Add HTTP(S) web enrollment as alternative to RPC/DCOM

[dazzyddos]

In segmented environments where the CA's RPC/DCOM ports (135, 49xxx) are firewalled but HTTP(S) remains accessible, certificate enrollment fails. This adds a --web flag that routes the existing CSR through the AD CS web enrollment endpoint (certsrv/certfnsh.asp) instead.

New flags for 'request' and 'request-download' verbs:
--web Submit/download via HTTP web enrollment
--web-host Target host when web endpoint differs from --ca
--https Use HTTPS instead of HTTP

Summary

Adds an alternative certificate enrollment transport via the AD CS web enrollment endpoint (certsrv/certfnsh.asp), for environments where the CA's RPC/DCOM ports are unreachable but HTTP(S) is accessible.

• Lib/WebEnrollment.cs (new) - Submits CSRs via HTTP POST to certfnsh.asp and retrieves issued certificates from certnew.cer. Uses UseDefaultCredentials (NTLM/Kerberos), consistent with the existing auth model.
• Commands/CertRequest.cs (modified) - Added --web, --web-host, and --https options. When --web is set, enrollment routes through WebEnrollment.SubmitRequest() instead of ICertRequest2. CSR generation, key export, SAN injection, SID extension, and all existing flags remain unchanged.
• Commands/CertRequestDownload.cs (modified) - Same three options for downloading previously issued or pending certificates via web enrollment.

Usage

Web enrollment (HTTP)

Certify.exe request --ca CA01\CA-NAME --template VulnTemplate --upn [email protected] --web

Web enrollment (HTTPS) with explicit web host

Certify.exe request --ca CA01\CA-NAME --template VulnTemplate --upn [email protected] --web --web-host ca-web.corp.local --https

Download a pending certificate via web

Certify.exe request-download --ca CA01\CA-NAME --id 42 --web --web-host ca-web.corp.local --private-key

Why

The default enrollment path uses CCertRequest.Submit() which requires RPC connectivity to the CA (TCP 135 + dynamic high ports). Network segmentation, host-based firewalls, or proxy-only access commonly block these ports while permitting HTTP(S). The CA web enrollment role service (certsrv) accepts the same CSR and template parameters over HTTP, making it a viable alternative transport that requires no additional CA-side configuration.

Notes

• Requires the CA to have the "Certificate Authority Web Enrollment" role service installed (default on many deployments)
• No new dependencies - uses System.Net.HttpWebRequest
• Wrapped in #if !DISARMED consistent with existing enrollment code
• --web only changes the submission transport; all request-building logic (CertEnrollment.CreateCertRequestMessage) is shared