Troubleshoot certificate auto-enrollment

Ubuntu Pro

This feature of ADSys requires an Ubuntu Pro subscription.

Certificate auto-enrollment is a key component of Ubuntu’s Active Directory GPO support. This feature enables clients to seamlessly enroll for certificates from Active Directory Certificate Services.

Some dependencies are not available in the client Ubuntu installation

The native LDAP method does not require additional client packages beyond ADSys. It does require domain controllers to accept LDAP StartTLS. The domain controller’s certificate does not need to be pre-installed in the Ubuntu client’s trust store: on the first enrollment ADSys trusts the authenticated Kerberos channel to bootstrap trust, installs the discovered CA, and verifies the full certificate chain on subsequent refreshes.

The legacy CEPCES method requires certmonger, python3-samba, and python3-cepces.

Inspecting enrolled certificates

With the native LDAP method, certificates enrolled by ADSys are machine-scoped and are not tracked by certmonger. They are laid out on disk as follows:

  • /var/lib/adsys/certs - CA certificates and the JSON enrollment state

  • /var/lib/adsys/private/certs - the matched leaf and private key generations

  • /usr/local/share/ca-certificates - symlinks to the root CAs installed in the system trust store

The enrollment state at /var/lib/adsys/certs/state_$(hostname).<object-id>.json records the CA, template and file paths of every enrolled certificate, and openssl x509 -noout -text -in <certificate> inspects the certificate itself.

adsysctl certificate reports the same information without reading those files by hand; see Manage enrolled certificates. list, status and verify diagnose an enrollment, and verify --online additionally attempts a CRL revocation check:

> sudo adsysctl certificate verify galacticcafe-CA.Machine.a1b2c3d4e5f6
Certificate 'galacticcafe-CA.Machine.a1b2c3d4e5f6': PASS
  chain: yes
  validity: yes
  key matches certificate: yes

With the legacy CEPCES method, certificates are managed by certmonger. While not encouraged, they can be manipulated with the same tool. This could be helpful for debugging purposes.

# Regenerate a certificate
> getcert rekey -i galacticcafe-CA.Machine
Resubmitting "galacticcafe-CA.Machine" to "galacticcafe-CA".

# Unmonitor a certificate
> getcert stop-tracking -i galacticcafe-CA.Machine
Request "galacticcafe-CA.Machine" removed.

# Remove CA
> getcert remove-ca -c galacticcafe-CA
CA "galacticcafe-CA" removed.

Errors communicating with AD CS

For native LDAP enrollment, check ADSys logs for LDAP, Kerberos, and MS-ICPR errors.

For CEPCES enrollment, also check certmonger logs (journalctl -u certmonger).

Additional information

While configuring Active Directory Certificate Services is outside the scope of the policy manager documentation, we have found the following resources to be useful:

We also provide a comprehensive list of relevant external resources.