How does smart card logon certificate enrollment work?

Posted by Purple___Flame@reddit | sysadmin | View on Reddit | 5 comments

Hello, i've been able to create a working smart card logon template and managed to issue a certificate which was promptly written to a usb token, so it does work, but i'm left with few questions..

The current enrollment process - as i have read/enroll permissions, i request certificate from my pc's certificates console and write it to usb(it just automatically prompts it) - is it normal? Certsrv web interface doesn't see my template for whatever reason so i'm unable to use it.

Am i right to assume that "Build from this Active Directory information" in Subject Name tab of template properties means that the user who requests the certificate is also the user for whom the certificate is for, and in that case - how can admin request a certificate for another user?

Lastly - how would(or not) certificate renewal even work potentially, considering we use usb tokens, can they even automatically get new certificates? Or is it simpler to do it manually?

[-]

picklednull@reddit

Sounds like you should read the feature documentation?

request certificate from my pc's certificates console and write it to usb(it just automatically prompts it) - is it normal? Certsrv web interface doesn't see my template for whatever reason so i'm unable to use it.

Yes.

There is no way to enroll inside a web browser, browsers don't have the APIs to interact with smart card hardware (other than via the OS certificate store) and HTTP doesn't provide support for enrollment either.

Also, the certsvc web interface is basically useless and a massive security liability unless hardened appropriately. You should just remove it.

Am i right to assume that "Build from this Active Directory information" in Subject Name tab of template properties means that the user who requests the certificate is also the user for whom the certificate is for, and in that case - how can admin request a certificate for another user?

Enrollment agents and "enroll on behalf of" in certmgr.msc.

Lastly - how would(or not) certificate renewal even work potentially, considering we use usb tokens, can they even automatically get new certificates?

User policy GPO that enables automatic certificate management, same as for computer certificates. But it sucks and users will only get balloon notifications about expiring certificates and they still need to manually enroll.

You can allow a user to renew based on existing certificate though.

[-]

theRealTwobrat@reddit

It’s worth stating again, you should take this advice, disable http interface OP.

[-]

Purple___Flame@reddit (OP)

Do i straight up remove it from IIS manager? I've enabled "Require SSL" for now, so it's no longer opening.

[-]

theRealTwobrat@reddit

So long as you are not using web enrollment for anything you can disable so websites. Otherwise the full steps to mitigate are here: https://support.microsoft.com/en-us/topic/kb5005413-mitigating-ntlm-relay-attacks-on-active-directory-certificate-services-ad-cs-3612b773-4043-4aa9-b23d-b87910cd3429

[-]

Purple___Flame@reddit (OP)

Thanks