I have been tasked to create a Windows Server 2012 Certificate Authority (CA) on our domain and use it to create a Personal Certificate to our users. The purpose of the certificate is to be able to sign PDF files

I have created the CA, and created a new template called "PDF Signing" with all the options i need. Now the only thing that remains is to actually create the certificate to our users.

So far i have seen 3 methods to do this:

  1. Run certmgr, right click on Personal->Certificates and request a certificate. Follow the wizard and choose the "PDF Signing" template. I don't know if this method requires the user to be administrators.
  2. Install the web enrollment role feature and point the users to the website. Ironically, i find that the UI is more complex than the one in certmgr
  3. Command line version (certreq)

Is there a way to automate this process? The command line version requires an .ini file and to supply the password, which complicates automation.

Am i stuck explaining the users how to use certmgr? Our users don't have any kind of privileges, not even local administrator. Or is there another method i have not seen?


This feature is called Certificate Autoenrollment: Configure Certificate Autoenrollment

just to note: do not use web enrollment, it is way outdated and have very and very limited functionality.

Edit: Here is how autoenrollment works.

  1. Each time group policies are refreshed on clients (on domain members it is about each 90min +/-, on domain controllers it is 15 or 5 minutes, depending on functional level) it triggers the autoenrollment.
  2. Autoenrollment checks all certificate templates from Active Directory and selects ones where current user account (or group) have Read and Autoenroll permissions.
  3. Autoenrollment locates available Enterprise CAs in an Active Directory forest and checks whether the CA supports certificate templates selected in step 2.
  4. Autoenrollment examines local certificate store and checks whether there are valid certificates based on templates selected in step 3. If there is missing certificate, autoenrollment performs silent certificate enrollment.

Although, the logic is more complex, this information is enough to you to understand how templates are selected, in other words, through permissions and certificate template availability at CA server.

  • thanks for the reply. that feature doesn't seem to let me choose the specific template i want to generate the certificates under. so i don't know what it will do if i turn it on. I only want to create personal certificates with the custom "pdf signing" template i created – fjleon Oct 11 '16 at 16:47
  • @fjleon, Its the first link on Configure Certificate Autoenrollment. Create a security group for "pdf signing" and allow Autoenroll on the Certificate Template. Be sure to do the rest, such as configuring a GPO. – user2320464 Oct 11 '16 at 17:05
  • @user2320464 is correct. See my edited response. – Crypt32 Oct 11 '16 at 17:21
  • There are tons of templates already, so if i understand you right, none should have right now the "autoenroll" permission, and when i add it to the template i need, it will only create certificates under that template. Seems to do what i need, thanks! – fjleon Oct 11 '16 at 20:09
  • none should have right now the "autoenroll" permission -- exactly. Only automatically enrolled templates must have autoenroll permissions in the Security tab. – Crypt32 Oct 11 '16 at 20:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.