I am trying to create client certifications against a Microsoft CA using the built in website. (Microsoft Active Directory Certificate Services) From what I can tell, you have to login as the user to create the corresponding certificate.

Is there any way to get around that? I tried to create my own template, duplicating the user template, but it doesn't match and gets rejected when trying to authenticate. Is this something I'd have to look at building?


Just configure the group policy to "Auto-Enrol" the user/machine certificates


| improve this answer | |
  • The users will only be logging in through a website, otherwise this would work perfectly. Any other ideas by chance? – Aur Jun 11 '10 at 13:04

Okay so I Figured this out. For A CA Server using server 2008 you have to do it via the MMC snap in using your Current User Certificate and not the local computer. Took me awhile to figure that out. You also have to create an enroll agent certificate for yourself. What you do than is right click the personal folder, go to advanced operations and choose enroll on behalf of.


  1. Open up mmc and do certificates for your user account.
  2. Enroll yourself as a Certificate request agent.
  3. right click the personal folder under the certificate
  4. Choose Advanced Operations and than Enroll on Behalf of
  5. Follow the wizard and the cert will be created

Thanks for all the help

| improve this answer | |
  • Which MMC snap in? – john doe Aug 4 at 15:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.