Share via

Is it possivle to have a domain controller with an internal (domain CA) and external (Digicert) cert?

Charles White 21 Reputation points
2021-03-23T14:08:28.01+00:00

Like the question says, is this possible? We are on a 2012 R2 functional level. And our domain is .local.

If we import an external cert, will that overwrite the Domain cert all together? In which case, I would think that information would propagate out the all the devices. But I would also think that an external cert that is not .local would cause issues with trust in the domain?

We have a vendor that wants to use ldaps for user permissions in their application. I'm trying to get all the info I can before I make any suggestions or decisions.

Charles

Windows for business | Windows Server | Devices and deployment | Configure application groups
0 comments

Answer accepted by question author

  1. Vadims Podāns 9,266 Reputation points MVP
    2021-03-23T21:03:47.393+00:00

    DigiCert will never issue you a certificate for .local domain, because you don't own it. The certificate must include actual domain name in SAN extension and it is possible only for private CA, not commercial CA such as DigiCert. This means that DigiCert is not an option for you at all, you have to use internal CA to issue LDAPS certificates.

    Was this answer helpful?

0 additional answers

Sort by: Most helpful
Most helpful Newest Oldest

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.