Solved

Enterprise CA - Certificate AutoEnrollment Policy on a non-domain computer HowTo

Posted on 2016-10-03
6
76 Views
Last Modified: 2016-10-09
I have completed the following steps thus far:
*Setup Active Directory Certificate Services
*Setup Certificate Enrollment Web Service
*Setup Certificate Enrollment Policy Web Service
*Created duplicate template of computer template
*Created a user account with permissions to the new template (and change the template to require the Subject Name to be supplied in the request)
*Issued the new template
*Reset IIS to update template cache in the Certificate Policy Web Service
*Used Add-CertificateEnrollmentPolicyServer on the non-domain computer to add the Enterprise CA's policy service (used the new user account as the credentials)

When I open the certificates mmc and attempt to get a new certificate using the policy, the list is blank. I'm am not sure what I am missing.

Side note: if there is a way to request the certificate from the policy service with powershell I'd be interested to know that too.
0
Comment
Question by:byt3
6 Comments
 
LVL 19

Expert Comment

by:Peter Hutchison
ID: 41828083
I do not think Auto-Enrollment works for non-domain computers.
You should use the CA web service via https://servername/certserv to request for certificates on non-domain computers or use the certreq.exe utility. The only powershell commands I know of, come with Exchange Servers e.g.
New-ExchangeCertificate
Get-ExchangeCertificate
Import-ExchangeCertificate

https://social.technet.microsoft.com/Forums/windowsserver/en-US/098f858a-3e89-48d2-828e-274487033f6b/how-to-request-certificate-from-a-nondomain-computer?forum=winserversecurity
0
 
LVL 45

Assisted Solution

by:Craig Beck
Craig Beck earned 500 total points
ID: 41828092
Auto enrolment doesn't work for non-domain computers but you can get non-domain computers to request a certificate from a CA by initiating the request manually.

This technet article shows you how...

https://blogs.technet.microsoft.com/askds/2010/05/25/enabling-cep-and-ces-for-enrolling-non-domain-joined-computers-for-certificates/
1
 
LVL 14

Expert Comment

by:Schnell Solutions
ID: 41828385
Like Craig Beck specified, it is not possible the use neither of AD Templates or auto enrolments.
0
Netscaler Common Configuration How To guides

If you use NetScaler you will want to see these guides. The NetScaler How To Guides show administrators how to get NetScaler up and configured by providing instructions for common scenarios and some not so common ones.

 
LVL 2

Author Comment

by:byt3
ID: 41828394
I am using the wrong term, I think what I am trying to do is setup auto renewal. I do understand that I need to initiate the request myself. I guess I can't do it using the mmc console. When I look into using the cerutil.exe later today, I'll come back on this thread if I have any questions.

Thanks for the link. I'll need it for cerutil.exe guidance.
0
 
LVL 2

Accepted Solution

by:
byt3 earned 0 total points
ID: 41828998
It seems I needed to wait longer to be able to use the MMC to request a certificate. The replication must not have finished to all DCs yet for the template. Oops!

I did find that during the cert request it would fail with permission denied, but if I clicked 'Continue' it would then prompt me for credentials. I had entered in credentials when adding the policy server and set it to remember them, but they weren't used when requesting the certificate.

Something to note is that I'm pretty sure this method of requesting certificates on non-domain computers only works on 2008R2/Windows 7 and up (that's when Web CES and CEP roles were introduced). If using an earlier versions of windows, you will be required to use certreq.exe .

First create an .inf file with details like extensions, request attributes...
https://blogs.technet.microsoft.com/rmilne/2014/06/17/how-to-request-certificate-without-using-iis-or-exchange/https://blogs.technet.microsoft.com/rmilne/2014/06/17/how-to-request-certificate-without-using-iis-or-exchange
https://technet.microsoft.com/en-us/library/dn296456(v=ws.11).aspx#BKMK_Newhttps://technet.microsoft.com/en-us/library/dn296456(v=ws.11).aspx#BKMK_New

*on computer needing cert: certreq.exe -New -machine Policy.inf cert.req
*copy cert.req to CA
*on CA: certreq.exe -Submit cert.req cert.cer chain.pfx response.rsp
*copy cert.req, chain.pfx and response.rsp to computer needing cert
*on computer needing cert: certreq.exe -Accept -machine chain.pfx
*on computer needing cert: certreq.exe -Accept -machine response.rsp
*on computer needing cert: certreq.exe -Accept -machine cert.cer
*done
0
 
LVL 2

Author Closing Comment

by:byt3
ID: 41835723
Craig sent me down the right track to eventually finding that I needed to use certreq.exe for a windows 2008 machine I have. I just need to wait for AD replication before I was able to see the template I had created through the policy server I added to the non-domain PC
0

Featured Post

Ransomware-A Revenue Bonanza for Service Providers

Ransomware – malware that gets on your customers’ computers, encrypts their data, and extorts a hefty ransom for the decryption keys – is a surging new threat.  The purpose of this eBook is to educate the reader about ransomware attacks.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

A procedure for exporting installed hotfix details of remote computers using powershell
In this article, I am going to show you how to simulate a multi-site Lab environment on a single Hyper-V host. I use this method successfully in my own lab to simulate three fully routed global AD Sites on a Windows 10 Hyper-V host.
This tutorial will walk an individual through the process of configuring basic necessities in order to use the 2010 version of Data Protection Manager. These include storage, agents, and protection jobs. Launch Data Protection Manager from the deskt…
This tutorial will walk an individual through the process of installing the necessary services and then configuring a Windows Server 2012 system as an iSCSI target. To install the necessary roles, go to Server Manager, and select Add Roles and Featu…

808 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question