What requirements must be met on the infrastructure side for smart card logons to be possible?

Author Uwe Gradenegger Posted on Categories Certificate usage, Active Directory, Smart card Tags Certificate template, Extended Key Usage (EKU)

In order for a smart card logon to be successful, some requirements must be met in the Active Directory environment:

Requirements

Do you know TameMyCerts? TameMyCerts is an add-on for the Microsoft certification authority (Active Directory Certificate Services). It extends the function of the certification authority and enables the application of rule sets to realize the secure automation of certificate issuance. TameMyCerts is unique in the Microsoft ecosystem, has already proven itself in countless companies around the world and is available under a free license. It can be downloaded via GitHub and used free of charge. Professional maintenance is also offered.

Domain controller certificates must allow logon

Domain controllers must have certificates that enable smart card logon . One of the following criteria must apply.

  • The "Extended Key Usage" extension contains the Extended Key Usage for KDC Authentication (1.3.6.1.5.2.3.5) or
  • The "Extended Key Usage" extension contains the Extended Key Usage for Smart Card Logon (1.3.6.1.4.1.311.20.2.2) or
  • A "Template Name" extension is present and has the value "DomainController"

Microsoft uses the term "Enhanced Key Usage", but the correct name according to RFC 5280 is "Extended Key Usage" .

Certification authority certificates must be entered in NTAuthCertificates

The following certification authority certificates must be stored in the Active Directory object "NTAuthCertificates". See also article "Editing the NTAuthCertificates object in Active Directory ".

  • The certification authority certificate of the certification authority that issues the domain controller certificates
  • The certification authority certificate of the certification authority issuing the user certificates

Certification authority certificates must allow the corresponding Extended Key Usage

The certification authority certificate of the certification authority issuing the user certificates must support either the "Smart Card Logon" or the "Client Authentication" Extended Key Usage, i.e. it must not be prohibited by a corresponding Extended Key Usages extension .

The above requirements are met with the default settings, i.e. if a certification authority integrated into Active Directory is installed, the required settings are set as above. The default certificate templates for domain controllers have the corresponding properties.

External sources