title: Web Service client certificates and AD certificate mapping
body: <p>This is my first question here at SO, so if it's not up to standard or out of place or anything, please let me know and I'll try and fix.</p>
  
  <p>I'm in the process of finding the optimal solution for the following scenario. I have a Windows Server 2008 domain holding a fair amount of users. Some of those users need to be able to connect to a WCF Service over the Internet; the WCF Service resides in the domain. I want these users to use client certificates for authentication, and I want to be able to map these certificates to their AD account. Those users, or another user on their behalf, should be able to obtain a certificate through a web interface. Certificate provisioning should be fully automated.</p>
  
  <p>My question is this: would this scenario involve setting up AD Certificate Services, or can I create and distribute self-signed certificates for the users needing them?</p>
  
  <p>The AD Certificate Services solution seems like a more extensive setup requiring more work. Also, I don't see any future scenarios where a full-blown PKI can come in handy. The self-signed certificates option seems to be the more practical solution. On the other hand, if this solution requires me to place every single certificate in the Trusted Persons store of the server hosting the WCF Service, it would soon become a major administrative burden. (Not sure if that's required, though, since I'm mapping the certificate to the AD user.) Also, automating this solution seems a little more complex, based on an afternoon of searching the web. And of course, the certificates would be self-signed, but assuming the distribution channel is safe, this does not seem to be an issue.</p>
  
  <p>So, in short: I want to do this the proper way, but I don't want to over-engineer the solution. Any ideas on the route I should take? Thanks in advance for any advice.</p>