ADCS Web Enrollment for Non-Windows Clients

is there way configure adcs web enrollment so not rely on activex generate private key , csr?

i've seen certificate authorities issue pfx bundle through custom web enrollment sites , to know if possible our macintosh , linux clients can register certificates.

it works fine if not doing advanced requests need use drop-down lists.

we developing mac enrollment client in next few months use cep/ces services windows server 2008 r2.

for now, long requesting certificates signing certs no key archival, can add certificates follows (also publish user cert:

modify certrqpt.inc file follows:

1) define display text web page
  const l_usertemplatecert_text="user certificate" 'note: should match localized name of 'user' template , certrqma.asp's localized string l_templatecert_text
change (or add line)
  const l_macauthtemplatecert_text="mac authentication certificate"

2) define table of entries manual requests. default.
  rgavailreqtypes(0,field_template)="user”
  rgavailreqtypes(0,field_friendlyname)=l_usertemplatecert_text
  rgavailreqtypes(0,field_csplist)="microsoft enhanced cryptographic provider v1.0?microsoft base cryptographic provider v1.0”
  rgavailreqtypes(0,field_csplist2)="microsoft base cryptographic provider v1.0?microsoft enhanced cryptographic provider v1.0”
  rgavailreqtypes(0,field_exportable)="true”
  navailreqtypes=1

you can change if wish not issue user certificate:

rgavailreqtypes(0,field_template)="macauthentication”            (name of certificate template)
  rgavailreqtypes(0,field_friendlyname)=l_macauthtemplatecert_text                  (references display text defined earlier)
  rgavailreqtypes(0,field_csplist)="microsoft enhanced cryptographic provider v1.0?microsoft base cryptographic provider v1.0”
  rgavailreqtypes(0,field_csplist2)="microsoft base cryptographic provider v1.0?microsoft enhanced cryptographic provider v1.0”
  rgavailreqtypes(0,field_exportable)="false”               (choose whether private key exportable)
  navailreqtypes=1

or if want deploy user , macauthentication certificate:

 rgavailreqtypes(0,field_template)="user”
  rgavailreqtypes(0,field_friendlyname)=l_usertemplatecert_text
  rgavailreqtypes(0,field_csplist)="microsoft enhanced cryptographic provider v1.0?microsoft base cryptographic provider v1.0”
  rgavailreqtypes(0,field_csplist2)="microsoft base cryptographic provider v1.0?microsoft enhanced cryptographic provider v1.0”
  rgavailreqtypes(0,field_exportable)="true”
  rgavailreqtypes(1,field_template)="macauthentication”            (name of certificate template)
  rgavailreqtypes(1,field_friendlyname)=l_macauthtemplatecert_text                  (references display text defined earlier)
  rgavailreqtypes(1,field_csplist)="microsoft enhanced cryptographic provider v1.0?microsoft base cryptographic provider v1.0”
  rgavailreqtypes(1,field_csplist2)="microsoft base cryptographic provider v1.0?microsoft enhanced cryptographic provider v1.0”
  rgavailreqtypes(1,field_exportable)="false”               (choose whether private key exportable)
  navailreqtypes=2

3) run iisreset.cmd on cert server reset iis.

hth,

brian

Windows Server  >  Security