Certificate requests can also be submitted through the Web using
the Web Enrollment Agent. Computers that are part of the domain can automatically
obtain computer certificates if automatic enrollment has been enabled through Group
Policy. A good use for automatic enrollment is to make issuing certificates for computers
that participate in IPSec much easier. Instead of having to create and install certificates
manually for each device, you could put them in an organizational unit (OU) and create
a Group Policy object (GPO) to enable automatic enrollment and allow those computers
to retrieve the correct certificate based on the template you configure for that policy.
Hands-On Exercise: Obtaining a Certificate
Using Web Enrollment
One of the easiest ways to instruct your users to request and obtain a certificate is through
the Web Enrollment Agent. All they will need is Internet Explorer and connectivity to
your CA server.
1. Open Internet Explorer. Choose Tools | Internet Options, and open the Security
tab. Click Trusted Sites, and then click the Sites button. Add http://win2k8ca
(replace win2k8ca with the appropriate server name that hosts your CA) to your
list of trusted sites. Make sure you uncheck the Require Server Verification
(https) for All Sites in This Zone checkbox. Click Close.
2. In the IE Trusted Sites Zone security settings, click the Custom Level button.
Pages:
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456