According to a the technet articles:

The Certificate Enrollment Web Service is an Active Directory Certificate Services (AD CS) role service that enables users and computers to perform certificate enrollment by using the HTTPS protocol. Together with the Certificate Enrollment Policy Web Service, this enables policy-based certificate enrollment when the client computer is not a member of a domain or when a domain member is not connected to the domain.

And they explain all the steps on how to install these services but not how they're used. Like yes, I want non-domain clients to enroll for certificates, so how do the clients do that? For the CA Web Enrollment service it clearly says to just enter this into your browser:


(link: https://technet.microsoft.com/en-us/library/hh831649(v=ws.11).aspx )

But for the CE and CEP services it says nothing. Maybe I don't actually understand what they are?


2 Answers 2


CEP is the service that non-domain clients use to gather all the certificate template information from the domain, since LDAP is not an option and DCOM is difficult to safeguard. CES is the retrieval of the certificates. This can be done by instructing non domain members to create an enrollment policy on their user certificate store, or if applicable computer certificate store. It can use multiple authentication schemes such as Windows Integrated (kerberos), X.509 certificates, or username and password. If you are trying to deploy computer certificates to non-domain clients, take care with the X.509 certificate option since they likely won't have a client authentication certificate for the computer store from your internal PKI when they go to retrieve their first cert. By using CES and also CEP you can keep ldap and dcom out of the scenario and just use HTTPS. This makes it alot easier to secure as well as use. You can not use CES without CEP since the template and user information needs to be retrieved from AD.


On the contrary. A client can use CES directly (without CEP) if the templates are pre-defined on the client. Many implementations have clients that use CES directly.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .