Trusting Internal Microsoft Certificate Authority

[ErikTheAngry]

Hi folks, this should be easy. I've been fighting with this a long while now, and all the reading in the world hasn't seemed to help me.

In a nutshell, I'm trying to trust Microsoft certificate authority in our domain, so that the CA-issued certificates for our domain controllers will be trusted. The application I am trying to get working is FreeRadius, though I suspect that is beside the point.

Thusfar, reading and research says that I must:

• 1) Download the chain from the CA, and save in DER format, convert to PEM
  2) Ensure the PEM from above is in /etc/pki/ca-trust/source/anchor
  3) Run update-ca-trust

I have completed said steps.

When I run radiusd in debug mode, it comes up saying:

TLS: certificate [CN=redactedservername] is not valid - error -8179: Peer's Certificate issuer is not recognized

To me this says that it's still not recognizing the issuing authority... which means I've probably done something wrong.

When I run:
openssl s_client -connect redactedservername:636 | more

I see that:

• 1) The chain shows the certificate is issued by my intended CA
  2) The "verify return code" is 0 (ok)
  3) The read:errno is 104

Item 3, from reading, suggested that it was a connection error, however following the related test (adding -msg to openssl) shows a conversation as would be expected.

Does anyone have any thoughts?

[aks]

AFAIK, there's two places /etc/pki/ca-trust/source/anchors/ and /etc/pki/ca-trust/source. You don't say how you are converting your certificates, nor what "kind" of certificates, but if you're using a certificate with distrust/blacklist or trust flags (the certificate with start with something like BEGIN TRUSTED CERTIFICATE), place it in the sources directory, rather than the anchors directory.

Also if you run update-ca-trust with the extract command it should output more detail. From the man page:
[quote](absent/empty command)
Same as the extract command described below. (However, the command may print fewer warnings, as this command is being run during rpm package installation, where non-fatal status output is undesired.)/quote]