Safeguard Authentication Services 5.0.2 - macOS Administration Guide

Configuring Certificate Templates for autoenrollment

Certificate enrollment is based on templates which define the properties of certificates generated by the Certificate Authority (CA) when clients request certificates.

To create a new certificate template

1. On the server hosting your Enterprise CA, click Start, select Administrative Tools, and click Certification Authority.
2. In the console tree, expand the CA root node, select Certificate Templates, and click Manage.
3. In the Certificate Templates console, select the template that you would like to enable for autoenrollment, or create a new template.
4. Double-click the template to open its properties and select the Security tab.
5. Add the users and machines that you want to automatically enroll for the certificate and select the Autoenroll permission option.
6. Click Apply.

Using Certificate Autoenrollment

Certificate Autoenrollment is an automatic process that runs as-needed on client systems according to Group Policy or according to manual configuration if you are not using Group Policy. Certificate Autoenrollment typically requires no user interaction. After Certificate Autoenrollment is complete, certificates appear in the user's keychain for user-based enrollment or in the system keychain for machine-based enrollment.

Certificate Autoenrollment runs when:

• A user logs in
• Group Policy machine processing occurs (at machine startup and periodically thereafter)
• vascert trigger runs manually (for machine-based enrollment)

If Group Policy is in use and a Certificate Services Client - Auto-Enrollment Group Policy indicates that Certificate Autoenrollment should occur, then the Certificate Autoenrollment client runs. The Certificate Autoenrollment client then downloads and evaluates Certificate Autoenrollment policy and uses this information to determine whether any certificates should be enrolled.

Each of these steps can be invoked manually for testing and troubleshooting. To start Group Policy manually, use the vgptool command. To run Certificate Autoenrollment, use the vascert command. These command are installed in /opt/quest/bin.

Configuring Certificate Autoenrollment manually

Once Certificate Autoenrollment is installed, you must configure your machine to use it. If you are using One Identity Safeguard Authentication Services with Group Policy, then skip the manual configuration described in this section as Group Policy performs these tasks automatically.

Related Topics

Configure a machine for Certificate Autoenrollment

Configure a user for Certificate Autoenrollment

Trigger machine-based Certificate Autoenrollment

Configure a machine for Certificate Autoenrollment

Use the vascert command line utility to configure your machine for Certificate Autoenrollment. Your computer must be joined to the Active Directory domain where your certificate enrollment policy server resides.

To configure your machine for Certificate Autoenrollment

• As root (or using sudo), run the following command to configure a machine for Certificate Autoenrollment:

  /opt/quest/bin/vascert server add -r <policy server URL>

  Where <policy server URL> is the actual http URL for your certificate enrollment policy server.

  For example: https://example.com/ADPolicyProvider_CEP_Kerberos/service.svc/CEP

  NOTE: You can configure more than one certificate enrollment policy server. Certificate Autoenrollment will choose the most appropriate server automatically when performing certificate enrollment.