Solved

Enterprise CA - Certificate AutoEnrollment Policy on a non-domain computer HowTo

Posted on 2016-10-03
6
34 Views
Last Modified: 2016-10-09
I have completed the following steps thus far:
*Setup Active Directory Certificate Services
*Setup Certificate Enrollment Web Service
*Setup Certificate Enrollment Policy Web Service
*Created duplicate template of computer template
*Created a user account with permissions to the new template (and change the template to require the Subject Name to be supplied in the request)
*Issued the new template
*Reset IIS to update template cache in the Certificate Policy Web Service
*Used Add-CertificateEnrollmentPolicyServer on the non-domain computer to add the Enterprise CA's policy service (used the new user account as the credentials)

When I open the certificates mmc and attempt to get a new certificate using the policy, the list is blank. I'm am not sure what I am missing.

Side note: if there is a way to request the certificate from the policy service with powershell I'd be interested to know that too.
0
Comment
Question by:byt3
6 Comments
 
LVL 18

Expert Comment

by:Peter Hutchison
ID: 41828083
I do not think Auto-Enrollment works for non-domain computers.
You should use the CA web service via https://servername/certserv to request for certificates on non-domain computers or use the certreq.exe utility. The only powershell commands I know of, come with Exchange Servers e.g.
New-ExchangeCertificate
Get-ExchangeCertificate
Import-ExchangeCertificate

https://social.technet.microsoft.com/Forums/windowsserver/en-US/098f858a-3e89-48d2-828e-274487033f6b/how-to-request-certificate-from-a-nondomain-computer?forum=winserversecurity
0
 
LVL 45

Assisted Solution

by:Craig Beck
Craig Beck earned 500 total points
ID: 41828092
Auto enrolment doesn't work for non-domain computers but you can get non-domain computers to request a certificate from a CA by initiating the request manually.

This technet article shows you how...

https://blogs.technet.microsoft.com/askds/2010/05/25/enabling-cep-and-ces-for-enrolling-non-domain-joined-computers-for-certificates/
1
 
LVL 14

Expert Comment

by:Schnell Solutions
ID: 41828385
Like Craig Beck specified, it is not possible the use neither of AD Templates or auto enrolments.
0
 
LVL 2

Author Comment

by:byt3
ID: 41828394
I am using the wrong term, I think what I am trying to do is setup auto renewal. I do understand that I need to initiate the request myself. I guess I can't do it using the mmc console. When I look into using the cerutil.exe later today, I'll come back on this thread if I have any questions.

Thanks for the link. I'll need it for cerutil.exe guidance.
0
 
LVL 2

Accepted Solution

by:
byt3 earned 0 total points
ID: 41828998
It seems I needed to wait longer to be able to use the MMC to request a certificate. The replication must not have finished to all DCs yet for the template. Oops!

I did find that during the cert request it would fail with permission denied, but if I clicked 'Continue' it would then prompt me for credentials. I had entered in credentials when adding the policy server and set it to remember them, but they weren't used when requesting the certificate.

Something to note is that I'm pretty sure this method of requesting certificates on non-domain computers only works on 2008R2/Windows 7 and up (that's when Web CES and CEP roles were introduced). If using an earlier versions of windows, you will be required to use certreq.exe .

First create an .inf file with details like extensions, request attributes...
https://blogs.technet.microsoft.com/rmilne/2014/06/17/how-to-request-certificate-without-using-iis-or-exchange/https://blogs.technet.microsoft.com/rmilne/2014/06/17/how-to-request-certificate-without-using-iis-or-exchange
https://technet.microsoft.com/en-us/library/dn296456(v=ws.11).aspx#BKMK_Newhttps://technet.microsoft.com/en-us/library/dn296456(v=ws.11).aspx#BKMK_New

*on computer needing cert: certreq.exe -New -machine Policy.inf cert.req
*copy cert.req to CA
*on CA: certreq.exe -Submit cert.req cert.cer chain.pfx response.rsp
*copy cert.req, chain.pfx and response.rsp to computer needing cert
*on computer needing cert: certreq.exe -Accept -machine chain.pfx
*on computer needing cert: certreq.exe -Accept -machine response.rsp
*on computer needing cert: certreq.exe -Accept -machine cert.cer
*done
0
 
LVL 2

Author Closing Comment

by:byt3
ID: 41835723
Craig sent me down the right track to eventually finding that I needed to use certreq.exe for a windows 2008 machine I have. I just need to wait for AD replication before I was able to see the template I had created through the policy server I added to the non-domain PC
0

Join & Write a Comment

Understanding the various editions available is vital when you decide to purchase Windows Server 2012. You need to have a basic understanding of the features and limitations in each edition in order to make a well-informed decision that best suits y…
Disabling the Directory Sync Service Account in Office 365 will stop directory synchronization from working.
This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles to another domain controller. Log onto the new domain controller with a user account t…
This tutorial will walk an individual through the process of installing of Data Protection Manager on a server running Windows Server 2012 R2, including the prerequisites. Microsoft .Net 3.5 is required. To install this feature, go to Server Manager…

746 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

11 Experts available now in Live!

Get 1:1 Help Now