On Fri, Dec 21, 2018 at 03:27:59PM +0800, fu-hong-quan@pacific-textiles.com wrote:

Hi,

I come across your blog and know that you're working on FreeIPA and dog tag PKI. So as we know MS CA is pretty good PKI and it's powered by Group Policy of

Active Directory, user is easy to request, issue and renew a certificate. So my question is that does Dog tag has the same function? Issuing and renewing cert

for windows users? e.g sending a request when user's computer is and user is logging on?

-Thanks,

Hi, (Cc pki-users@redhat.com mailing list for visibility) I don't know enough about exactly what Windows does to request certs against AD. Ultimately it will depend on the enrolment protocol, what authentication mechanism is used, and so on. If you can find out more about that, or point me to documentation, I'll be better able to explain how Dogtag could meet the need (or not). Cheers, Fraser