Certificate Enrollment Web Service enrollment for multiple forests.

Question

I've setup Certificate Enrollment Web Service. The document says you can request certs in other forests. The document falls short of HOW to do that. Is there instructions? Seems MS just leaves stuff off all the time.

Right now I'm guessing something like DSPublish the cert chain into the other forest to get things going.

Any help finding the details would be great. Thank you.

AND THESE FREAKING TAGS BULLS*T IS GETTING TO ME>>>> THERE IS NO CA TAG!!!!!!!!!

Answer 1

I still can't see certs in other forests. I have no details from Microsoft about this part of their product.

Answer 2

Hello @ComputerHabit ,

Thank you for posting here.

Based on my knowledge, for cross forest certificates:

If there is two-way trust relationship between two forests, we can set up Cross-Forest Certificate Enrollment.
For more information we can refer to link below.
AD CS: Deploying Cross-forest Certificate Enrollment
https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/ff955845(v=ws.10)

If there is no two-way trust relationship between two forests, we can set up Cross-Forest Certificate Enrollment.
For more information we can refer to link below.
Test Lab Guide Mini-Module: Cross-Forest Certificate Enrollment using Certificate Enrollment Web Services
https://social.technet.microsoft.com/wiki/contents/articles/14715.test-lab-guide-mini-module-cross-forest-certificate-enrollment-using-certificate-enrollment-web-services.aspx

Hope the information above is helpful.

Should you have any question or concern, please feel free to let us know.

Best Regards,
Daisy Zhou

============================================

If the Answer is helpful, please click "Accept Answer" and upvote it.

Answer 3

I answered my own questions here:

https://learn.microsoft.com/en-us/answers/questions/357894/ad-cs-deploying-cross-forest-certificate-enrollmen-1.html