Knowledge Base

HOW TO: Configure a Certification Authority to Issue Smart Card Certificates in Windows 2000

PSS ID Number: 313274

Article Last Modified on 1/7/2004

The information in this article applies to:

Microsoft Windows 2000 Server
Microsoft Windows 2000 Advanced Server

This article was previously published under Q313274

IN THIS TASK

SUMMARY
** To Configure an Enterprise CA to Issue Smart Card Certificates
- To Set Security Permissions

SUMMARY

This step-by-step article describes how to configure a Certification Authority to issue smart card certificates.

You can configure a Windows 2000-based or Microsoft Windows XP-based computer to require the use of a smart card to log on to either a computer or a domain. To use a smart card, a domain user must have a smart card certificate, and you must prepare a Certification Authority (CA) to issue smart card certificates before the CA can issue them.

The CA must have both the Smart Card Logon and Enrollment Agent certificate templates installed. If you want the CA to issue smart card certificates that can be used for secure e-mail messages, you must also install the Smart Card User certificate template.

back to the top

To Configure an Enterprise CA to Issue Smart Card Certificates

Log on to an enterprise CA with a domain administrator account.
Click Start, point to Programs, point to Administrative Tools, and then click Certification Authority.
In the Certification Authority console, expand your domain name, right-click the Policy Settings node, point to New, and then click Certificate to Issue.
In the Select Certificate Template dialog box, click Smart card logon, and then click OK.
Right-click Policy Settings, point to New, and then click Certificate to Issue.
In the Select Certificate Template dialog box, click Enrollment Agent, and then click OK.
Right-click Policy Settings, point to New, and then click Certificate to Issue.
In the Select Certificate Template dialog box, click Smart Card User, and then click OK.

For additional information, click the article numbers below to view the articles in the Microsoft Knowledge Base:

313557 HOW TO: Install a Smart Card Reader

228831 Cannot Overwrite Smart Card Key in Certificate Services Setup

231881 How to Install/Uninstall a Public Key Certificate Authority for Windows 2000

281245 Guidelines for Enabling Smart Card Logon with Third-Party Certification Authorities

back to the top

To Set Security Permissions

The security permissions for a certificate template indicate who is allowed to request a certificate of that type. You can view an modify these security permissions in the Active Directory Sites and Services console.

Click Start, point to Programs, point to Administrative Tools, and then click Active Directory Sites and Services.
In the Active Directory Sites and Services console, expand the Services node, and then expand the Public Key Services node.
Click Certificates Templates.
Double-click the SmartcardLogon certificate template, and then click the Security tab. Note the security settings for authenticated users, domain administrators, and enterprise administrators. You can add users or groups if necessary.NOTE: It is not necessary to issue the Enrollment Agent certificate from the same CA that issues certificates for smart cards. The CA that issues Enrollment Agent certificates need only be trusted by the enterprise CA.