Step 1 - Certificate Chain Deployment

The following covers how to install the Cert Chain from EJBCA onto Client Certificate Stores by downloading the CA certificates in EJBCA and then setting group policies to automatically place the CA certificates into their respective certificate stores.

Step 2 - Configure Group Policies on AD server

Configure Group Policies on the AD server according to the following:

1. Access the Group Policy Management (gpmc.msc) on the AD Domain Services server.

2. Expand your domain forest, click Domains > your domain name, and then select Default Domain Policy.

3. Right-click Default Domain Policy and select Edit.

4. Expand Computer Configuration and select Policies > Windows Settings > Security Settings > Public Key Policies.

5. Edit Certificate Services Client – Auto-Enrollment according to the following and then click OK.
   

   • Change Configuration Model to Enabled.

   • Select Update certificates that use certificate templates.

6. Expand User Configuration > Policies > Windows Settings > Security Settings > Public Key Policies.

7. Edit Certificate Services Client – Auto-Enrollment according to the following and then click OK.
   

   • Change Configuration Model to Enabled.

   • Select Update certificates that use certificate templates.

Optionally: If you require to Publish the User certificates in Active Directory and maintain the same User certificate across all domain-joined workstations, perform the following steps. If not, a user that logs on to multiple workstations will be issued a certificate for each workstation profile by design.

1. Expand User Configuration > Policies > Windows Settings > Security Settings > Public Key Policies.

2. Edit Certificate Services Client – Credential Roaming:
   

   • Click the General tab, change to Enabled, and click OK.
     

   • In the message about Roaming Uses Profile exclusion list displayed, acknowledge and click OK.

Step 3 - Update Group Policy for Certificate Enrollment

T o update the Group Policy for Certificate Enrollment, do the following:

1. Access the Group Policy Management (gpmc.msc) on the AD Domain Services server.

2. Expand your domain forest, click Domains > your domain name, and then select Default Domain Policy.

3. Right-click Default Domain Policy and select Edit.

4. Expand Computer Configuration > Policies > Windows Settings > Security Settings > Public Key Policies.

5. Edit Certificate Services Client – Certificate Enrollment Policy.

6. Change Configuration Model to Enabled.

7. Remove the Active Directory Enrollment Policy from the Certificate Enrollment policy list, and then click Add.

8. Enter the policy server URI: https://<ejbcaserver.yourcompany.com:8442>/ejbca/msae/CEPService?msae, click Validate Server, and then click Add.

   • Multiple policy servers can be added here (EJBCA or others). An EJBCA CEP Service URI will be listed with Policy Name as configured in Part 3b: EJBCA Policy Server Configuration.

   • Using the URI format above, changing ?msae will point to a different alias in EJBCA . This may be desired if the EJBCA Auto-enrollment configuration contains multiple aliases, representing different domains.
     

9. Select Default, and then click Add.

10. Expand User Configuration > Policies > Windows Settings > Security Settings > Public Key Policies.

11. Edit Certificate Services Client – Certificate Enrollment Policy.

12. Change Configuration Model to Enabled.

13. Remove the Active Directory Enrollment Policy from the Certificate Enrollment policy list, and then click Add.

14. Enter the policy server URI https://<ejbcaserver.yourcompany.com:8442>/ejbca/msae/CEPService?msae, click Validate Server and then click Add.

15. Select Default, and then click OK.

Step 4 - Test Microsoft Auto-enrollment

To test the Microsoft Auto-enrollment:

1. Add the Windows Client host member of the domain (yourcompany.com).

2. For any user who has logged in prior, you may need to delete the cached policy information in the local user account directory.

   1. The location of the cached user policy is: %userprofile%\AppData\Local\Microsoft\Windows\X509Enrollment
      

   2. The location of the cached machine policy is: %programdata%\Microsoft\Windows\X509Enrollment

3. Log in as user member of the Domain Admins group.

4. Open the Microsoft Management Console (mmc.exe).

5. Click File>Add/Remove Snap-in and select certificates for both user and local computer .
   
   

6. Verify that the user certificate was generated (Current User/ Personal/ Certificates).
   Ensure that the user certificate in the personal store is generated by your issuing CA using the duplicated template.

7. Verify that the computer certificate was generated. (Local Computer/ Personal/ Certificates requires Admin privileges to check the local computer certificate store).
   Ensure that the computer certificate in the personal store is generated by your issuing CA using the duplicated template.