Welcome back once again to Implementing Microsoft Always On VPN.
This module covers certificate deployments with Intune.
Now, up until this point,
we've kind of assumed that your endpoints and users were joined to a domain
and that you had access to the on‑premises network, and you're enrolling for
certificates using Active Directory and Group Policy. And that's all well and
fine and and works in in the vast majority of cases, but, of course, this is
not the only use case for deploying certificates, and there may certainly be
some scenarios in which we need to deploy certificates to devices that don't
have access to the domain or maybe aren't even joined to the domain.
And so that's what this particular module is going to focus on, and we'll
start by looking at some of those common use cases.
We'll talk about deploying trusted certificates because we can't enroll for
end‑entity certificates, the certificates that are actually used for device
and user authentication from any CA that the endpoint doesn't trust, so the
first step is to get our endpoints to trust our issuing CAs and our CA
infrastructure and then ultimately get those certificates rolled out to the
end entities.
Now you have two options available to you as an administrator in
Intune with which to enroll end‑ entity certificates.
The first is PKCS, and the second one is called SCEP, and we're
going to have a long conversation about these two technologies and
why you should choose one over the other.
And then finally,
we'll wrap up the conversation with deployment of
the Intune certificate connector,
which is the software that establishes the connectivity between Intune and our
on‑premises enterprise PKI so that we can enroll certificates for devices and users that are outside of the corporate network.