Microsoft AD CS: Automate Certificate Enrollment & Renewal | TokenTimer

Connect Microsoft Active Directory Certificate Services to TokenTimer and automate certificate enrollment and renewal for IIS. This walkthrough takes you through the CertOps onboarding quickstart using an existing Microsoft CA and a domain-joined Windows server. From certificate template permissions to CA verification and scheduled renewal, follow the process through to the replacement certificate being served by IIS. In this video, you’ll learn how to: • Check certificate template settings and machine-account enrollment permissions. • Configure AD CS enrollment on an existing TokenTimer Windows agent. • Verify the CA certificate, confirm its fingerprint, and run a fresh check after pinning. • Create a renewal profile and attach it to the correct managed certificate. • Follow an automatic renewal through enrollment, Windows certificate installation, and IIS rebinding. • Verify the new certificate’s identity and expiration through an independent TLS connection. The demonstration uses a private Microsoft CA with immediate issuance. We also explain how CA approval requirements can affect the enrollment workflow. Explore TokenTimer: https://tokentimer.ch Documentation: https://tokentimer.ch/docs/