For WSTEP enrollment, the enrollment service in Active Directory must use the following URL to communicate with Certificate Enrollment Gateway:

https://<CEG-server>:443/wstep/<auth>/services/<tenant-ID>/<CA-ID>

Where:

  • <CEG-server> is the hostname or IP address of the Certificate Enrollment Gateway server.
  • <auth> is the authentication method, either usertoken for user name and password authentication or kerberos for Kerberos (Windows integrated) authentication.
  • <tenant-ID> is the unique identifier of a tenant defined in Certificate Enrollment Gateway. The value is case-sensitive.
  • <CA-ID> is the CA ID of the Certificate Authority (CA) defined in CA Gateway that will issue certificates to the Windows endpoint.

For example, when authenticating with a user name and password:

https://cegserver1.example.com:443/wstep/usertoken/services/tenant1/example-ca1

For example, when authenticating with Kerberos:

https://cegserver1.example.com:443/wstep/kerberos/services/tenant1/example-ca1