Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Microsoft Certificate Web Services is a HTTPS web service (WS-Trust) that has no Kerberos dependency and can be used on a variety of devices. This is new in Windows 2008 and is separate from the browser based key request system that has existed in the product since Windows 2000.

The service is based on WCF and is accessed in the following URL format: https://server/server_CES_UsernamePassword/service.svc?wsdl


  • How do internal Microsoft tools interact with this service? What methods are called? What does the SOAP look like?

  • How can a developer interact with this service in a meaningful way? I attempted to view the object directly in VS2010, but I didn't find any proxy objects that enabled any constructive action.

My thoughts are if I can't access the object in VS2012, I won't be able to use any other language or get Mac or Linux to enroll with a certificate as well.

Here is a sample XML file that is displayed (and consumed by svcutil).

<?xml version="1.0" encoding="UTF-8"?>
-<wsdl:definitions name="SecurityTokenService" xmlns:wsa="" xmlns:wsaw="" xmlns:wsa10="" xmlns:tns="" xmlns:soapenc="" xmlns:soap12="" xmlns:wsu="" xmlns:soap="" xmlns:xsd="" xmlns:wsp="" xmlns:msc="" xmlns:wsap="" xmlns:wsx="" xmlns:wsam="" xmlns:wsdl="" targetNamespace="" xmlns:i0="">-<wsp:Policy wsu:Id="WSHttpBinding_ISecurityTokenService_policy">-<wsp:ExactlyOne>-<wsp:All>-<sp:TransportBinding xmlns:sp="">-<wsp:Policy>-<sp:TransportToken>-<wsp:Policy><sp:HttpsToken RequireClientCertificate="false"/></wsp:Policy></sp:TransportToken>-<sp:AlgorithmSuite>-<wsp:Policy><sp:Basic256/></wsp:Policy></sp:AlgorithmSuite>-<sp:Layout>-<wsp:Policy><sp:Strict/></wsp:Policy></sp:Layout><sp:IncludeTimestamp/></wsp:Policy></sp:TransportBinding>-<sp:SignedSupportingTokens xmlns:sp="">-<wsp:Policy>-<sp:UsernameToken sp:IncludeToken="">-<wsp:Policy><sp:WssUsernameToken10/></wsp:Policy></sp:UsernameToken></wsp:Policy></sp:SignedSupportingTokens>-<sp:Wss11 xmlns:sp=""><wsp:Policy/></sp:Wss11>-<sp:Trust10 xmlns:sp="">-<wsp:Policy><sp:MustSupportIssuedTokens/><sp:RequireClientEntropy/><sp:RequireServerEntropy/></wsp:Policy></sp:Trust10><wsaw:UsingAddressing/></wsp:All></wsp:ExactlyOne></wsp:Policy><wsdl:import location=" Policy 01aa_CES_UsernamePassword/service.svc?wsdl=wsdl0" namespace=""/><wsdl:types/>-<wsdl:binding name="WSHttpBinding_ISecurityTokenService" type="i0:ISecurityTokenService"><wsp:PolicyReference URI="#WSHttpBinding_ISecurityTokenService_policy"/><soap12:binding transport=""/></wsdl:binding>-<wsdl:service name="SecurityTokenService">-<wsdl:port name="WSHttpBinding_ISecurityTokenService" binding="tns:WSHttpBinding_ISecurityTokenService"><soap12:address location=""/>-<wsa10:EndpointReference><wsa10:Address></wsa10:Address></wsa10:EndpointReference></wsdl:port></wsdl:service></wsdl:definitions>
share|improve this question
I realize this post is 2 years old but if any one else is interested in this topic I have created a client in Java using Sun's Metro API, should work with CXF or spring: – user88546 Oct 6 '15 at 18:52

No idea how Microsoft internal tools interacts with the service. You'd have to ask them, and they won't tell you. A friend used to work in MSIT building said tools, and even he wouldn't tell me.

However, there should be a sample in the Windows SDK that gets installed here (source:

C:\Program Files\Microsoft SDKs\Windows\v7.1\Samples\security\x509 certificate enrollment\CSharp\enrollWithIX509EnrollmentHelper

According to various sources its not the most in depth sample, so see here too:

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.