Scripting user enrollment on Microsoft AD CS

1

I need to be able to auto-enroll a huge number of users using Microsoft AD CS. I have create a certificate template that these users are able to auto-enroll with.

I now need to create the requests and accept the certificates automatically, without UI interaction.

My first thought was to use certreq with -q option to suppress interaction:

certreq -enroll -user -q -PolicyServer "ldap://" "TemplateName"

The server then answers :

The request subject name is invalid or too long (0x80094001)

I think that the -q option enabled the use of default values, some of which might be empty.

Is there any way to provide certreq for additional information (e.g. CN, SAN DNS...) while using an AD CS certificate template in command-line enroll?

templates
certificate
pki
certreq
asked on Stack Overflow May 22, 2015 by Iansus • edited May 22, 2015 by Our Man in Bananas

0 Answers

Nobody has answered this question yet.


User contributions licensed under CC BY-SA 3.0