An environment had two Windows Certificate Authorities, publishing a computer certificate via auto-enrollment for DirectAccess authentication.
- Customer CA 1
- Customer CA 2
The Certificate authorities needed operating system to be upgraded, so two new CAs were created, these had same name as previous CA but with v2 added to name:
- Customer CA v2 1
- Customer CA v2 2
The previous Certificate Authorities were not decommissioned and remain online.
Now when client applies for auto-enrolment certificate it seems to randomly get certificate from old CA "Customer CA" or new CA "Customer CA v2"
Direct Access authentication only works when certificate is obtained from old "Customer CA"
Checking Direct Access remote access configuration can see it is configured to use old Customer CA, but it appears to only be able to select one certificate.
What are some ways this issue can be remediated?
My thoughts on some options:
1) Is there a way to ensure auto-enrolment occurs from both old CA and new CA, either via group policy or script?
2) Decomission Customer CA 1 & 2. Point Direct Access to Customer CA v2 certificate.
3) Allow certificates from Customer CA or Customer CA v2 in direct access, if this is possible. Can not immediately see how this could be achieved.
4) Redo the upgrade process in a way that ensures the new & old certificate is trusted by Direct Access. Unsure what this process may involve if possible.
Note: I was in no way have been involved in the CA upgrade process, I am looking at this after the fact.