Microsoft Certificate Authority (CA) provides basic smart card certificate templates. However, these standard Microsoft CA templates cannot be used as is on Windows 2008 or Windows 2012 servers. They must be duplicated and configured first. This article shows how you can set up a Smart Card certificate templates that can be used by users with the appropriate permissions, to request a certificate to be placed onto their smart card, i.e. to self enroll.
First, open up the Service Manager. Note: You cannot manage certificate templates from the default CA snap in.
Select “Active Directory Certificate Services”, Certificate Templates, right click the “Smart Card User” template and select “Duplicate Template”
The Smart Card User template is a general use template that enables computer logon, as well as signing and encryption. If you want just smart card logon, you can also select the “Smart Card Logon” template.
Select “Windows Server 2003 Enterprise”.
Note: Do not choose Windows Server 2008 Enterprise – this uses CNG (the new cryptographic subsystem) which does not support the typical smart card.
Rename the template.
Select the CSPs button at the bottom right of the “Request Handling” tab, and set the template to require the use of the Microsoft Smart Card Base Crypto provider. This will ensure that the smart card is used for storing the certificate and keys.
Click OK, and OK again to save the template.
Go to the CA snap-in, and select the “Certificate Templates” directory. This directory contains all the templates assigned to the CA. Some templates are assigned to the CA by default.
Select “Certificate Template to issue”.
Select the certificate template you have just created. Check that the certificate template is now visible in the “Certificate Template” directory of the active CA.
You are now ready to have users self-enroll their smart card certificates.
0 Comments