ADCS

Instead of using its Internal CA, Signotaur can delegate certificate issuance to Active Directory Certificate Services (ADCS), Microsoft's enterprise PKI. When ADCS is used as the issuer, Signotaur builds a certificate request, submits it to ADCS, and records the certificate and chain that ADCS returns. The certificate hierarchy, validity periods, and key policies are all governed by ADCS.

This is the right choice for organisations that already operate ADCS: client machines that already trust the enterprise Root through Group Policy will automatically trust everything Signotaur issues, with no separate root distribution.

ADCS is disabled by default. Enabling it requires a service restart.

Prerequisites

Before configuring ADCS, confirm the following on your ADCS deployment:

Certificate templates are published for the certificate types you intend to issue. By default Signotaur requests the WebServer template for web certificates and the CodeSigning template for code-signing certificates; you can change these template names in Signotaur's settings.
The account Signotaur uses has Enrol permission on those templates.
For the CertSrv transport, the ADCS Web Enrolment role is installed and reachable over HTTPS.

Choosing a Transport

Signotaur can talk to ADCS over one of two transports. Choose based on where the Signotaur server runs and how your CA exposes itself:

	DCOM	CertSrv
Protocol	The ADCS COM API (`ICertRequest`)	The ADCS Web Enrolment site (`/certsrv/`) over HTTPS
Platform	Windows only	Cross-platform
Requires	Network access to the CA's DCOM endpoints	The Web Enrolment role, reachable over HTTPS
Typical use	Signotaur server is domain-joined and on the same network as the CA	Signotaur reaches the CA only over HTTPS, or the CA is accessed across a network boundary

A third transport, CES (Certificate Enrolment Web Services), is reserved for a future release.

DCOM

For the DCOM transport, Signotaur needs the CA configuration string: the CA's identity in hostname\CAName format, for example:

ca.example.com\Example Issuing CA

The account Signotaur authenticates as must have Enrol permission on the requested template.

CertSrv

For the CertSrv transport, Signotaur needs the endpoint URL of the ADCS Web Enrolment site, for example:

https://ca.example.com/certsrv/

The CertSrv transport requires HTTPS. The Windows authentication schemes ADCS Web Enrolment uses (Negotiate / NTLM) are not sent over plain HTTP by Signotaur's HTTP client, so a http:// endpoint will fail to authenticate. Bind an HTTPS certificate to the ADCS Web Enrolment site and use an https:// endpoint URL.

If the ADCS Web Enrolment site presents a TLS certificate that does not chain to a root trusted on the Signotaur server, you can enable Allow untrusted certificates so Signotaur accepts it anyway. The hostname must still match the certificate. This setting is ignored for the DCOM transport.

Authentication

Signotaur can authenticate to ADCS in one of two ways:

Integrated authentication (default): Signotaur authenticates as its own Windows service account. The service account must be able to enrol against the target templates. This is the simplest option when the Signotaur server is domain-joined.
Explicit credentials: a username and password you supply. The password is stored encrypted in the configuration. Use this when the service account cannot be granted enrolment rights directly, or when the CA is in a different domain.

Testing the Connection

The ADCS settings tab provides a Test Connection button. It performs a read-only connectivity and authentication check (it does not request or consume a certificate) and reports an actionable message if the endpoint is unreachable, the credentials are rejected, or the configuration is incomplete. Use it after entering or changing the ADCS settings, before issuing a real certificate.

Configuring ADCS

ADCS is configured from the ADCS tab of the Managed Certificates admin page. The tab is shown only when ADCS is enabled. It covers the connection settings (transport, endpoint or CA configuration, credentials) and the per-certificate-type issuance defaults (template names and additional SANs). See the ADCS settings tab for a field-by-field reference.

The validity period and key size of certificates issued by ADCS are determined by the ADCS certificate template, not by Signotaur. Signotaur's validity and key-size settings apply only to the Internal CA.