Re: Win2003 server: certificate templates

From: Laudon Williams [MSFT] (laudonw_at_online.microsoft.com)
Date: 10/22/03 

Date: Wed, 22 Oct 2003 08:15:45 -0700

The best way will be to enroll from the web page. You should be able to do
this directly from the UNIX system. The problem is that you are trying to
request a machine certificate from a user account. 

-- 
This posting is provided "AS IS" with no warranties, and confers no rights.
"laurent" <ripoll_laurent@yahoo.fr> wrote in message
news:OsLs4vKmDHA.2432@TK2MSFTNGP10.phx.gbl...
>
> The servers are running under UNIX, and I decided to request the
> certificates with the mmc tool on a windows XP or 2000 computer ( I
> already did some tests with the web enrollment).
> After obtaining the certificates I export them on the servers.
>
> I used the certificate user snap-in in the mmc panel to request a
> certificate.
> I created a "serverCert" template by modifying the "computer" template,
> but I cannot access "serverCert" through the mmc panel.
> I checked the rights on the certificate template and I have the right to
> enroll.
> To be able to request this new certificate template via mmc, are there
> any constraints? Do you have to duplicate specific templates, in order
> to access them?
>
> Thanks,
> laurent
>
>
> Laudon Williams [MSFT] wrote:
> > Laurent, machines can enroll under their own context. Given an
Enterprise
> > CA, you can add the machine to the template and it can autoenroll for
the
> > certificate. The user does not have to intervene. I obviously don't have
the
> > full context here, but it seems easier that way.
> >
> > For your second question, 1.3.6.1.4.1.311.21.10 is application policies,
a
> > Microsoft extension. It should be benign. You can make sure that there
are
> > no application policies enabled in the template.
> >
>
>
> >Hi,
>
> >Thanks for your help with my last questions about the certificates
> >renewal for a standalone CA. I chose to reenroll them.
> >I'm now doing some tests on a windows server 2003 enterprise CA and I
> >have a few questions.
> >I create some server certificates for machines that need to establish
> >ssl connections.
> >Here are some questions about certificates templates:
> >I created a new certificate template "serverCert".
>
> >  1)I have a user toto who is identified on my domain, and who can use
> >this certificate template. I succeeded in getting a certificate with
> >this new template through the web enrollment page with this user but I
> >cannot access "serverCert" through the mmc panel.
> >The only templates I'm prompted with are EFS and USER
> >So is there a way to access this new certificate template via the mmc
> >panel?
>
> >  2)As I received a new certificate with the Web enrollment page, I saw
> >some unusual oids like this one:
> >1.3.6.1.4.1.311.21.7 and this one 1.3.6.1.4.1.311.21.10.
> >I did some research, and the first one seems to be the certificate
> >template id, and I don't know the role of the second one.
> >Are these oids necessary, if not is there a way to remove them?
> >Indeed I'm not sure if it will work with the servers.
>
>
> >Thanks,
> >laurent
> -- 
> ---------------
> laurent Ripoll
> www.altasys.fr
> ---------------
>
>
>

Relevant Pages

  • Re: Error enrolling machine certs
    ... failing to enroll using Domain Controller template. ... certificate templates and to the certificate services - everything that can ... > computer as a local admin to request a computer certificate either through ...
    (microsoft.public.windows.server.security)
  • Re: Event ID 13 - automatic certificate enrollment error
    ... add Domain Controllers to it and check enroll ... > MMC for the certificate authority I can see the certificate templates ... > folder and when I select it I can then see Domain Controller on the ... > manage I can see the template Domain Controller. ...
    (microsoft.public.windows.server.active_directory)
  • Re: Certificate Tamplates in CertSrv Website
    ... The answer is the template names are hard coded in the web site on which are ... > My question is what es is needed to enroll a certificate over the website. ... > One clear example ist the IPSec online and offline certificate tamplate. ...
    (microsoft.public.windows.server.security)
  • Re: Error enrolling machine certs
    ... ignore the bit about the DC certificate. ... description from a Windows 2003 server... ... The custom cert has the right permissions assigned I think (read, enroll, ... > failing to enroll using Domain Controller template. ...
    (microsoft.public.windows.server.security)
  • RE: Certsrv and Autoenrollment problem
    ... Thank you for posting to the SBS Newsgroup. ... so it will not be instantiated on the template ... Certificate Authority snap-in will show the templates in the Certificate ... Microsoft CSS Online Newsgroup Support ...
    (microsoft.public.windows.server.sbs)