I have installed 2 CA onto 2 Windows 2008R2 VM, one being an offline root CA and the other is intended to be the issuing CA. However I found that a DC (a 2008R2 VM) is requesting 2 certificates, namely Domain Controller Authentication and Directory Email Replication, (they are auto issued with expiration period of one year) on every reboot. I wonder if there is normal and would like to turn this 'feature' off, any idea?
Add a comment
|
Its normal for the DC to ask for a cert. It does this through autoenrollment. As long as the template is approved and the DC has the relevant permissions (read, enroll and autoenroll), it can autoenroll for a cert based on the template.
You could remove the template or edit the permissions if you dont want to issue it. Use the certificate management console as per http://technet.microsoft.com/en-us/library/cc772358.aspx to remove the template if you dont want to issue it.
-
Thank you very much for your info. I have disabled auto enrollment using group policy for domain controllers and wonder will there be any issue later without auto enrollment for the DC? – William Dec 20 '11 at 3:30
-
Don't disable autoenrollment. I personally would be more interested in troubleshooting why the same cert is requested over and over again. – maweeras Dec 20 '11 at 14:13
-
Since I think I need to do something to stop the unnecessary requests, I have disabled auto enrollment at the mean time. Just wonder, would it be related to forest functional level? I have 3 DC, 2x 2003R2 x86 and 1x 2008R2. It is the 2008R2 keeps requesting the certs regularly. In the long run, I am planning to replace those 2003R2 with 2008R2 and raise the domain/forest functional level to the highest level (now it is limited to 2003 native mode). – William Dec 23 '11 at 2:53
