Hi Guys,

I have had to build a windows 2003 certificate server and i have it setup and working. 

I would like to enable and enrollment agent to enroll User (Exchange) certificate for users. I can do this in 2008 - 2012 but can not seem to find how to get it working for 2003. 

I have create the enrollment agent template and create the enrollment agent certificate. Yet I cannot  find how to create certificate on behalf of. The certsrv seem to only show smart card option. Certificate MMC only allows you to request certificate unlike 2008.

Anyone have any idea how to complete this. It may be an option to Auto enroll user certificate and then just export each user certificate.  Thanks for your help on this.

PS As a side note if you leave Basic authentication enable of Active-sync then users will require both certificate and basic authentication? You cannot set it up for one or the other?

Craig

Hi Craig,

It seems that there is no enroll on behalf of option in Windows Server 2003's certificate snap-in.

Please try to use the certificate snap-in of Windows 7/Windows Server 2008 R2 to perform this procedure.

Best Regards.

Hi Steven,

Can I use a win7 or 2008 r2 certificate snap-in with a windows 2003 CA to enrol on behalf of?

Also I assume I can use the Enrolment agent certificate for 2003?

Craig

Hi Craig,

>>Can I use a win7 or 2008 r2 certificate snap-in with a windows 2003 CA to enrol on behalf of?

I tested it on my Windows 7, it works for me.

Best Regards.

Hi Steven,

Can you confirm these are all the steps?

Open Certificate console.

Request Enrollment agent certificate

Install Enrollment agent certificate

Request user certificate on behalf of user.

Craig

Hi Craig,

>>Open Certificate console.

     Request Enrollment agent certificate

     Install Enrollment agent certificate

     Request user certificate on behalf of user

If we request the enrollment agent certificate by using mmc, the Enrollment Agent certificate will be installed automatically. When we request the user certificate on behalf of other users, the wizard will let you choose an Enrollment Agent certificate. Then we can choose the user certificate template to enroll it for other users.

Best Regards.