Create the autoenrollment certificate profile

Sign in to DigiCert ONE and go to DigiCert​​®​​ Trust Lifecycle Manager.

Select Policies > Certificate profiles from the main menu.

Select Create profile from template.

Select the certificate template for the type of certificate you need.

Under the General information section, enter the profile Nickname and choose the Business Unit and issuing CA.

From the Enrollment method dropdown, select Microsoft Autoenrollment.

Select the desired Enrollment mode radio button:

Select keystore provider options to set the cryptographic provider that can be used for requests. The available options are:

Select the Allow private key to be exported checkbox under Other options if you want users to export their certificates and private keys.

Select Publish certificate to Active Directory to allow certificates to be published to your Active Directory.

Once you select Yes, you must assign a special permission to the Autoenrollment Server to allow certificate publishing. Refer to “Allow Publishing to Active Directory” for more details.

Select Next.

Under Certificate fields, select the validity period unit (Years, Months, or Days) and enter the value in the textbox.

Select the Algorithm from the available algorithms in the dropdown list. Available algorithms are based on the issuing CA selected for the profile.

Select the Key type and attribute from the dropdown lists.

Select the checkbox to Allow duplicate certificates if multiple certificates are to be issued for the same seat ID.

Under Renewal options, select the Renewal window from the dropdown list. The default (recommended) value is 30 days.

Select Subject DN and SAN fields from the dropdown list. Select as many fields as required for your certificates, then select Add fields.

For each selected field, select the required source from the Source for the field’s value dropdown. The available options include Active Directory attribute, Fixed value, and From CSR. The Active Directory attribute option is the default value.

For Subject DN fields that support multiple values, select Add and specify the source and Active Directory attribute for each additional entry.

Specify which certificate fields are mandatory using the Required checkbox.

Specify the Active Directory attribute with multi-valued strings using the Multiple checkbox.

The SAN fields allow multiple values to be added for each. Select the Add link and specify the source and value for each additional field. This is shown for RFC822 Name (Email) below but also applies for Other Name (UPN) and Other Name (Custom) fields.

Specify the Key usage (KU) extension criticality and values. Note that the KU options shown differ depending on the certificate template being used.

Specify the Extended key usage (EKU) extension criticality and values.

Under Certificate delivery format, select the certificate format to use and chain certificates to include when certificates are issued.

Under Email configuration & notifications, specify the template to be used for certificate revocation notification emails.

Under Administrative contact, specify whether to include default or custom administrative contact details in certificate notification emails. Note that including internal support contact details for end users is optional but recommended.

Under Seat ID Mapping, select the certificate field to be used as the seat ID. This uniquely identifies each enrollment entity, for licensing purposes.

Under Service User binding, select the Service user API token to be bound to the certificate profile. If no Service user is selected from the dropdown, then all API tokens in the account will be able to manage this profile.

Select Create. The newly created certificate profile is displayed in the certificate profiles list.