Generate Device Cerificate

Question

Cuurenly we deploy device certificate from intune where intune will contact CA server on onprem and intune push the deployment to the endpoint.

Now for testing purpose i want to deploy the certificate to non intune device, so how we can generate the certificate manually so i can download and install to the endpoint manually.

Answer 1

Hi @Handian Sudianto

Thanks for clarifying. Since your goal is simply to manually issue a certificate from the same on-prem AD CS CA for a non-Intune test device, you don't need to reproduce the Intune PKCS process itself.

If the test device is domain-joined and can reach the CA, you can manually enroll using:

certlm.msc → Personal → Certificates → All Tasks → Request New Certificate → Active Directory Enrollment Policy

Select the certificate template that your Intune PKCS profile uses, assuming the test user/computer has Read and Enroll permissions on that template.

If the device is not domain-joined, another straightforward option is to generate a certificate request (.req) using certreq, submit it to the CA, then install the issued certificate. This keeps the test separate from Intune while still using your existing CA and certificate template.

The key is to use the appropriate AD CS certificate template, rather than trying to manually invoke the Intune PKCS connector.

Please don't forget to "Accept the Answer" if this information helped you. This will help us and others in the community as well.

Answer 2

Hello @Handian Sudianto

Yes, you can manually enroll a certificate from your on-premises AD CS CA for testing, provided the certificate template allows the test user/device to enroll.

On the non-Intune Windows device:

• Run mmc.exe.
• Add the Certificates snap-in and select Computer account → Local computer.
• Go to Certificates (Local Computer) → Personal → Certificates.
• Right-click and select All Tasks → Request New Certificate.
• Follow the Certificate Enrollment wizard and select the same or an equivalent certificate template used for the device certificate.

This requires the device to be able to reach the CA and the requesting identity to have Enroll permission on the certificate template.

If the test device isn't domain joined or can't use normal AD CS auto/enrollment, you can also use the Certificate Enrollment Web Service/Policy Web Service or create a certificate request (.req) and have the CA issue it manually, depending on how your PKI is configured.

One important point: if your current Intune deployment uses SCEP/NDES, you generally shouldn't try to extract or reuse an Intune-issued certificate. For testing, issue a separate certificate from an appropriate AD CS template instead.

If you can confirm whether your Intune certificate profile uses SCEP or PKCS, we can provide the closest manual enrollment method to reproduce the same certificate.

Please "Accept the Answer" if this information helped you. This will help us and others in the community as well.