How to request certificate from a non-domain computer

Question

We using a Windows Server 2008 R2 Enterprise CA to issuing webserver-certificates (SSL). The CA-Server is a member of a AD-Domain and online. Now we want to request certificates from computers like Windows Server 2008 R2 or Linux Server which aren't member
of the domain.
How we can request certificates automatically with a script remote from these Windows Servers, for example ? Is it possible to use  the "Certificate Enrollment Web Service" without the "Certificate Enrollment Policy Web Service" ?
Is it possible to use certreq in this scenario ?
Thanks for your help.

Answer 1

Now I have found a solution. Shortly I want describe the way:
Prerequirements:
1. ADCS Enterprise Certification Authority is installed
2. ADCS Certificate Enrollment Web Service is installed on a server
3. ADCS Certificate Enrollment Policy Web Service is installed on an other server
Steps to do:
1. Prepare a request-file for a certificate
2. On a computer which is not a member of the Domain/Forest of the CA-Service: submit the request to the CA and receive the issued certificate. The following command have to written in one line without line breaks.
  certreq -submit
    -Username {domain}\{username}
    -p {password}
    -PolicyServer "https://{FQDN CertificateEnrollmentPolicyWebService-Server/-Alias}/ADPolicyProvider_CEP_UsernamePassword/service.svc/CEP"
    -config "https://{FQDN CertificateEnrollentWebService-Server/-Alias}/{CAName}_CES_UsernamePassword/service.svc/CES"
    -attrib "CertificateTemplate:{TemplateName}"
    {Enter Path and Name of the Request-File}
    {Choose Path and Filename for certificate}
   Sample:
   certreq -submit
        -Username contoso\Serviceaccount
        -p P@ssw0rd
        -PolicyServer "https://CAPolicyEnroll.contoso.com/ADPolicyProvider_CEP_UsernamePassword/service.svc/CEP"
        -config "https://CAWebEnroll.contoso.com/IssuingCA1_CES_UsernamePassword/service.svc/CES"
        -attrib "CertificateTemplate:MyOwnSSLTemplate"
        request.req
        sslcert.cer
3. Now you can find a file with your requested certificate locally in path you have choosen for the certificate-file.
I hope this will be helpful for other people enrolling certificates on non-domain member computers.