Re: Assigning Certificates

From: krish shenoy[MS] (kshenoy_at_online.microsoft.com)
Date: 07/31/03 

Date: Thu, 31 Jul 2003 08:57:44 -0700

You can use the Win2k3 Certreq -new command to generate a request that takes
an inf file containing the request parameters. Set MachineKeySet=True and
Exportable=TRUE and specify Subject in the format required by IPSec

CN=machine name,DC= ..,DC=..,DC=..

Then submit the request using certreq -submit and accept it using
certreq -accept
You can then export the certificate to a file

Alternatively you can create a script that uses Xenroll to create the
request

[NewRequest]
    Subject = "CN=..,OU=...,DC=..."
    PrivateKeyArchive = TRUE
    KeySpec = 1
    KeyLength = 1024
    RenewalCert = CertId
    SMIME = TRUE
    Exportable = TRUE
    UserProtected = TRUE
    KeyContainer = "..."
    MachineKeySet = TRUE
    Silent = TRUE
    ProviderName = "Microsoft Enhanced Cryptographic Provider v1.0"
    ProviderType = 1
    UseExistingKeySet = TRUE
    RequesterName = DOMAIN\User
    RequestType = PKCS10 | PKCS10- | PKCS7 | CMC
    KeyUsage = 0x80
    EncipherOnly = TRUE 

-- 
This posting is provided "AS IS" with no warranties and confers no rights.
Use of any included samples is subject to the terms specified at
http://www.microsoft.com/info/copyright.htm"
"Johnny" <jkaftan@wts.com> wrote in message
news:uYhp9MVVDHA.2268@TK2MSFTNGP11.phx.gbl...
> My problem is not importing, it is having something to import.  I want to
> allow users to connect via VPN with Certificates to my network.  I want to
> be able to generate a certificate and hand it to them on a floppy.  Then
> they can take it home and install it on their computer and get into the
> network.
>
>
> "Miha Pihler" <miha.pihler@Atlantis-N0Spam.si> wrote in message
> news:uV2mRAVVDHA.3924@tk2msftngp13.phx.gbl...
> > It depends on CA policy used. What is the purpose of this certificate?
> >
> > In general you can use MMC with Certificate Snap-In to import
certificate
> > under Computer Account....
> >
> > -- 
> > Mike
> > MCSA 2K, MCSE 2K, MCT, ...
> >
> > "Johnny" <jkaftan@wts.com> wrote in message
> > news:OjW4$JUVDHA.2004@TK2MSFTNGP10.phx.gbl...
> > > Looking for a way to assign Computer Certificates to machines that are
> > never
> > > on the network.  Is there a way for an administrator to create a
> > certificate
> > > that can be imported to a Machine's Certificate store.  I could then
> > create
> > > a certificte, copy it to a floppy and send it home with the user.
> > >
> > > Thanks.
> > >
> > >
> >
> >
>
>

Relevant Pages

  • Re: Computer and User Certificates Issues
    ... Enrollment of User Certificates using the custom v2 User Certificate Template ... I can NOT request the custom v2 Computer Cert nor the included v1 no ... Concerning permissions, these are the exact permissions I am using now: ...
    (microsoft.public.security)
  • Re: Cannot request computer certificate.
    ... request a computer certificate for about 9 months. ... and verify that you can get a computer/server certificate from it. ... List of NetBt transports currently bound to the Redir ... DNS Host Name: srvr3.domain.com ...
    (microsoft.public.windows.server.security)
  • RE: SIMple SSL question ??
    ... OK - i would also delete a cert request file lying around. ... But a certificate is a pub key + extra info. ... That said - if someone compromises the server he will also find a way to retrieve the private key. ... traffic between the initial web server and the client. ...
    (microsoft.public.dotnet.security)
  • Re: how can we restrict what certificate WSE will use?
    ... the valid x509 certificate which is used to identify him'. ... X509SecurityTokenManager to verify the request is from a trusted client. ... the problem is that he can not passed the authentication (suppose we ... > decrypte and signature validation process. ...
    (microsoft.public.dotnet.framework.webservices.enhancements)
  • Re: Web Certificate Enrollment security problem
    ... Enrollment works only with the NetBIOS Name and not with the FQDN. ... Svyatoslav Pidgorny, MS MVP - Security, MCSE ... access auditing and logging "issue and manage certificate requests" on ... Have seen that there is a component "Certsrv Request" when launching ...
    (microsoft.public.security)