I have a CA that is serving computer clients successfully and NPS (Etc.) is all fine. We are currently looking to move some services outside of the network perimeter and I would like to create a secondary cert for users rather than computers. One key shouldn't open all the doors, I know there's priv keys on personal devices for "special" staff etc.

fqdn -> *.services.fqdn

Some questions:

  • How do I create a subdomain for the same forest?
  • The external radius server is not connected to our domain (ie uploaded the public cert and point it towards the crl)
    • Will the computer cert be able to authenticate against the subordinate cert?
  • If anybody has done something like this before am I better off creating a *.client.fqdn and a *.services.fqdn
  • Can I still have SCEP for the FQDN cert?



Browse other questions tagged .