AD CS: Managing Network Device Enrollment Service

NDES uses two certificates, for signing and encryption. During setup certificates are requested for NDES based on the Exchange Enrollment Agent (Offline Request) and the CEP Encryption certificate templates, which are required during setup.

Any time after setup you can create custom service certificate templates for NDES.

To create custom service certificates:

1. Create two certificate templates for signing and encryption by duplicating the Exchange Enrollment Agent (Offline Request) and the CEP Encryption certificate templates. Follow the procedure described in Create a New Certificate Template. When prompted, select Windows Server 2003 for the minimum CA version. Make changes to the certificate template properties to meet your requirements.
   
   
2. Assign the new certificate templates to a CA. See Add a Certificate Template to a Certification Authority
   
   
3. Enroll for the new encryption and signing certificates from the NDES computer by using the Certificates snap-in for the computer account. See Add the Certificates Snap-in to an MMC and Request a Certificate.
   
   
4. Grant the NDES service account Read permissions on the private keys of both new certificates by using the Certificates snap-in for the computer account. In the Personal folder, right-click the new certificate, point to All tasks, and click Manage private keys. Allow Read access for the NDES service account.
   
   
5. Restart IIS.
   
   

To renew NDES service certificates:

1. Enroll for the Exchange Enrollment Agent (Offline Request) and the CEP Encryption certificates from the NDES computer by using the Certificates snap-in for the computer account. See Add the Certificates Snap-in to an MMC and Request a Certificate.
   
   

   Note
   If you are using custom service certificate templates, select those certificate templates instead of the default NDES certificate templates.

2. Grant the NDES service account Read permissions on both new certificates by using the Certificates snap-in for the computer account. In the Personal folder, right-click the new certificate, point to All tasks, and click Manage private keys. Allow Read access for the NDES service account.
   
   
3. Restart IIS.
   
   

A request from a device to NDES specifies whether the request is for an encryption certificate, a signing certificate, or a certificate for both encryption and signing.

By default, NDES uses the IPSEC (Offline Request) certificate template for all three types of device certificate requests.

NDES can be configured to use a custom certificate template for each type of device certificate.

To configure custom device certificate templates:

1. Create a certificate template by duplicating the IPSEC (Offline Request) certificate template. Follow the procedure described in Create a New Certificate Template. When prompted, select Windows Server 2003 for the minimum CA version. On the Request Handling tab, specify the certificate purpose based on the type of certificate your device requires: encryption, signing, or both encryption and signing. Make changes to the certificate template properties to meet your requirements. Ensure the NDES service account has Read and Enroll permissions on the template.
   
   
2. Assign the new certificate template to the NDES configured CA. See Add a Certificate Template to a Certification Authority
   
   
3. Specify the name of the new certificate template in the appropriate registry setting and restart IIS. Review the descriptions for the EncryptionTemplate, SigningTemplate, and SigningAndEncryptionTemplate in Configuring NDES.
   
   

Two components of NDES should be backed up: NDES registry settings and service certificates.

To back up NDES registry settings, start a command prompt, type the command reg export HKEY_LOCAL_MACHINE\Software\Microsoft\Cryptography\MSCEP <MSCEPBackup.reg>, and press ENTER.

To back up NDES service certificates, export the service certificates and their private keys from the NDES computer’s personal certificate store by using the Certificate Export wizard in the Certificates snap-in. See Export a Certificate with the Private Key.

You can identify NDES service certificates by the Key Usage extension on the Details tab, which has the value Certificate Request Agent. If there are multiple signing and encryption certificates in the certificate store with Key Usage equal to Certificate Request Agent, NDES uses the newest valid certificate.

Note
If you upgraded to NDES from MSCEP in Windows Server 2003, the service certificates might be in the CEP certificate store. Review Upgrading to NDES from MSCEP in Windows Server 2003 and CertsInMyStore setting description in Configuring NDES.

NDES stores its configuration in the registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Cryptography\MSCEP.

Some registry keys and values described in the table are not defined during NDES setup. The default values described in the following table are used when a setting is not defined.

To change NDES configuration, edit the NDES registry settings by using Regedit.exe or Reg.exe, then restart IIS. If necessary, create the key and value using the names and data types described in the following table.

AD CS: Network Device Enrollment Service in Windows Server 2008 R2

AD CS: Deploying Network Device Enrollment Service

AD CS: Troubleshooting Network Device Enrollment Service