1

I'm trying to crack the following nut: I have a contract with Digicert for S/MIME certificates for my org. Digicert allows to use their API for cert issuance.

Unfortunately I can't let users self-enroll, because I need to store their encryption keys.

To date, I'm generating their keypairs myself on dedicated machine, sign CSR on Digicert site, upload the private key to escrow on local CA, then send all to end-user.

What I would prefer, though, is to never touch user's private key. This is possible with Active Directory autoenrollment, but I can't autoenroll with Digicert.

Any ideas how to marry those two worlds?

| improve this question | |
  • MS certificate autoenrollment doesn't work with DigiCert. – Crypt32 Feb 26 '19 at 14:23
  • 1
    Yes, no kidding - if it was, I wouldn't ask this question. I am asking "how to marry this" - perhaps there's some software "glue" I could use. – StanTastic Feb 26 '19 at 14:27
  • 1
    You will have to write your own workflow and tool that would allow users to self-enroll certificates and push a copy of the key to internal CA database. There is no easy solution. – Crypt32 Feb 26 '19 at 17:28
  • @Crypt32, thanks for tuning in - I guess if you are not aware of such a solution then it really doesn't exist :-) In a related note - does PSPKI support CA escrow storage, or the only way is still to use certutil? – StanTastic Mar 5 '19 at 8:43
  • 1
    I bet, certutil is a reliable solution for your task. Use it. – Crypt32 Mar 5 '19 at 9:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.