Windows 2012 PKI Issuing Subordinate CA question

hello all,

i have question implementing 802.11x wireless authentication using client computer certificates in 2 tier pki environment. have 1 root offline ca ,  multiple issuing subordinate ca's @ each site location.  is there way publish/deploy site specific computer templates ?  the way see now,  is if issuing ca's publish version of computer templates , each client computer in our domain end getting multiple computer certs issued each ca in personal certificates store. 

how can have issuing ca of site issue certs computers physically located in site a.  auto-enroll publish computers domain wide.  is manual enroll way out ?  i don't see gpo setting can leverage deploy personal client computer certificates , bind specific ou.

thanks

neeraj

 

> way see now,  is if issuing ca's publish version of computer templates , each client computer in our domain end getting multiple computer certs issued each ca in personal certificates store.

yep. , can't stick client local site ca. cas registered in active directory , discoverable forest member. , if multiple templates (on different cas) are available particular user , autoenrollment enabled, client contact cas required certificates.

> manual enroll way out ?

no, not way out. client able manually request certificates cas.

> don't see gpo setting can leverage deploy personal client computer certificates , bind specific ou.

you may need create security group ou , designate certificate template group. however, have track group membership, when users moved between ous.

---

vadims podāns, aka powershell cryptoguy
weblog: en-us.sysadmins.lv
powershell pki module: pspki.codeplex.com
powershell cmdlet editor pscmdlethelpeditor.codeplex.com
check out new: ssl certificate verifier
check out new: powershell file checksum integrity verifier tool.

Windows Server  >  Security