Active Directory Blog : Vista, Certificate Services

2008 Web Enrollment and Version 3 Templates

Tim Springston — Tue, 01 Jul 2008 00:00:00 GMT

Certificate Services in Server 2008 has had a lot of changes and enhancements. Some are obvious and documented well, and others are not obvious and not so well documented. Case in point is an additional aspect of Server 2008 certificate web enrollment....(read more)

2008 Certificate Web Enrollment Pages - Available!!

Tim Springston — Tue, 11 Mar 2008 16:00:00 GMT

I am very happy to announce that the Certificate Web Enrollment pages from Server 2008 are available as a free download at last. Just click on the links below to get the pages, then follow the steps in the KB article to install them on your Server 2003...(read more)

The FEK, AES and FIPs: Acronym Heaven!

Tim Springston — Mon, 04 Feb 2008 19:14:00 GMT

I’ve had several blog posts about the improved security in Windows Vista and Server 2008, particularly around cryptography. Here’s one more, albeit a short one. This post is about how, generally, Encrypted File System (EFS) works using Advanced Encryption...(read more)

All The Logging In The World

Tim Springston — Mon, 08 Oct 2007 19:40:00 GMT

There’s normal troubleshooting and then there’s the stuff you do when the basic troubleshooting doesn’t get things resolved. Normal troubleshooting can be things like selecting “last known good” on a reboot after installing a new driver and having a blue screen. Or perhaps uninstalling and then reinstalling an application, or altering settings for the application or operating system to alleviate a problem. Sometimes we have to dig in and find out more. Many admins out there in the world live that every day. Which is why we add methods to find out more into our products. This post is all about listing all of the data gathering methods that a Directory Services person may ever need to know. Since there are so many it will be difficult to organize well in one uber post but I’m going to put out here for you all anyway, disorganized or not....(read more)

Certificate Web Enrollment from Vista

Tim Springston — Thu, 05 Apr 2007 03:29:00 GMT

One of the enhancements in Windows Vista is the new certificate scripting interface called certenroll. In prior client operating system versions we had the xenroll code which would allow users to enroll for certificates via a web page served out by their Windows Server 2003 certificate authority. For Vista and Longhorn, though, a need was seen to enhance the functionality and ease of development in the certificate APIs. It ended up being a radical, but vastly improved, certificate enrollment API simply called Certenroll.

From a file level, you have xenroll.dll on Server 2003 and XP as the resource DLL to be used. Vista and Longhorn use certenroll.dll instead.

Here’s the MSDN start page on the new certificate services interface:

Certificate Enrollment API

http://msdn2.microsoft.com/en-us/library/aa374850.aspx

With all this new and easy to use functionality comes an issue that some folks may have to deal with. Basically, the Windows 2000 and Server 2003 certificate authority web enrollment pages will not allow a Vista client to enroll for a certificate. The fundamental difference is simply the difference in the enrollment interfaces.

Does this mean that certificate web enrollment isn’t an option from Vista clients? Emphatic no! But it does mean that you have some additional considerations to take into account.

We have a published Knowledge Base article on this (below) but I think that getting the word out a bit more on some details would be helpful for everyone.

How to use Certificate Services Web enrollment pages together with Windows Vista

http://support.microsoft.com/kb/922706

The article basically describes the problem and says that you need to remove your Windows Server 2003 CA web enrollment pages in favor of the ones from a Longhorn Server.

Wait! you say. Longhorn isn’t even released yet! How can I get those pages when they aren’t even available?

We have a hotfix package available as a free (my favorite word) download from our web site.

Just go here and use the KB article 922706 as the reference: https://support.microsoft.com/contactus2/emailcontact.aspx?scid=sw;en;1410&WS=hotfix

Here are few caveats or things to keep in mind about the Longhorn Certificate Enrollment pages that may not have been clearly spelled out in the Knowledge Base article:

-The Longhorn pages support web enrollment requests from 2003 and XP clients as well as Vista (xenroll as well as certenroll)

-The article says that you must use a specific version of the Longhorn pages. Rest assured, if we provide them to you they’re the right ones.

-Enroll on Behalf of (this may be available in Vista SP1) is not present in the Longhorn pages

-Enrolling computer certificates is not possible currently (part of the enroll on behalf of difference)

For folks out there who have heavily customized web enrollment pages I encourage you to contact us, obtain the Longhorn pages and then alter that code as needed to replicate what you need for your purposes.

Special thanks to my colleague Seth Scruggs for some of the above bullets.

We welcome feedback on this, so please post a comment if you’d like. If you have questions on this, please also post.