Solved

Use of certificates across different AD forests

Posted on 2009-07-16
2
2,105 Views
Last Modified: 2012-06-27
Hello,

Our company has just had a merger.  This means that we have 4 AD forests.  Forest1 has an AD integrated certificate server which is used for 802.1x authentication.  The other forests do not have a certificate server.  We are currently in the process for migrating everyone to Forest1, but in the meantime we need everyone is the other forests to be able to use forest1's certificates for authentication.  Would this be possible?  There are trusts between the domains, but we can't seem to get it working.  

Each time we browse to the certificate server to request a new certificate we get the following message:

Certificate Request Denied  

Your certificate request was denied.

Your Request Id is 13024. The disposition message is "Denied by Policy Module 0x8007202b, The requester's Active Directory object is not in the current forest. Cross forest enrollment is not enabled. CN=XXXXX,CN=Users,DC=XXXXX,DC=XXX,DC=XXX ldap: 0xa: 0000202B: RefErr: DSID-031006E0, data 0, 1 access points ref 1: 'XXXXX.XXX.XXX' ".
Contact your administrator for further information.

Is there any way to enable Cross forest enrolment?  From what we have read you need windows 2008 server.  At the moment we only have 2003 server.  We would also like to do this without having to introduce new certificate servers to the domains.

Thanks for any help you can give
0
Comment
Question by:dccdesktop
2 Comments
 
LVL 31

Accepted Solution

by:
Paranormastic earned 500 total points
ID: 24870367
Cross forest enrollment is going to be a new CA feature in 2008 R2, whenever that ends up being.  In my opinion, this is probably the biggest advancement in MS cert services since 2003 came out.  SCEP was nice, but this is a much bigger deal.

For now, you would need to create a local account in that domain and then issue the cert, export it including private key, and then install it on the end workstation.  At least one of your CDP locations will need to be accessible from the other workstations (for the root CA and any applicable subordinate CAs), which hopefully isn't too big of a deal.

Unless you are itchy enough to start testing on the beta and roll out a new subordinate CA for this purpose, that's about how it has to be for another year or so.

Here are a couple links about this upcoming feature:

http://blogs.technet.com/pki/

(big download)
http://download.microsoft.com/download/f/2/1/f2146213-4ac0-4c50-b69a-12428ff0b077/Windows_Vista_PKI_Enhancement_in_Windows_7_and_Windows_Server_2008_R2.pptx
0
 

Author Closing Comment

by:dccdesktop
ID: 31604147
Thanks. I had a feeling that 2008 was the only way to do what we wanted.
0

Featured Post

Optimizing Cloud Backup for Low Bandwidth

With cloud storage prices going down a growing number of SMBs start to use it for backup storage. Unfortunately, business data volume rarely fits the average Internet speed. This article provides an overview of main Internet speed challenges and reveals backup best practices.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Synchronize a new Active Directory domain with an existing Office 365 tenant
This article runs through the process of deploying a single EXE application selectively to a group of user.
This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles from a Windows Server 2008 domain controller to a Windows Server 2012 domain controlle…
This video explains how to create simple products associated to Magento configurable product and offers fast way of their generation with Store Manager for Magento tool.

832 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question