Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am trying to create client certifications against a Microsoft CA using the built in website. (Microsoft Active Directory Certificate Services) From what I can tell, you have to login as the user to create the corresponding certificate.

Is there any way to get around that? I tried to create my own template, duplicating the user template, but it doesn't match and gets rejected when trying to authenticate. Is this something I'd have to look at building?

share|improve this question

Just configure the group policy to "Auto-Enrol" the user/machine certificates

share|improve this answer
The users will only be logging in through a website, otherwise this would work perfectly. Any other ideas by chance? – Aur Jun 11 '10 at 13:04
up vote 1 down vote accepted

Okay so I Figured this out. For A CA Server using server 2008 you have to do it via the MMC snap in using your Current User Certificate and not the local computer. Took me awhile to figure that out. You also have to create an enroll agent certificate for yourself. What you do than is right click the personal folder, go to advanced operations and choose enroll on behalf of.


  1. Open up mmc and do certificates for your user account.
  2. Enroll yourself as a Certificate request agent.
  3. right click the personal folder under the certificate
  4. Choose Advanced Operations and than Enroll on Behalf of
  5. Follow the wizard and the cert will be created

Thanks for all the help

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.