I have installed 2 CA onto 2 Windows 2008R2 VM, one being an offline root CA and the other is intended to be the issuing CA. However I found that a DC (a 2008R2 VM) is requesting 2 certificates, namely Domain Controller Authentication and Directory Email Replication, (they are auto issued with expiration period of one year) on every reboot. I wonder if there is normal and would like to turn this 'feature' off, any idea?
SnapOverflow
Its normal for the DC to ask for a cert. It does this through autoenrollment. As long as the template is approved and the DC has the relevant permissions (read, enroll and autoenroll), it can autoenroll for a cert based on the template.
You could remove the template or edit the permissions if you dont want to issue it. Use the certificate management console as per http://technet.microsoft.com/en-us/library/cc772358.aspx to remove the template if you dont want to issue it.