EAP-TLS proves that an endpoint holds a trusted private key. Excellent. Network policy still needs to know whether that endpoint is a workstation, kiosk, lab instrument, or something that should be allowed near the finance VLAN only in the broadest geographical sense.
You can teach RADIUS a mapping for every identity, hostname, or MAC address. You can put a live CMDB API call in every authentication. You can bend your Active Directory OU hierarchy around device purpose and hope the GPO consequences stay interesting rather than catastrophic. You can also declare segmentation overrated and go for lunch.
AD CS Enrollment Broker moves that policy step to certificate enrollment. It authenticates the requester, reads governed endpoint facts, and places only approved claims into a certificate issued by AD CS. RADIUS or another relying party can then validate the certificate and apply compact rules to those claims without depending on a live broker or inventory lookup for each authentication. The relying party still makes the final authorization decision.
The endpoint keeps its private key. The client cannot select its own subject, SAN claims, template, or issuer. The certificate carries a governed snapshot, so certificate lifetime, renewal, and revocation still matter. Fun is welcome; hand-waving is not.
See Why this exists for the problem, tradeoffs, and certificate- freshness model.
AD CS Enrollment Broker is a policy and registration-authority layer between native Windows certificate-enrollment clients and Microsoft Active Directory Certificate Services (AD CS). It implements the supported portions of MS-XCEP and MS-WSTEP, derives certificate identity from authoritative server-side facts, and submits restricted requests through AD CS enrollment services.
The broker supports three enrollment paths:
- domain computers authenticated with Kerberos;
- guarded bootstrap requests paired to an immutable asset by an authenticated technician;
- renewal authenticated with an existing broker-issued client certificate.
All paths validate proof of possession and replace client-supplied identity with broker policy. The returned certificate is checked against the approved public key, subject, SAN set, EKU, key usage, chain, and revocation policy before it is released.
This snapshot contains product source, synthetic tests and publication-safe documentation. It intentionally excludes deployment records, private topology, operational evidence, credentials, certificate identifiers, and Git history.
- Documentation home, why this exists, and quick start
- System context and trust boundaries
- Component architecture
- Trust boundaries and durable state
- Protocol flows
- Deployment topology and rollback
- Docker Hub image and Compose
- Operations and troubleshooting
- Security model
- Threat model
- Security reporting
- Support policy
- Contribution guide
- License and attribution notice
- Third-party notices
- Release governance
- Configuration reference
- Build and test
- Glossary
- Protected-artifact image build
dotnet restore PkiProxy.slnx --locked-mode
dotnet run --no-restore --project tests/PkiProxy.PublicContractTests -c Release
dotnet publish src/PkiProxy.Api/PkiProxy.Api.csproj -c Release --no-restore \
/p:PathMap="$(pwd)=/_/src"The default application configuration exposes a loopback development listener
with enrollment disabled. A real deployment requires explicit authenticated
listener, directory, CA, signer, state-store, trust, and revocation settings.
Start from .env.example; its real application keys contain reserved placeholders
that startup rejects until an operator supplies reviewed deployment values.
Published releases can be pulled from
rovingclimber/adcs-enrollment-broker:
docker pull rovingclimber/adcs-enrollment-broker:latest
docker compose up -d --no-buildFor controlled deployments, use the attested version to discover the image and then pin its immutable digest. See the Docker Hub guide.
AD CS Enrollment Broker is licensed under the Apache License 2.0. Public release also requires completion of the public release checklist.