Google Groups no longer supports new Usenet posts or subscriptions. Historical content remains viewable.
Dismiss

Publish user certificate to a AD contact

333 views
Skip to first unread message

Marten

unread,
May 15, 2008, 8:50:01 AM5/15/08
to
Hi,
I try to publish a user certificate to a contact object in AD with the
following command:

certutil -dspublish c:\robert.cer
CN=Robert,OU=External,DC=Domain,DC=Net?userCertificate

I recive the following error:
CertUtil: -dsPublish command FAILED: 0x80070057 (WIN32: 87)
CertUtil: The parameter is incorrect.

The certificate is ok and trusted. Is this the right syntax or is it
something else wrong here?

Thanks in advance /Marten

Brian Komar (MVP)

unread,
May 15, 2008, 2:30:39 PM5/15/08
to
The dspublish is used to publish CA certificates, not user certificates
It has specific containers that can be uses (RootCA,SubCA,CrossCA,
NTAuthCA).
Brian

"Marten" <Mar...@discussions.microsoft.com> wrote in message
news:1EBCB478-4796-43C4...@microsoft.com...

Marten

unread,
May 17, 2008, 2:08:01 PM5/17/08
to
Hmm strange, according to this article it should work

http://msexchangeteam.com/archive/2008/04/23/448761.aspx

Do you know another way to do this?

Thanks for your help /Marten

Paul Adare

unread,
May 17, 2008, 2:30:15 PM5/17/08
to
On Sat, 17 May 2008 11:08:01 -0700, Marten wrote:

> Hmm strange, according to this article it should work
>
> http://msexchangeteam.com/archive/2008/04/23/448761.aspx
>
> Do you know another way to do this?

Do you have permissions to write to the userCertificate attribute for the
contact object in question?

--
Paul Adare
http://www.identit.ca
One man's constant is another man's variable. -- Perlis

Marten

unread,
May 18, 2008, 5:48:01 AM5/18/08
to
Yes (enterprise admin), it works if a use "user" as the command switch
instead of the full DN. But of course, then the cerificate get publish to the
logged on user not the contact.

Thanks /Marten

Saurav Sinha [MSFT]

unread,
May 27, 2008, 7:52:52 PM5/27/08
to
you can try the following

certutil -addstore
"CN=Robert,OU=External,DC=Domain,DC=Net?userCertificate?base" c:\robert.cer

Saurav Sinha [MSFT]

unread,
May 27, 2008, 8:00:47 PM5/27/08
to
one clarification(forgot to add the ldap:/// prefix in the previous reply)

certutil -addstore
"ldap:///CN=Robert,OU=External,DC=Domain,DC=Net?userCertificate?base"
c:\robert.cer

0 new messages