Re: Web Enrollment Certificate Request Denied
From: Max (maxroberts1_at_yahoo.com)
Date: 07/07/04
- Next message: Jeff Cochran: "Re: List of software to protect Win2K server"
- Previous message: Dusty Harper {MS}: "Re: Security Tab Missing"
- In reply to: anonymous_at_discussions.microsoft.com: "Web Enrollment Certificate Request Denied"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Date: 7 Jul 2004 12:55:30 -0700
Sorry, I haven't dealt with deploying smart cards yet.
I'm just trying to figure out why certificate requests work using the
Certificates MMC, but then I'm told that the EFS certificate template
is
not supported by the Certificate Services when requesting the
certificate through web enrollment.
My XP workstation is a member of the domain. I have the lowest
possible browser security. And I'm using Windows Integrates Security
both on the web enrollment server and its checked on the browser. I'm
not using my UPN when connecting to the web server. These are all
things that are notes as possible causes in the latest whitepaper.
Perhaps my problem is that I'm not following Microsoft Best Practices
of having the web enrollment server on the same server as the Issuing
CA. I've split the two and I think that is causing me issues. There
don't seem to be many examples of this - the new book by Brian Komar,
the 2003 PKI Best Practices White Paper, and the 2003 PKI MOC all give
best practices set-up with IIS and web enrollment together on the
Issuing CA.
Page 134 of Komar's book, Microsoft Windows Server 2003 PKI and
Certificate Security, actually says "If you are planning to utilize
the Certificate Services Web Enrollment pages, you must install IIS on
the Issuing CA."
So perhaps my setup doesn't work at all. Although it would seem to be
better from a security standpoint to split web enrollment and IIS from
the Issuing CAs and their private keys.
- Next message: Jeff Cochran: "Re: List of software to protect Win2K server"
- Previous message: Dusty Harper {MS}: "Re: Security Tab Missing"
- In reply to: anonymous_at_discussions.microsoft.com: "Web Enrollment Certificate Request Denied"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
|
