I have a Windows 2003 AD and I set up a root ca and a sub ca both of which are windows 2008(joined to domain).I need to use the sub ca to generate end user certificates for digital signature , they should be able generate from the url (self enroll). Can someone advice if I can get this done?
a. without schema update on ad? ad 2003 to ad 2008
b. or rather make them stand alone ? will the templates work this way ?