Re: Windows 2003: Issue user certificate on behalf of a user

A certificate is issued for trust purposes, as far as I know this can't be
done. I would be surprised if it could because then it would no longer be
trustworthy (The cert).

I have copied the PKI folks in who have a better background in this area.

--
Paul Bergson
MVP - Directory Services
MCTS, MCT, MCSE, MCSA, Security+, BS CSci
2008, 2003, 2000 (Early Achiever), NT4
Microsoft's Thrive IT Pro of the Month - June 2009

http://www.pbbergs.com

Please no e-mails, any questions should be posted in the NewsGroup This
posting is provided "AS IS" with no warranties, and confers no rights.

"Jeremy Wiebe" <> wrote in message
news:84630547-6D78-4B2D-8C21-...
> Hi there,
>
> I'm working on an application where we are going to use User Principal
> Name
> Mapping (http://technet.microsoft.com/en-us/l.../bb742438.aspx) to map
> incoming requests on our application to windows accounts. From what I
> understand, this will require user certificates issued by a CA within the
> domain.
>
> I've got a test Windows 2003 R2 domain up and running and have the CA
> running as well.
>
> What I can't figure out is how to issue a certificate for a user without
> logging in as that user and using the web enrollment app. Is there any
> way
> for a domain admin to issue a certificate for a user and then get access
> to
> the certificate?
>
> Thanks.

Yes it can be done but why do you need to issue them first. Part of any
good PKI en-rollement or any good CPS would have specific requirements for
validating the user, ie he's in front of you with his passport or he's
logged in already with a valid account.

To issue certificates to user without them being there you need to do it
from the command line or use a 3rd party plug-in such as ActivIdentity or
entrust software package.

I'm not up on 2008 but certainly under 2003.


On 18/01/2010 13:40, in article OW$, "Paul
Bergson [MVP-DS]" <pbbergs@no_spammsn.com> wrote:

> A certificate is issued for trust purposes, as far as I know this can't be
> done. I would be surprised if it could because then it would no longer be
> trustworthy (The cert).
>
> I have copied the PKI folks in who have a better background in this area.