Using Subordinate CA's

  • Thread starter Thread starter Guest
  • Start date Start date
G

Guest

At one of my locations I setup an Enterprise Root CA, then also at the same
location I set up a Enterprise Subordinate CA. When I request a new
certificate through the Snap-in, it request a certificate from my Root CA
instead of my subordinate CA. How can I force the computers to request from
the Subordinate CA?
 
Wow. That was easy. Can computers be set up to request a certificate
automatically? I read where the GPO can be set up to where the computer
request a certificate for the PC, but what about User Certificates?
 
Wow. That was easy. Can computers be set up to request a certificate
automatically? I read where the GPO can be set up to where the computer
request a certificate for the PC, but what about User Certificates?
Click to expand...

If you are using the Windows Server 2003 enterprise CAs, running on
Windows Server 2003, Enterprise Edition, you can enable autoenrollment
for user through a combination of Version 2 certificate templates and
Group Policy.

The client computers *must* be running Windows XP.

http://www.microsoft.com/technet/prodtechnol/windowsserver2003/plan/auto
enro.asp

Alternatively, I have included a vbs script in my book that allows you
to perform scripted enrollment (automated enrollment) for user
certificates on Windows 2000 clients with CAPICOM loaded.

http://www.microsoft.com/MSPress/books/6745.asp

Brian
R
 
I am running Windows 2000 Server.

Brian Komar said:
If you are using the Windows Server 2003 enterprise CAs, running on
Windows Server 2003, Enterprise Edition, you can enable autoenrollment
for user through a combination of Version 2 certificate templates and
Group Policy.

The client computers *must* be running Windows XP.

http://www.microsoft.com/technet/prodtechnol/windowsserver2003/plan/auto
enro.asp

Alternatively, I have included a vbs script in my book that allows you
to perform scripted enrollment (automated enrollment) for user
certificates on Windows 2000 clients with CAPICOM loaded.

http://www.microsoft.com/MSPress/books/6745.asp

Brian

R
Click to expand...
 
You should set up only the Sub CA to issue the templates you want. You can
do this by adding/removing certificate templates from under the certificate
templates node in the MMC CA snapin.
 
Back
Top