Requirements

• Microsoft Domain Controller, Microsoft Active Directory and Microsoft Certificate Authority (with the appropriate certificate templates are configured for certificate [web] enrollment). Refer to Microsoft documentation for the installation and configuration for Microsoft software.
• Microsoft has posted the certificate requirements for smart card logon.

• Requirements for domain controller certificates from a third-party Certificate Authority.
• Guidelines for enabling smart card logon with third-party certification authorities.

Steps

1. Enter the Microsoft Certificate Authority (CA) URL ( e.g., https://[CA_hostname]/certsrv ) in a web browser.
2. Depending on the Microsoft configuration the user is likely to be prompted to enter Windows credentials in a pop-up Window.
3. Click the Request a certificate link from the select a task listing.
4. Click advanced certificate request.
5. Click Create and submit a request to this CA.
6. In the Advanced Certificate Request form,
   1. Change the Certificate Template to Smartcard User.
   2. Change the CSP to Microsoft Base Smart Card Crypto Provider.
   3. Select an appropriate key size (default is 1024). Leave the remaining settings as default.
   4. Click Submit.

7. After clicking Submit, the end user will be prompted to enter a PIN to access the certificate store on the SID800.

8. Now the system will generate the request:

9.  The private key is generated and stored in the certificate store of the SID800 and after the request has been processed the end user is prompted to install a certificate. Click the Install this certificate link to complete the certificate enrollment and store the certificate on the SID800. A copy of this certificate is also stored in the userCertificate attribute of the user's properties found in Microsoft Active Directory.

10. Open the RSA Authentication Client RSA Control Center and click the Certificates link to confirm the presence of the certificate.

11. From a Microsoft workstation logon the end user will press Ctrl+Alt+Del to logon and may have to switch user to display the tile for Smart card logon. Clicking the Smart card logon tile will prompt the end user to enter the PIN to access the certificate store of the SID800.  For example, where the end user is prompted to enter a PIN: