According to a the technet articles:

The Certificate Enrollment Web Service is an Active Directory Certificate Services (AD CS) role service that enables users and computers to perform certificate enrollment by using the HTTPS protocol. Together with the Certificate Enrollment Policy Web Service, this enables policy-based certificate enrollment when the client computer is not a member of a domain or when a domain member is not connected to the domain.

And they explain all the steps on how to install these services but not how they're used. Like yes, I want non-domain clients to enroll for certificates, so how do the clients do that? For the CA Web Enrollment service it clearly says to just enter this into your browser:


(link: https://technet.microsoft.com/en-us/library/hh831649(v=ws.11).aspx )

But for the CE and CEP services it says nothing. Maybe I don't actually understand what they are?


The Certificate Enrollment Web Service was implemented in the Windows 7/Server 2008 R2 time frame to provide a better method for Windows clients to get certificates without using the older DCOM method.

They built it essentially as an upgraded way to do what they were doing before but for their own OSes.

In theory since this is a web service, other non Windows devices could have clients written that can speak the WS-Trust protocol.

Googling for Linux WS-Trust and OSX WS-Trust comes up with some results but nothing obvious like, run this cli tool and get certificates from your AD certificate authority.

More info about the certificate enrollment webservice here.

After a little more research the best way to enroll linux or OSX/macOS clients is likely going to be the Network Device Enrollment Service which implements the Simple Certificate Enrollment Protocol (SCEP).

There appear to be clients for these platforms, like Jamf Software's Casper Suite and this example for Linux.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.