Re: Certificate Renewal minimum requirements
From: Brian Komar (bkomar_at_nospam.identit.ca)
Date: 10/23/04
- Next message: B. Meincke: "Re: mapped share on student session timing out"
- Previous message: Steven L Umbach: "Re: changing registry permissions via gpo?"
- In reply to: MC: "Re: Certificate Renewal minimum requirements"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Date: Sat, 23 Oct 2004 07:26:09 -0500
In article <eps2fPDuEHA.3860@TK2MSFTNGP09.phx.gbl>, seaedsit@hotmail.com
says...
> David, thanks for that input.
>
> Is the auto-enroll permission enough, or must the user be granted the
> "enroll" permissions too ?
> In the MS documents you can find statements, that when autoenroll
> permissions are granted user always must have enroll permissions too.
>
> The problem would be when enroll permissions are granted, users would be
> able to enroll smart card user certificates by themselves. It only should be
> possible to enroll smart card user certificates by a couple of admins who
> own an enrollment agent certificate.
>
> Thx,
> Mario
>
The solution is to use two certificate templates. The first, for initial
enrollment only allows the couple of admins to enroll on behalf of the
user. This is accomplished by limiting permissions to the enrollment
agents and to require the certificate request agent OID in the signing
certificate. This certificate can include a custom application policy
OID designated as the "Company" smart card
Then you can create a renewal certificate that:
- supercedes the initial certificate
- enables Read, Enroll, and Autoenroll perms to *all* smart card holders
- Requires that the request be signed with an application policy OID,
the "Company" smart card OID.
HTH,
Brian
>
>
>
> "David Cross [MS]" <dcross@online.microsoft.com> wrote in message
> news:uWOomGDuEHA.2000@TK2MSFTNGP14.phx.gbl...
> > yes, they will still need autoenroll permission, I think we have an
> example
> > for usingf existing cert and auto-renewal in this paper:
> >
> > auto-enrollment:
> >
> http://www.microsoft.com/technet/prodtechnol/windowsserver2003/technologies/security/autoenro.mspx
> >
> >
> > --
> >
> >
> > David B. Cross [MS]
> >
> > --
> > This posting is provided "AS IS" with no warranties, and confers no
> rights.
> >
> > http://support.microsoft.com
> >
> > "MC" <seaedsit@hotmail.com> wrote in message
> > news:etsQ$nBuEHA.3156@TK2MSFTNGP12.phx.gbl...
> > > Hi,
> > >
> > > What are the minimum requirements to renew a smart card user certificate
> > > stored on a smart card?
> > >
> > > Is it necessary to give the user "enroll" permissions to renew an
> existing
Ths
- Next message: B. Meincke: "Re: mapped share on student session timing out"
- Previous message: Steven L Umbach: "Re: changing registry permissions via gpo?"
- In reply to: MC: "Re: Certificate Renewal minimum requirements"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
|
