A policy module to tame them all: Introducing the TameMyCerts Policy Module for Microsoft Active Directory Certificate Services
As the operator of a certification authority, you are (among other things) responsible for the identification of the enrollees and the confirmation of the requested identities . The fact that this task is carried out conscientiously and without error is the central pillar of the trust placed in the certification authority. Well-known companies have already failed at this task , even had to file for insolvency as a result of misissuances and/or were severely punished by the big players in the market.
In many cases, we as (Microsoft) PKI operators in companies (regardless of the associated quality) are able to delegate our task of uniquely identifying an enrollee to the Active Directory. In many cases, however, we unfortunately also have to instruct our certification authority(ies) to simply issue everything that is requested.