Re: Smartcard Enrollment Agents
From: Brian Komar (bkomar_at_nospam.komarconsulting.com)
Date: 07/10/04
- Next message: NickC: "Folder Permissions"
- Previous message: Brian Komar: "Re: ssl certificate"
- In reply to: Denis Beuermann: "Smartcard Enrollment Agents"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Date: Sat, 10 Jul 2004 15:51:48 -0500
In article <Ox9JQt$YEHA.3716@TK2MSFTNGP11.phx.gbl>, beuermann@rissoft.de
says...
> Hi NG,
>
> I hope you can help me. I have installed a CA on Windows Server 2003
> Enterprise Edition. I want enroll certificates for other users as an
> enrollment agent. The enrollment agent certificate is installed on my own
> smartcard. I go to the certsrv website > click request a certificate >
> advanced certificate request > request a certificate for a smart card on
> behalf of.... > select the certificate template, the ca, the CSP (Smart Card
> CSP) > signing certificate > user to enroll > and click enroll. At this time
> a error message occur:
>
> Cannot find the administrator signing smart card. Please insert the
> administrator smart card.
>
> But the admin signing smartcard is inserted. What is wrong???
>
> Denis
>
>
>
If you place the enrollment agent certificate on a smart card, the the
smart card holding the enrollment agent certificate *must* use a
different CSP than the smart card certificate being requested. What
happens if the enrollment agent certificate is stored in the user's
profile, rather than on a smart card.
The other possibility is that the enrollment agent certificate does not
have the Certificate Request Agent oid in either the application policy
or EKU extension. The enrollment web pages are hard coded to require a
certificate with the correct OID.
Finally, if the smart card is not also an authentication certificate,
the computer may not know of its existance, and will not be looking at
the smart card reader. By creating a custom v2 certicate that includes
the following applicaition policy OIDs, you can log on with the smart
card and then signin enrollment requests for other smart cards:
- client authentication
- smart card logon
- certificate request agent.
HTH,
Brian
- Next message: NickC: "Folder Permissions"
- Previous message: Brian Komar: "Re: ssl certificate"
- In reply to: Denis Beuermann: "Smartcard Enrollment Agents"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
|
