Windows Server 2003 PKI Certificate Autoenrollment

Certificate autoenrollment in Windows Server 2003, Windows XP, and Windows 2000 automatically creates certificates for users and machines. Autoenrollment handles certificate enrollment, certificate renewal, and certain housekeeping tasks, such as removing revoked certificates from a user's or machine's certificate store and downloading trusted root Certification Authority (CA) certificates and cross-certificates (a new way to set up CA trust relationships in Windows 2003) from Active Directory (AD). Win2K public key infrastructure (PKI) supports certificate autoenrollment only for machine certificates and Encrypting File System (EFS) user certificates. Fortunately, Windows 2003 PKI extends certificate autoenrollment for users to all certificate types.

Windows PKI uses certificate autoenrollment several ways:

• Every Windows 2003 and Win2K domain controller (DC) automatically receives a DC certificate when the machine joins a domain in which an enterprise CA is defined.
• An administrator can set a Group Policy Object (GPO) setting that automatically enrolls machines for IP Security (IPSec) or Secure Sockets Layer (SSL) certificates.
• An administrator can set a GPO setting that automatically enrolls several users for a user or secure-mail certificate.
• A CA administrator who wants to change a property of a particular certificate type can duplicate the old certificate template to create a new certificate template and let the new template supersede the old one. Autoenrollment then automatically distributes to the appropriate PKI users a new certificate based on the new template.
• An administrator can automate the creation of certificates for new users.

Certificate autoenrollment requires additional client-side code. At press time, Microsoft bundled only user autoenrollment client logic with Windows 2003 and XP, but the company will soon introduce machine autoenrollment client logic for Windows 2003, XP, and Win2K. User and machine autoenrollment requires that the machine and user be part of an AD domain. . . .