Set up certificate auto-enrollment

Ubuntu Pro

This feature of ADSys requires an Ubuntu Pro subscription.

Certificate auto-enrollment is a key component of Ubuntu’s Active Directory GPO support. This feature enables clients to seamlessly enroll for certificates from Active Directory Certificate Services.

The certificate policy manager allows clients to enroll for machine certificates from Active Directory Certificate Services. The native LDAP method writes certificates and private keys directly to disk; the legacy CEPCES method delegates tracking and refreshes to certmonger.

Unlike the other ADSys policy managers which are configured in the special Ubuntu section provided by the ADMX files (Administrative Templates), settings for certificate auto-enrollment are configured in the Microsoft GPO tree:

• Computer Configuration > Policies > Windows Settings > Security Settings > Public Key Policies > Certificate Services Client - Auto-Enrollment

Prerequisites

Active directory

You will need an installation of ADSys on a client Ubuntu Machine and the client should be joined to an Active Directory (AD) domain. Please refer to our how-to guides on setting up the Ubuntu client machine:

• Join machine to AD during installation

• Join machine to AD manually

• Install ADSys

For the Windows domain controller, refer to:

• Set up AD

Required packages

The required packages depend on the certificate enrollment method configured in /etc/adsys.yaml.

LDAP enrollment

No additional client package is required beyond ADSys.

On the Windows side, the Certification Authority role is required, and domain controllers must accept LDAP StartTLS. The domain controller’s StartTLS certificate does not need to be trusted by the Ubuntu client in advance: on the first enrollment ADSys bootstraps trust through the mutually authenticated Kerberos channel and then installs the discovered CA, so subsequent refreshes verify the certificate chain normally.

The client must be able to reach, through any intermediate firewall:

• the domain controllers on TCP port 389 (LDAP with StartTLS), in addition to the Kerberos ports already required for domain membership,

• the certificate authority on TCP port 135 and its dynamic RPC ports (MS-ICPR enrollment endpoint).

CEPCES enrollment

The following packages must be installed on the client:

• certmonger — daemon that monitors and updates certificates

• python3-samba — Samba Python bindings

• python3-cepces — CEPCES helper for certmonger

sudo apt install certmonger python3-samba python3-cepces

On the Windows side, the following roles must be installed and configured:

• Certification Authority

• Certificate Enrollment Policy Web Service

• Certificate Enrollment Web Service