1

I have a Windows 2003 AD and I set up a root ca and a sub ca both of which are windows 2008(joined to domain).I need to use the sub ca to generate end user certificates for digital signature , they should be able generate from the url (self enroll). Can someone advice if I can get this done?

a. without schema update on ad? ad 2003 to ad 2008

b. or rather make them stand alone ? will the templates work this way ?

1 Answer 1

1

No you dont need a schema extension to use the 2008 CA. See AD Schema Requirements for Windows PKI features.

You are better off using an enterprise subordinate than a standalone subordinate. However it is common to use a standalone root CA.

PKI is something you should plan before you implement (rather than attempt to retrofit later). You might be put off by the amount of documentation out there. Nevertheless, I suggest you review the documentation starting with content on the AskDS blog where Microsoft support engineers post.

See Designing and Implementing a PKI: Part I Design and Planning and other accopanying blogs in series to get a good intro into designing your corp PKI implementation.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .