Skip to main content
Flexible Top Header
Question

Automatic Cert Enrollment / DNS architecture question

  • July 30, 2026
  • 1 reply
  • 22 views
S

Good evening,

 

As the powers that be push us towards shorter and shorter certificate durations, large enterprise grapples with certificate management . We were previously using Microsoft native for workstations / servers / laptops which was working ok with a few shortcomings.

The responsible team looked at other ‘enterprise’ solutions and ultimately picked Venafi by Palo (previously CyberArk). We have run into a seemingly insurmountable issue impacting only laptops that roam between sites that have differing deployment options for the DNS and DDNS zone names. I.E. Execs travel to hospitals or local managers travel to system office, etc.

At it’s home site, the device gets a zone name (via deployment option) of acme.com (the parent). The device gets it’s cert and all is good with a FQDN of device123.acme.com. Device then travels to the Ann Arbor site and is handed a deployment option for the zone of aa.acme.com.

Now the fun starts: Device cert happens to expire while at remote site and attempts to get new cert but is unable because now the updated FQDN of the device is device123.aa.acme.com and the cert server (AEC) refuses due to FQDN mismatch.

So here are my couple of questions for the brain trust:

  1. Palo confirmed that this is working as expected. Their engineers specific to the PKI product set (not 1st level) seemed bewildered at the concept of parent / child DNS zones. We are a very large enterprise and have utilized parent w/ delegated child zones for 25+ years. I know that I do run into some folks that are in the ‘throw it all in one domain’ camp but require the ability to administratively segment control of each hospital system across the nation as only one of the several drivers and have architected our forward and reverse DNS architecture with local XHA pairs at each hospital. I guess I’m looking for feedback on how many folks leverage the parent / child architecture today. Palo called it a ‘corner case’ which literally made me laugh out loud.
  2. Has anyone implemented auto enrollment and management (renewal) of certs on laptops using ANY product where the laptops roam across different child zones? Can you please share your experience?

Thanks in advance for any thoughts.

    1 reply

    L
    • lukas.weber
    • Consistent Uptimer
    • August 3, 2026

    Calling delegated parent/child DNS zones a "corner case" seems odd. This is a very common enterprise design, especially in healthcare, higher education, government, and other large distributed organizations where administrative delegation is required.

    The real issue appears to be that the certificate identity is tied to the device's current FQDN rather than a stable identity. A roaming laptop changing its DNS suffix is a perfectly valid operational scenario. I'd be looking for a solution that supports renewal based on the device's AD identity, machine SID, or another persistent identifier, rather than rejecting renewal because the DNS suffix changed.

    I'm curious whether others using Venafi, Keyfactor, EJBCA, or Microsoft Intune/NDES have encountered this and how they addressed it.

    Terms & ConditionsAccessibility statement