Hi,

I have some linux clients connected to a MS domain controller. And I need to get certificates autoenrolled for them from Microsoft Active Directory Certificate Services. Is there a linux tool that I can use to get this thing done?

Currently AD authentication for Linux hosts is done through a third party tool.

Any help on this is highly appreciated.

Thank you.

You don't tell us what version/distro of Linux, what version of Windows is on the DC, or what "third party tool" you're using, so we have no idea what you've got to work with, what you've done/tried, or what error(s) you get. So, there's little we can tell you, unless you provide details.

From what I've read, you may be able to use LDAP to do this, but if you're using Microsoft, have you asked their tech-support folks?

Hi,
I have Microsoft Active Directory running on Windows server 2008 R2. And my certificate services also running on Windows server 2008 R2. The linux distributions that are connected to the AD is RedHat Enterprise Linux (RHEL 6.0 and 5.5) and Suse Linux Enterprise Server (SLES 11 and 10). The AD authentication for the linux clients is done through Quest software Authentication Services.

I need to find out linux clients that supports Windows Client Certificate Enrollment Protocol and Certificate Auto enrollment System Overview according to the Microsoft TechNet forums.

I have tested the possibilities of using SCEP protocol for this scenario. What I tested is SSCEP. Since SCEP is by design for issue certificates for the network devices, Microsoft SCEP service does not perform a domain authentication prior to issuing a certificate. I need to perform a domain authentication prior to issuing a certificate.

Any help or hint on this scenario is highly appreciated.

Thank you.

Well, since you're in an environment that's vendor-supported, I'll again suggest contacting your vendors. Microsoft, RedHat, and Novell, in this case, since you're using pay-for products from each of them.

You mention the SCEP software, which you know won't do what you want. Again, LDAP can be used in this situation, from what I've read, but I've not actually done it, which is why contacting Microsoft will be a good idea. They'll be able to tell you where certificates are, how to generate them, etc.