Thank you for your answers, this is what I did: . Download the MS ISS6.0 Resource Kit. . Install (using custom install) SelfSSL on the machine you wish to generate the Self-Signed Certificate for (I used DC01.ad.local). . Run the command: "selfssl /N:CN=DC01.ad.local /K:1024 /V:1825 /S:1 /P:443". Research the command FIRST if you're running this on an IIS Server. . Ignore the message "Error opening metabase: 0x80040154" - which appears if IIS isn't installed. . Using the Certificates MMC snap-in (configured for the local Computer Account), go to Personal\Certificates and export the public key. We needed Base64 encoding for our linux app. . Import the newly created .CER file into whatever app needs to authenticate on the Active Directory and point the app to the server that has the certificate installed (in this case DC01.ad.local).
Don't forget to backup the private key! Keep in mind that this is a 5 year cert (/v:1825) and will only authenticate against the specified Domain Controller (DC01.ad.local). It's vastly preferred to do a proper PKI design, but this solves the issue while we decide on whether PKI is for us. Cheers James -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of James D. Stallard Sent: 06 September 2007 14:39 To: [email protected] Subject: Authenticating with TLS against Active Directory I have a Windows Server 2003 R2 Active Directory and a Linux box running an application (called Collage) whose users I would like to authenticate against the AD. The application only supports TLS, so I need a certificate. However, I do not have the time on this job to properly design and deploy PKI, so I'm looking for a one-off solution. My questions are therefore: . If I create a self-signed certificate (using SelfSSL.EXE from the IIS reskit), install it on a Domain Controller and export it, can I use that to authenticate my Linux application? . Is there a better way of achieving the same goal? Thanks in advance Cheers James James D. Stallard CITP Chief Technical Architect Leafgrove Limited Web: www.leafgrove.com LinkedIn: www.linkedin.com/in/jamesdstallard
