Microsoft RPC/DCOM

History

The Microsoft Active Directory Certificate Services (ADCS), sometimes only called "Microsoft CA", is the Certification Authority software built into Windows Server. The software was originally developed at the end of the last millenium and continued to receive some additions for the next ten to fifteen years.

An alternative is Microsoft's SOAP or SCEP, which Microsoft calls Web Enrollment and NDES, respectively.

Specification and Adoption

We have no knowledge of other CA systems implementing this protocol, although Microsoft has published the specification in Microsoft OpenSpec in the meantime. On the client-side, Windows has built-in support of the protocol, other platforms are not supported.

Technology

Its main enrollment method is a proprietary protocol based on RPC or DCOM.

Autoenrollment also uses this protocol. For autoenrollment to work, you need

• a domain-joined device.

• Group policy enables autoenrollment,

• an Enterprise CA (as opposed to stand-alone)

• that enrolls a Certificate Template for which

• the user or device has the enrollment and autoenrollment permissions.

The default interval to check for autoenrollments is 8 hours, although it can be enforced with certutil -pulse or often better gpupdate -force.

Authentication

This protocol uses the authentication protocols built into Active Directory, i.e. users and computers authenticate with their AD credentials.