I'm trying to crack the following nut: I have a contract with Digicert for S/MIME certificates for my org. Digicert allows to use their API for cert issuance.
Unfortunately I can't let users self-enroll, because I need to store their encryption keys.
To date, I'm generating their keypairs myself on dedicated machine, sign CSR on Digicert site, upload the private key to escrow on local CA, then send all to end-user.
What I would prefer, though, is to never touch user's private key. This is possible with Active Directory autoenrollment, but I can't autoenroll with Digicert.
Any ideas how to marry those two worlds?