0

We us our own mechanism to create a signed certificate for each and every end user of an Enterprise. However, we'd like to use the Enterprise mechanisms (like AD) to distribute each user its designated certificate.

How can we do it ? (AD answer would be great :-))

Improve this question

1 Answer 1

Reset to default
1

Providing you use a the MSWindows CA, you can use the certificates autoenrollment feature to deploy User and Computer certificates through GPO.

Edit: Here's a link to one relevent Technet article.

Hope this helps.

Improve this answer
3
  • My certificates are not created by the AD CA. Can it still be done ?
    – feder
    Jan 11, 2010 at 12:22
  • Maybe... You would need to issue with your existing CA the certificate for the Root AD CA (or subordonate/issuing CA), then the already issued certificates will continue to work as the cert chain include your existing ca. Maybe others have come across this.
    – Maxwell
    Jan 11, 2010 at 12:51
  • Let me make it clear: My certificates CA and the AD CA are not related. Can the AD auto-enrollment feature, or GPO still do the trick.
    – feder
    Jan 11, 2010 at 14:23

You must log in to answer this question.