2003 Standard CA Stand Alone Vs. Enterprise

My company wants to secure VPN traffic and executive emails using
certificates. With the limitations of 2003 standard, can I do this? If so
should I install the CA as an Enterprise or stand alone? Thanks

 

In general, you want the Enterprise CA. It directly interfaces with AD
which makes management much easier. There might be specific design
considerations in your environment that may change that, but it is unlikely.

 

An Enterprise CA makes more sense for an AD domain. Windows 2003 Standard
however does not have the more advanced feature of Windows 2003 Enterprise,
namely version 2 templates which can be used for autoenrollment for users
and computers. You can however enable automatic request for computer
certificates via Group Policy. --- Steve

 

Can I make the Version 1 Certs work in a 2003 VPN and Exchange environment

 

Sure. You just don't have the flexibility to customize the template and use
autoenrollment for users with version 1 templates. The link below is to the
PKI guide for the W2003 Deployment Kit. -- Steve

http://www.microsoft.com/resources/.../all/deployguide/en-us/DSSCH_PKI_OVERVIEW.asp
http://tinyurl.com/6ywg6 --- same link as above, shorter.

 

Thanks for the help!! I have installed the Enterprise Root CA and a Sub to
issue through the web. Is there any special consideration to make this work
with email? The root is on the exchange server, but I am having difficulties
encrypting and signing messages. Any additional help would be great....

 

You will have to issue [have them request] the proper certificates to the
users such as the user certificate. They can do that via Web Enrollment or
by opening the certificate mmc snapin for users, go to the
personal/certificates folder, right click, select all tasks - request
certificate. By default domain computers should already trust the Enterprise
CA but you can check to make sure the CA's certificate shows in the trusted
root CA folder. User certificate should already be available for users.
Beyond that since I don't use Exchange I suggest you post in one of the
Exchange newsgroups for the fine details to get things working
moothly. --- Steve