[Pki-users] Inquiry: Can Dog Tag issue a ceritificate for windows users and computers?

[Fraser Tweedale]

On Fri, Dec 21, 2018 at 03:27:59PM +0800, fu-hong-quan at pacific-textiles.com wrote:
> Hi,
> 
>  I come across your blog and know that you're working on FreeIPA and dog 
> tag PKI. So as we know MS CA is pretty good PKI and it's powered by Group 
> Policy of
> 
> Active Directory, user is easy to request, issue and renew a certificate. 
> So my question is that does Dog tag has the same function? Issuing and 
> renewing cert 
> 
> for windows users? e.g sending a request when user's computer is and user 
> is logging on?
> 
> -Thanks,
> 
Hi,

(Cc pki-users at redhat.com mailing list for visibility)

I don't know enough about exactly what Windows does to request certs
against AD.  Ultimately it will depend on the enrolment protocol,
what authentication mechanism is used, and so on.

If you can find out more about that, or point me to documentation,
I'll be better able to explain how Dogtag could meet the need (or
not).

Cheers,
Fraser