Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

We us our own mechanism to create a signed certificate for each and every end user of an Enterprise. However, we'd like to use the Enterprise mechanisms (like AD) to distribute each user its designated certificate.

How can we do it ? (AD answer would be great :-))

share|improve this question
add comment

1 Answer

Providing you use a the MSWindows CA, you can use the certificates autoenrollment feature to deploy User and Computer certificates through GPO.

Edit: Here's a link to one relevent Technet article.

Hope this helps.

share|improve this answer
    
My certificates are not created by the AD CA. Can it still be done ? –  feder Jan 11 '10 at 12:22
    
Maybe... You would need to issue with your existing CA the certificate for the Root AD CA (or subordonate/issuing CA), then the already issued certificates will continue to work as the cert chain include your existing ca. Maybe others have come across this. –  Maxwell Jan 11 '10 at 12:51
    
Let me make it clear: My certificates CA and the AD CA are not related. Can the AD auto-enrollment feature, or GPO still do the trick. –  feder Jan 11 '10 at 14:23
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.