Subordinate CA certificates establish trust for every domain controller certificate issued by your PKI.
From any domain-joined system:
* Launch `certlm.msc`
* Navigate to "**Trusted Root Certification Authorities > Certificates**"
* Locate your Root CA certificate
* Right-click the certificate and select "**All Tasks > Export...**"
* Select "**No, do not export the private key**"
* Export the certificate as either:
* `DER encoded binary X.509 (.CER)`, or
* `Base-64 encoded X.509 (.CER)`
* Navigate to "**Intermediate Certification Authorities > Certificates**"
* Locate your Subordinate CA certificate
* Repeat the export process
Import both certificates into the trusted certificate store required by the third-party application.
### Export a Domain Controller Certificate
If the application requires the LDAPS server certificate itself:
* On the target domain controller, launch `certlm.msc`
* Navigate to "**Personal > Certificates**"
* Locate the certificate issued to the domain controller's FQDN that includes **Server Authentication** as an intended purpose
* Right-click the certificate and select "**All Tasks > Export...**"
* Select "**No, do not export the private key**"
* Export the certificate as either:
* `DER encoded binary X.509 (.CER)`, or
* `Base-64 encoded X.509 (.CER)`
!!! warning "Do Not Export the Private Key"
Third-party LDAPS clients require only the public certificate. Do **not** export the certificate as a `.pfx` file or include the private key unless the vendor explicitly documents that requirement.
### Validate the Exported Certificate
Run the following command against the exported certificate:
```powershell
certutil -verify -urlfetch <EXPORTED_CERTIFICATE>.cer
```
Verify that:
* The certificate chains back to your internal Root CA.
* The certificate is currently valid.
* The output does not contain `CRYPT_E_REVOCATION_OFFLINE`.
If the application connects by hostname, ensure it uses the same FQDN that appears in the domain controller certificate. Connecting by IP address will typically fail certificate validation unless the IP address is present in the certificate's Subject Alternative Name.
Third-party LDAPS clients require only the public certificate. Do **not** export the certificate as a `.pfx` file or include the private key unless the vendor explicitly documents that requirement.