Roaming Credentials Question for Server 2008 and XP

thutzler · 12-23-2008, 02:30 PM

First off, if this is not the correct forum to post this question I appologize. If not, then please direct me to the correct forum and I will post this message there.

We recently decided to strat using digital signatures and electronic forms. To create and view the forms we chose Adobe Acrobat 9 Pro. For creating digital signatures we installed a Certificate Authority (CA) on one of our 2008 servers which is running IIS.

After much fun we got the CA running, and Adobe Acrobat and reader to be able to validate signatures etc. We were almost ready to roll it out but we wanted to simplify the process of getting the certificates to the users since many of our users have limited computing skills. So we are looking into using an enrollment agent, and roaming credentials. So far so good, we can request a cert on behalf of another user, and publish it to their AD account. Roaming Credentials downloads it to their computer and places it in the Active Directory User Object store. And that is where we run into a problem.

Acrobat and reader can only look for cert in the Windows personal, trusted root and trusted publishers stores and so does not see the certificates in the AD user object store.

Ultimately I want to be able to get the certificates to the users computers, and into their personal store without any user interaction. I am looking for ANY way to accomplish this. A script to copy the certs from the AD user object store to personal, or import the AD certs into the personal store, copy paste, ANYTHING to be able to get the certs to the users and to be able to be seen by Adobe. I have looked at capicom, and certmgr, along with some others but none of it seems to have what I need. Does anyone have any suggestions?

12-23-2008, 02:30 PM	#1 (permalink)
thutzler Registered User Join Date: Dec 2008 Posts: 1 OS: XP, Server 2008, Server 2003	Roaming Credentials Question for Server 2008 and XP First off, if this is not the correct forum to post this question I appologize. If not, then please direct me to the correct forum and I will post this message there. We recently decided to strat using digital signatures and electronic forms. To create and view the forms we chose Adobe Acrobat 9 Pro. For creating digital signatures we installed a Certificate Authority (CA) on one of our 2008 servers which is running IIS. After much fun we got the CA running, and Adobe Acrobat and reader to be able to validate signatures etc. We were almost ready to roll it out but we wanted to simplify the process of getting the certificates to the users since many of our users have limited computing skills. So we are looking into using an enrollment agent, and roaming credentials. So far so good, we can request a cert on behalf of another user, and publish it to their AD account. Roaming Credentials downloads it to their computer and places it in the Active Directory User Object store. And that is where we run into a problem. Acrobat and reader can only look for cert in the Windows personal, trusted root and trusted publishers stores and so does not see the certificates in the AD user object store. Ultimately I want to be able to get the certificates to the users computers, and into their personal store without any user interaction. I am looking for ANY way to accomplish this. A script to copy the certs from the AD user object store to personal, or import the AD certs into the personal store, copy paste, ANYTHING to be able to get the certs to the users and to be able to be seen by Adobe. I have looked at capicom, and certmgr, along with some others but none of it seems to have what I need. Does anyone have any suggestions?