Use of certificates across different AD forests

Hello,

Our company has just had a merger.  This means that we have 4 AD forests.  Forest1 has an AD integrated certificate server which is used for 802.1x authentication.  The other forests do not have a certificate server.  We are currently in the process for migrating everyone to Forest1, but in the meantime we need everyone is the other forests to be able to use forest1's certificates for authentication.  Would this be possible?  There are trusts between the domains, but we can't seem to get it working.  

Each time we browse to the certificate server to request a new certificate we get the following message:

Certificate Request Denied  

Your certificate request was denied.

Your Request Id is 13024. The disposition message is "Denied by Policy Module 0x8007202b, The requester's Active Directory object is not in the current forest. Cross forest enrollment is not enabled. CN=XXXXX,CN=Users,DC=XXXXX,DC=XXX,DC=XXX ldap: 0xa: 0000202B: RefErr: DSID-031006E0, data 0, 1 access points ref 1: 'XXXXX.XXX.XXX' ".
Contact your administrator for further information.

Is there any way to enable Cross forest enrolment?  From what we have read you need windows 2008 server.  At the moment we only have 2003 server.  We would also like to do this without having to introduce new certificate servers to the domains.

Thanks for any help you can give
dccdesktopAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

ParanormasticCryptographic EngineerCommented:
Cross forest enrollment is going to be a new CA feature in 2008 R2, whenever that ends up being.  In my opinion, this is probably the biggest advancement in MS cert services since 2003 came out.  SCEP was nice, but this is a much bigger deal.

For now, you would need to create a local account in that domain and then issue the cert, export it including private key, and then install it on the end workstation.  At least one of your CDP locations will need to be accessible from the other workstations (for the root CA and any applicable subordinate CAs), which hopefully isn't too big of a deal.

Unless you are itchy enough to start testing on the beta and roll out a new subordinate CA for this purpose, that's about how it has to be for another year or so.

Here are a couple links about this upcoming feature:

http://blogs.technet.com/pki/

(big download)
http://download.microsoft.com/download/f/2/1/f2146213-4ac0-4c50-b69a-12428ff0b077/Windows_Vista_PKI_Enhancement_in_Windows_7_and_Windows_Server_2008_R2.pptx
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
dccdesktopAuthor Commented:
Thanks. I had a feeling that 2008 was the only way to do what we wanted.
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Active Directory

From novice to tech pro — start learning today.