Although a certificate
can be generated for both a member and a non-member, it is not recommended to
configure domain members this way. It is much more efficient to configure the group
policy autoenrollment, which automatically distributes the proper certificates to computers
that are members of an Active Directory domain. To manually add the certificate to
the client, perform the following steps:
1. From the VPN client, open Internet Explorer, and browse to the certificate web
enrollment page. By default, this is http://
/certssrv.
NOTE
The VPN client must access the web enrollment page from a network that has access
to it??”that is, is not being blocked by a firewall. Because web enrollment is a particularly
sensitive service, it is not common to make it available through the Internet or
through untrusted networks.
2. Select the Request a Certificate task.
3. Select Advanced Certificate Request.
4. Select Create and Submit a Request to This CA.
5. From the Certificate Template drop-down, select Configuring the Enterprise Root CA.
6. Enter the name of the VPN client. This name must match the actual machine name.
Pages:
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449