# Security - Code Signing Enroll User For Different Domain

This is how to enroll into a cert from the users computer.

#### How Users Enroll for Certificates with Custom ("Different") Domain Name

Users with Enroll permission can now request a certificate:

**Option A – Using MMC (easiest for testing)**

1. Run certmgr.msc (Current User).
2. Right-click **Personal** → **All Tasks** → **Request New Certificate**.
3. Select your enrollment policy (Active Directory Enrollment Policy).
4. Choose your new template.
5. When prompted, click **Details** → **Properties**.
6. On **Subject** tab: Enter custom values (e.g., Common name = "OtherDomain Code Signing Authority").
7. On **Subject** tab: Enter custom values (e.g., Organtization = "SFL Services LLC").
8. On **Subject** tab: Enter custom values (e.g., Locality = "Loveland").
9. On **Subject** tab: Enter custom values (e.g., State = "Ohio").
10. On **Subject** tab: Enter custom values (e.g., Country = "US").
11. On **Extensions** tab: Add SAN if needed (e.g., email=<signing@otherdomain.com>).
12. Enroll.

**Using certreq.exe (scriptable / automated)** Create an .inf file:

<div dir="auto" id="bkmrk-codesign-request.inf"><div data-testid="code-block"><div><div><div><div>codesign-request.inf</div></div></div><div>  
</div></div></div></div>```powershell
[Version]
Signature="$Windows NT$"

[NewRequest]
Subject = "CN=Code Signing, O=SFL Services LLC, L=Loveland, S=Ohio, C=US"
; You can make Subject empty if you prefer only SAN / no CN, but most code signing tools expect a CN
KeySpec = 1
KeyLength = 4096                   ; 3072 or 4096 is strongly recommended in 2025+
Exportable = TRUE                  ; Usually yes for code signing
MachineKeySet = FALSE              ; User context (most common for code signing)
SMIME = FALSE
PrivateKeyArchive = FALSE
UserProtected = FALSE
UseExistingKeySet = FALSE
ProviderName = "Microsoft Enhanced RSA and AES Cryptographic Provider"
ProviderType = 24
RequestType = PKCS10
KeyUsage = 0x80                    ; digitalSignature = required for code signing

[EnhancedKeyUsageExtension]
OID=1.3.6.1.5.5.7.3.3              ; Code Signing EKU

; Optional: if you really want to add DNS SANs (rare for pure code signing)
[Extensions]
2.5.29.17 = "{text}"
_continue_ = "dns=www.sflservicesllc.com&"
_continue_ = "email=sales@sflservicesllc.com"
```

Then:

<div dir="auto" id="bkmrk-create-a-powershell-"><div data-testid="code-block"><div>Create a powershell script **createCert.ps1**, Run the script</div></div></div><div id="bkmrk-note%3A-change-the-tem">**Note:** Change the template name to the name you chose when creating [HERE](https://docs.sflservicesllc.com/books/security/page/security-create-a-code-signing-template "Code Signing Template Create") it with no spaces.</div>```powershell
certreq -new codesign-request.inf codesign.csr
certutil -dump codesign.csr
certreq -submit -attrib "CertificateTemplate:YourTemplateName" codesign.csr codesign.cer
certreq -accept codesign.cer
certutil -store my
```