Re: Computer Certificate using Web enrollment
From: Brian Komar (bkomar_at_nospam.identit.ca)
Date: 08/25/05
- Next message: Arch Willingham: "Automatic certificate enrollment for local system failed after upgrading member server to domain controller"
- Previous message: Olaf Engelke [MVP Windows Server]: "Re: FYI - Transparent Screensaver for 2003 Server found"
- In reply to: manuellee: "Computer Certificate using Web enrollment"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Date: Thu, 25 Aug 2005 16:02:19 -0500
In article <UPydnYIWz55_G5DeRVn_vA@giganews.com>, manuellee@cableonda-
dot-net.no-spam.invalid says...
> I have a standalone root certificate, and IIS6.0 installed. I´m
> currently trying to deploy computer certificates, and eventhough I´m
> able to do this using active directory or the cert manager console, I
> want to deploy the computer certificates using IIS6.0.
>
> The issue is that when i log into the Webpage and select advanced
> certificate request, in the certificate templates there is no option
> for computer certificate.
>
> I have run the certutil and verified that the machine certificate is
> set for deploy. What should i do?
>
>
The reason is that the Web enrollment requests are performed in the
security context of the user, not the computer. The computer has enroll
permissions and not the user. Even if the user were assigned the Read
and Enroll permissions, there is no DNS name in their user account to
populate the subject of the certificate.
You must enable the Offline templates or create a v2 template that
enables the user to provide the subject in the request. This will allow
the user to type the DNS name of the computer and then submit the
request from the Web interface (if they have Read and Enroll permissions
for the cert and are a local Administrator on the computer to install it
in the machine store)
Brian
-- == Brian Komar MVP - Windows - Security http://www.identit.ca/blogs/brian
- Next message: Arch Willingham: "Automatic certificate enrollment for local system failed after upgrading member server to domain controller"
- Previous message: Olaf Engelke [MVP Windows Server]: "Re: FYI - Transparent Screensaver for 2003 Server found"
- In reply to: manuellee: "Computer Certificate using Web enrollment"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
