In order to issue Smart Card certificates to users, you must have the following:
- Microsoft Windows Server is installed (2008, 2012, 2016, SBS)
- The server is configured, has Active Directory Services installed and has been promoted to a Domain Controller
- The DNS server is configured with the correct domain name
- Microsoft Windows Certificate Services installed in Enterprise mode
- There is an enrollment station PC joined to the domain with a smart card reader and minidriver installed
It is especially important the the DNS is configured correctly, otherwise the client PCs will not be able to find the required certificate CRL (Certificate Revocation List).
For additional information, see Setting up the Windows Environment.