Not every enrolment should issue the moment it is requested. Skyrsoft CertOps can queue a request for a person to review, or let it through automatically under rules you write, and every enrolment path runs through the same engine to get there — agents, SCEP, EST, the REST API and the self-service portal alike.
How it works
A request arrives, the template’s own policy is checked, request validation runs if the template has any bound, and only then does the approval engine decide: auto-approve, auto-reject, or leave it for a person. A request that matches no rule at all falls through to Manual Approvals, unresolved, rather than being silently dropped or silently issued.
Manual approvals
Admins and approvers see the pending queue and can approve — optionally overriding the issuing CA for that one request — or reject with a required comment. A licence cap, a template-policy violation and a CA error each surface as their own distinct error rather than a generic failure.
Approval rules
Rules are evaluated in priority order, lower priority number first, and can match on an FQDN pattern, a subject pattern, the template, the protocol (agent, SCEP, EST, API or portal), and a source IP range. A matched rule then auto-approves or auto-rejects, optionally pinning the issuing CA. Free licences allow up to two approval rules; Pro is unlimited.
A catch-all rule at the end of the list is a deliberate policy choice, not something every deployment needs — without one, anything that does not match an auto-approve rule simply waits in Manual Approvals, which is the safer default for most environments. Pairing an auto-approve rule with a template that has no AD request validation bound to it means anyone who can reach the enrolment endpoint gets issued a certificate under that template; that is workable for a controlled lab subnet, but there is no directory check standing behind the rule’s own criteria in that configuration. Narrow the FQDN pattern or the source IP range before widening it any further.
Limits
Saving an approval rule does not check that what it names exists. The template and issuing CA
a rule points at are stored with no existence check at save time — a typo or a stale reference is
accepted rather than rejected. Review a rule’s Template and Issuing CA fields yourself after
saving it.
A null template on an auto-approve rule means “match any template,” and that is by design, not
a bug. A broadly scoped auto-approve rule — a wide FQDN pattern, no template set — approves
whatever reaches it under whichever template the request happens to claim. Scope auto-approve
rules deliberately: a narrow FQDN pattern or source IP range, and a named template, rather than
relying on the save step to catch a rule that is broader than intended.
FQDN and subject patterns are regular expressions, not globs. A rule written with * to match
anything is an invalid regular expression and silently never matches; write .* instead.
Turning on approval enforcement changes what a queued SCEP or EST request looks like to the client, not just to the admin reviewing it. Both protocols cover their own retry behaviour on their own pages.