Mastering Active Directory

Certificate Enrollment Policy Web Service

This role service works with Certificate Enrollment Web Service and allows user, computers, or services to perform policy-based certificate enrollment. Similar to the enrollment web services, the client computers can be non-domain joined computer or domain-joined devices, which are out of the company's network boundaries. When a client requests for policy information, the enrollment policy web service queries the AD DS using LDAP for the policy information, and then deliver it to the client via HTTPS. This information will be cached and used for similar requests. Once the user has the policy information, then he/she can request the certificate using Certificate Enrollment Web Service.