Certificate Authority - Autoenrollment

[Keith Wilmot]

We are looking at options for having our servers autoenroll for certifcates using the computer template.  We have a 2-tier setup with an offline root and an enterprise sub CA joined to our main domain.  I am able to get autoenrollment working for our main domain joined machines but we are now trying to get our other non-trusted domains to do the same.  I have the "Certificate Enrollment Web Service" and the "Certificate Enrollment Policy Web Service" configured and I can successfully request a cert where I provide the subject info.  What we would like is to be able to enable autoenrollment and have the server reach out to the CA and grab a cert automatically.  We have been able to successfully request a cert from the computer template in the tnon-trusted domain but it doesn't use the computer name and instead generates a cert using the name of the service account I

have running the web services.

Is it even possible to setup it up this way where we can have machines in the non-trusted domains to autoenroll using the computer template, where it provides its server name automatically?

[#2]

Hi Keith.

Excellent that you have a tiered CA structure!

To your issue with enrolling untrusted computers, I would like to raise the concern that autoenrollment's security in part depends on the computers authenticating, showing the CA that the computers identity has been verified and can be issued a cert because it is a known device.

If untrusted computers were automatically issues certs, what is to prevent a bad guy's computer from being issued one?

Not knowing what your business goals are, what should possibly be happening is that the computers in the untrusted domains should be issued certs in their own domains and a PKI cross trust be implemented.

https://msdn.microsoft.com/en-us/library/windows/desktop/bb540800(v=vs.85).aspx

It does depend on the goals, however.

Thanks

Ed

[#3]

This can be achieved. But as Ed suggested that enrolling untrusted computers could be a problem.

Hence, what you would need to do is issue the first computer certificate during provisioning time of the machine and from thereon it can be auto-enrolled. In this manner you know the device is trusted by your organization and certs are not being given to unknown devices.

During provision time you will have to enroll certificates using Certificate enrollment Policy set to accept user authentication and CES too with user authentication. From thereafter the certs will be renewed from CEP/CES based on the original certs using cert based authentication.

This presentation can help you to understand better

https://channel9.msdn.com/Events/TechEd/NorthAmerica/2011/SIM329