certificate authority - manual issue

[steve sklar]

I have a Certificate authority on a Domain (Enterprise
CA). Currently the certificates are automatically
issued. I want to manually issue certificates.

How do I configure this?

Thanks
Steve

 

[Steven L Umbach]

You could disable auto enrollment of machine certificates in Group Policy/machine
configuration/Windows settings/security settings/public key policy and then request
certificates through Web Enrollment or mmc certificate snapin. --- Steve

http://www.microsoft.com/WINDOWS2000/techinfo/planning/security/autocertsteps.asp
http://www.microsoft.com/windows2000/techinfo/planning/security/advcertsteps.asp

 

[Vishal Agarwal[MSFT]]

Hi,
You can run following command:
certutil -setreg policy\RequestDisposition +REQDISP_PENDINGFIRST

and then restart the CA (net stop certsvc & net start certsvc). This will
set the request to go pending and then you will need to manually issue the
certificates.

Or alternatively, you can set this pending option in the CA snapin
(Certsrv.msc). Right click of the CA name and then choose properties. Upon
display of properties, choose "Policy Module" tab and change the setting for
automatic issuance to pending.



Hope it helps.

Thanks,

Vishal[MSFT]