Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We us our own mechanism to create a signed certificate for each and every end user of an Enterprise. However, we'd like to use the Enterprise mechanisms (like AD) to distribute each user its designated certificate.

How can we do it ? (AD answer would be great :-))

share|improve this question

Providing you use a the MSWindows CA, you can use the certificates autoenrollment feature to deploy User and Computer certificates through GPO.

Edit: Here's a link to one relevent Technet article.

Hope this helps.

share|improve this answer
My certificates are not created by the AD CA. Can it still be done ? – feder Jan 11 '10 at 12:22
Maybe... You would need to issue with your existing CA the certificate for the Root AD CA (or subordonate/issuing CA), then the already issued certificates will continue to work as the cert chain include your existing ca. Maybe others have come across this. – Maxwell Jan 11 '10 at 12:51
Let me make it clear: My certificates CA and the AD CA are not related. Can the AD auto-enrollment feature, or GPO still do the trick. – feder Jan 11 '10 at 14:23

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.