Search code examples
pki

Do auto-enrolled certificates follow you around?


If you auto-enroll an account for an X.509 certificate in a Windows PKI environment, do you get the same certificate (and, by extension, private key) on every computer in the domain that you log into, or does a different certificate get issued for each computer you log into?

I would expect there would be a single certificate that would appear in the CurrentUser certificate store on each computer you logged into. But this is a matter of dispute and I don't have an environment where I can test it.

Are there any subtleties of configuring the certificate template that affect this? Does not using roaming profiles affect this?

If it matters, I am most interested in how this works for service accounts, but I expect it would be the same as for interactive user accounts.

Our PKI is currently Server 2003. It should be migrated to Server 2008 within a year.


Solution

  • Win2K3 does support something called "credential roaming". I haven't investigated it myself, but did come across a document explaining it: http://technet.microsoft.com/en-us/library/cc700848.aspx