So as you can see, creating certificate templates and publishing them is
not terribly difficult, honestly. The process of enrolling those
certificate for endpoints, again if it's just a handful of servers,
probably easy enough, if it's maybe even just a few devices or users,
obviously not difficult either, however,
deploying certificates at scale becomes challenging, and at
the end of the day we also want to ensure that the
administrative burden is as low as possible.
Anything that we can do to automate processes should be done, and with
that, we're going to use certificate auto‑enrollment in Active Directory.
Certificate auto‑enrollment can be used for both users and devices, so we
can automate the enrollment and provisioning of certificates users and
devices using Group Policy.
The important part to remember here is not only does it work for provisioning,
but it also works for renewing those certificates as
well, and that's really critical.
Obviously the certificates have an expiry,
they have a lifetime, and they will have to be renewed at some point,
so in this case we can ensure not only that they are provisioned
without administrative intervention required,
but we can also ensure that those certificates are
automatically renewed prior to their expectation.
The recommendation for this GPO for enabling
auto‑enrollment is to link it at the domain level.
Honestly, there's no reason not to, however,
it's really important that it just gets to our VPN servers,
NPS servers, VPN users, and VPN devices.
So, if you want to target this particular GPO at an OU or what have you,
ultimately that's a design choice you have to make. It's far easier just
to link it at the domain level and be done with it, and that's what we're
going to do in this demonstration.
So let's create a certificate auto‑enrollment GPO and apply that using Active Directory and Group Policy.