Enrolment at scale

Autoenrollment is what makes ADCS pleasant: Group Policy says which templates a user or computer should have, and the client requests and renews them automatically. Certificate lifecycle becomes invisible.

The same mechanism is the hazard. A change to a published template propagates to thousands of principals at their next policy refresh. A mistake is not one bad certificate; it is an estate-wide issuance event.

1. 1

   Publish the template

   The template is made available on the issuing CA.

2. 2

   Grant permissions

   The right groups receive Read and Autoenroll.

3. 3

   Link a GPO

   Certificate Services Client policy names the templates to acquire.

4. 4

   Client refresh

   At policy refresh the client requests any missing or expiring certificates.

5. 5

   Renewal

   Shortly before expiry the client renews, usually with a new key.

Get-ChildItem Cert:\LocalMachine\My |
  Select-Object Subject, Issuer, NotAfter, Thumbprint |
  Sort-Object NotAfter | Format-Table -AutoSize

Network devices — switches, firewalls, phones, printers, industrial controllers — cannot use Group Policy. NDES provides SCEP enrolment for them: an administrator generates a one-time challenge password, and the device presents it with its request.

NDES deserves particular care. If the challenge password can be reused indefinitely, or the template allows the requester to choose the subject, SCEP becomes an unauthenticated way to obtain an authentication certificate.

• Define which identity the device represents and which EKU it needs — usually client authentication only
• Restrict the template so the subject comes from the request but the CA validates the naming pattern
• Set short validity and automate renewal through the management platform
• Decide how revocation will reach the device, and what happens if it is offline
• Record ownership, so a broken renewal has a human to call