I'm doing certificate-based authentication using windows server 2012. I've set up the CA, NDES and now, when I request a certificate using the SCEP Challenge password, I'm able to receive the certificate, but in AD, the certificate keeps mapping to the wrong user.

Let me explain briefly. While setting up NDES, I added an IIS_IUSRS user (let's say "ndes_user") and also added this user to Domain Admins and Domain Users group. And for test purpose, I created another user (let's say "test_user") and added this user to Domain User group only.

Now, in CSR, I added SubjectAlternativeName (test_user) for mapping the certificate to the respective user in the AD. But, the certificate is mapping to "ndes_user" and not "test_user".

(If it helps), In the certificate template, for the subject name, I chose "Build from Active Directory" and chose "User Principal name".

My doubt is "Based on what attributes in CSR, does the certificate maps to the respective user in AD? Is it SubjectAlternativeName".

My question is "What changes should I make to map the "CA issued certificate" to the respective user in AD".

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.