Configure certificate auto-enrollment

Ubuntu Pro

This feature of ADSys requires an Ubuntu Pro subscription.

Certificate auto-enrollment is a key component of Ubuntu’s Active Directory GPO support. This feature enables clients to seamlessly enroll for certificates from Active Directory Certificate Services.

Enrollment method

ADSys supports two certificate enrollment methods. Set the method in /etc/adsys.yaml:

# LDAP/RPC enrollment - recommended
certificate_enrollment: ldap

# Legacy CEPCES enrollment — kept for backwards compatibility; used as default if the certificate_enrollment setting is empty or missing
# certificate_enrollment: cepces

See Set up certificate auto-enrollment for the package requirements of each method.

Rules precedence

Auto-enrollment configuration will override any settings referenced higher in the GPO hierarchy.

Policy configuration

Certificate auto-enrollment is configured by setting the Configuration Model to Enabled and ticking the following checkbox: Update certificates that use certificate templates.

Certificate GPO properties

The policy can be disabled by performing any of the following:

  • Unticking the Update certificates that use certificate templates checkbox

  • Setting the Configuration Model to Disabled or Not configured

The other settings in this GPO entry do not affect ADSys in any way.

For more advanced configuration, a list of policy servers can be specified in the following GPO entry:

  • Computer Configuration > Policies > Windows Settings > Security Settings > Public Key Policies > Certificate Services Client - Certificate Enrollment Policy

Certificate advanced configuration

Applying the policy

On the client system, a successful auto-enrollment will place certificate data in the following paths:

  • /var/lib/adsys/certs - CA certificates and enrollment state

  • /var/lib/adsys/private/certs - native LDAP matched leaf/private-key generations

  • /usr/local/share/ca-certificates - root certificate data (symbolic link pointing to /var/lib/adsys/certs)

With the native LDAP method, ADSys tracks the files it created in /var/lib/adsys/certs/state_*.json. Certificates are not registered with certmonger. Use adsysctl certificate to manage them; see Manage enrolled certificates.

With the legacy CEPCES method, certmonger tracks certificates and can be queried directly:

# Query monitored certificates
> getcert list
Number of certificates and requests being tracked: 1.
Request ID 'galacticcafe-CA.Machine':
 status: MONITORING
 stuck: no
 key pair storage: type=FILE,location='/var/lib/adsys/private/certs/galacticcafe-CA.Machine.key'
 certificate: type=FILE,location='/var/lib/adsys/certs/galacticcafe-CA.Machine.crt'
 CA: galacticcafe-CA
 issuer: CN=galacticcafe-CA,DC=galacticcafe,DC=com
 subject: CN=keypress.galacticcafe.com
 issued: 2023-08-18 18:44:27 EEST
 expires: 2024-08-17 18:44:27 EEST
 dns: keypress.galacticcafe.com
 key usage: digitalSignature,keyEncipherment
 eku: id-kp-clientAuth,id-kp-serverAuth
 certificate template/profile: Machine
 profile: Machine
 pre-save command:
 post-save command:
 track: yes
 auto-renew: yes

# Query known CAs
> getcert list-cas
(...)
CA 'galacticcafe-CA':
 is-default: no
 ca-type: EXTERNAL
 helper-location: /usr/lib/certmonger/cepces-submit