2. Enrolling User and Computer Certificates
Now that we have installed the AD CS, it's time for
our users and computers to receive certificates. Users can receive
their certificates three ways:
Through Group Policy objects (GPOs)
You
can use group policies to automatically enroll user and computer
certificates, making the entire certificate process transparent to your
end users.
Through web enrollment
You can request a certificate by using http://servername/certsrv (see Exercise 3).
Through certificate autoenrollment
To set up certificate autoenrollment, you configure the local security policy (see Figure 2 and Exercise 2).
Exercise 2 shows the steps you need to take to configure autoenrollment.
Open the Local Security Policy MMC by selecting Start => Administrative Tools => Local Security Policy. In
the left pane, click Public Key Policies. In the right pane,
right-click Certificate Services Client - Auto-Enrollment and choose
Properties.
In the Configuration Model drop-down list, choose Enabled and click OK.
|
Exercise 3 will show you how to get a certificate using a web browser.
Open Internet Explorer by selecting Start => Internet Explorer.
Enter http://server1/certserv in the Address bar. Note: server1 should be replaced with whtever the loca server name is.
Click the Request A Certificate link.
On the Request A Certificate page, click the Advanced Certificate Request link.
On the Advanced Certificate Request page, choose Create And Submit A Request To This CA.
If
you have a pop-up blocker enabled, you might receive a message about
the information bar. Click Close and then right-click the information
bar on the top of the website. If a second Information box appears
telling you to add the website to the secure site list, click OK.
On
the Advanced Certificate Request page, accept the defaults and click
the Submit button. (If the Submit button is grayed out, your Internet
security settings are too high. Reduce them and try again.)
An information box will appear asking if you want this website to request a certificate. Click Yes.
A
box will appear telling you that the certificate was issued to you. To
accept this certificate, click Install This Certificate.
At
the Web Access Confirmation screen, click Yes. (This confirmation is
letting you know that a certificate is being added to your system.)
The Certificate Installed screen appears when installation is complete. Close the web browser.
