Generate Device Cerificate

Question

Generate Device Cerificate

Handian Sudianto 7,441

Cuurenly we deploy device certificate from intune where intune will contact CA server on onprem and intune push the deployment to the endpoint.

Now for testing purpose i want to deploy the certificate to non intune device, so how we can generate the certificate manually so i can download and install to the endpoint manually.

0 comments

2 answers

Your answer

Answer 1

Allan Solomon Mejia 7,995

Hello @Handian Sudianto

Yes, you can manually enroll a certificate from your on-premises AD CS CA for testing, provided the certificate template allows the test user/device to enroll.

On the non-Intune Windows device:

Run mmc.exe.
Add the Certificates snap-in and select Computer account → Local computer.
Go to Certificates (Local Computer) → Personal → Certificates.
Right-click and select All Tasks → Request New Certificate.
Follow the Certificate Enrollment wizard and select the same or an equivalent certificate template used for the device certificate.

This requires the device to be able to reach the CA and the requesting identity to have Enroll permission on the certificate template.

If the test device isn't domain joined or can't use normal AD CS auto/enrollment, you can also use the Certificate Enrollment Web Service/Policy Web Service or create a certificate request (.req) and have the CA issue it manually, depending on how your PKI is configured.

One important point: if your current Intune deployment uses SCEP/NDES, you generally shouldn't try to extract or reuse an Intune-issued certificate. For testing, issue a separate certificate from an appropriate AD CS template instead.

If you can confirm whether your Intune certificate profile uses SCEP or PKCS, we can provide the closest manual enrollment method to reproduce the same certificate.

Please "Accept the Answer" if this information helped you. This will help us and others in the community as well.

Handian Sudianto 7,441 Reputation points

2026-08-14T08:04:32.39+00:00

hi @Allan Solomon Mejia

I sue PKCS and when request to enroll then how i can know the policy server UI?
Allan Solomon Mejia 7,995 Reputation points

2026-08-14T14:23:01.1566667+00:00

Hello @Handian Sudianto

Since you’re using Intune PKCS, you normally do not need to enter a Certificate Enrollment Policy Server URL on the test device. That dialog is for AD CS Certificate Enrollment Policy Web Service (CEP), which is separate from the Intune PKCS Certificate Connector.

For a manual test, if the device is domain-joined and can reach AD CS, use:

certlm.msc → Personal → Certificates → All Tasks → Request New Certificate → Active Directory Enrollment Policy

Then select the same (or equivalent test) certificate template used by your PKCS deployment and enroll it. Microsoft documents this manual enrollment approach using the built-in Active Directory Enrollment Policy.

If the device is not domain-joined, you would need another enrollment mechanism such as CEP/CES or CA Web Enrollment. You can’t derive the CEP URL from the Intune PKCS profile. The CEP service must already be installed and configured in AD CS.

References:

Microsoft Learn – Certificate Enrollment Policy Web Service | https://learn.microsoft.com/en-us/windows-server/identity/ad-cs/configure-certificate-enrollment-policy-web-service?

Microsoft Learn – Intune PKCS troubleshooting | https://learn.microsoft.com/en-us/troubleshoot/mem/intune/certificates/troubleshoot-pkcs-certificate-profiles?

Please "Accept the Answer" if this information helped you. This will help us and others in the community as well.
Handian Sudianto 7,441 Reputation points

2026-08-14T14:38:10.8866667+00:00

Hi @Allan Solomon Mejia

I use onprem Microsoft CA on AD server to generate the certificate. PKCS i mean is i create the PKCS policy from intune for all intune devices. Now i want to install the certificate manually for some non intune devices and want to know how to create the certificate manually.
Allan Solomon Mejia 7,995 Reputation points

2026-08-14T14:49:08.8+00:00

Hello @Handian Sudianto

Please see my comments above.

Answer 2

Hi @Handian Sudianto

Thanks for clarifying. Since your goal is simply to manually issue a certificate from the same on-prem AD CS CA for a non-Intune test device, you don't need to reproduce the Intune PKCS process itself.

If the test device is domain-joined and can reach the CA, you can manually enroll using:

certlm.msc → Personal → Certificates → All Tasks → Request New Certificate → Active Directory Enrollment Policy

Select the certificate template that your Intune PKCS profile uses, assuming the test user/computer has Read and Enroll permissions on that template.

If the device is not domain-joined, another straightforward option is to generate a certificate request (.req) using certreq, submit it to the CA, then install the issued certificate. This keeps the test separate from Intune while still using your existing CA and certificate template.

The key is to use the appropriate AD CS certificate template, rather than trying to manually invoke the Intune PKCS connector.

Please don't forget to "Accept the Answer" if this information helped you. This will help us and others in the community as well.