I am trying to enroll (on behalf of) a user certificate but certain fields appear to be missing in the subject field. Specifically, O and OU.
Using ADSI, I see that the fields have the values I want but when I generate the certificate using Enroll on Behalf, certreq.exe, or certmgr.msc (run as different user) O does not appear at all and OU values are the AD containers the user account belongs to. This occurs despite my specifying the values in my .inf for certreq and setting the values in certificate properties when using certmgr.msc.
Am I missing something or could I have configured something wrong? I am using an in internal CA.
Best Answer
A bit late but might help someone else.
If you are requesting certs based on a template, the template would be configured how to generate a subject on the cert. Specifically it will be configured either to read the properties from AD or accept the value specified in the request.
This looks like its configured to read the properties from AD. Therefore, the content in the request (be it the .inf or properties of request when using certmgr) will be ignored.
If you want to use the properties in the request you need to edit the template to not use the values from AD but use the properties in the request instead.