When you’re on a new or unfamiliar customer’s site it’s sometimes a challenge to locate their CA.

In the past (assuming a working Lync or OCS installation) I’ve stepped through the “Request, Install or Assign Certificates” stage in setup.exe / Deployment Wizard, purely because it automatically detects the PKI CA (but then won’t let you scrape it to the clipboard). Tedious but effective.

Turns out all you need to do is run this command in a DOS box from a modern-vintage machine (e.g. Win 7 client or Server 2008), and it will reveal all:

certutil -config - -ping

That’s not a typo: it’s certutil space minus config space minus space minus ping.

Sweet.