Setting up Certificate Templates to Enroll on behalf of another user

This article was the subject of a Security Notice (link)

Microsoft Certificate Authority (CA) provides basic smart card certificate templates. However, these standard Microsoft CA templates cannot be used as they are but instead they must be duplicated and configured first.  This section shows how to set up the Smart Card certificate templates on the server that can be used by an administrator, or Enrollment Agent, to enroll smart card certificates on behalf of other users.

This requires two steps:  issuing an "enrollment agent" certificate and adjusting the Smart Card User or Logon template to require that certificate for enrollment.

Security Warning: Providing the ability to enroll "on behalf of" another user is a security vulnerability. A previous version of this article did not adequately highlight best practices for securing the issuance of an enrollment certificate and the risks for not doing this correctly.  

It is recommended to:

• create a seperate AD Group specifically for the Enrollment Agents
• set up the template so that the Enrollment Agent (EA) certificate uses the Enrollment Agent's smart card
• enable “CA certificate manager approval” on the issuance requirements tab.  This puts the request in a pending state, and requires a manual approval of an admin for the issuance request.

Step 1:

To issue an enrollment agent certificate, duplicate the Enrollment Agent template.  

In the Server Manager, choose Tools, then Certification Authority. 

Expand your server name to reveal Certificate Folders.

Right click the Certificate Templates folder and choose Manage.

A new window opens with a list of templates in the middle pane. Right click the "Enrollment Agent" template and select "Duplicate Template".  

Next, adjust the properties of the new template.  Under the Compatibility tab, leave the 2003 settings chosen.  

 

Under the General tab, rename the template.

To set up the template for the Enrollment Agent certificate to simply be issued to the user account of the Enrollment Agent, and placed into their Certificate Store, only the properties in the Security tab need to be adjusted to allow the appropriate user or group of users to request this type of certificate for themselves.  Skip ahead to the Security tab instructions.

To set up the template so that the Enrollment Agent (EA) certificate gets placed onto the Enrollment Agent's smart card, follow the steps below.  Be warned:  if the EA certificate is on the EA's smart card, during enrollment for the other user, you'll be prompted to insert the Enrollment Agent card and PIN, and the other (new) user's card and PIN, possibly multiple times, thus swapping the cards in and out of the reader.  If you don't pay careful attention to the prompts, you may end up placing the other user's logon certificate onto the Enrollment Agent's smart card inadvertently.

 Under the Request Handling tab, select Purpose: "Signature". 

Click through the resulting warning box as shown here.

Note that "Prompt the user during enrollment" gets selected after the warning box, leave that selected.

Under the Cryptography tab, change the minimum key size to 2048, select "Requests must use one of the following providers", and check the Microsoft Base Smart Card Crypto Provider.  

Note that this is the setting that will put the Enrollment Agent (EA) certificate onto the Enrollment Agent's smart card.  

Under the Security tab, be sure the Enroll ability is set for only the user or group of users who will be setting up the smart cards for logon (the Enrollment Agents).   

 

Click OK to save the template. Close that window.

The Certificates Template folder contains all the templates assigned to the CA. Some templates are assigned to the CA by default, the new template needs to be issued to be added to the Certification Authority templates. Right click the Certificate Templates folder, choose New then Certificate Template to Issue.  Choose the template you just created and click Ok.

Select the certificate template you have just created. Click the Certificate Templates folder to check that the new certificate template is now visible in that folder.

In order to issue the enrollment agent certificate, the user who will be enrolling others (the Enrollment Agent) needs to request the enrollment agent certificate by logging onto their account and running the MMC, similar to the steps in the article Self-enrolling a Smart Card Certificate.

Step 2:

In order to be able to issue a smart card certificate on behalf of another user, the Smart Card User or Logon template needs to be adjusted to require the Enrollment Agent certificate for enrollment.

Duplicate and configure a Smart Card User or Logon template, detailed in the article on setting up templates for self enrollment: Setting up a Smart Card Template for Self-Enrollment (Server 2012 R2 & 2016)

Then make the following changes to template properties under the Issuance Requirements tab:

- Set the number of authorized signatures to 1,

- Set the policy type to "Application Policy",

- Set the application policy OID to "Certificate Request Agent".

This will ensure that the template will be made available to users with the Enrollment Agent role.

Note: Be sure the Enroll ability is set for the group or users who act as the Enrollment Agents to set up the other users with this certificate.

Make sure to rename this template so that it is clear that this is an "enroll on behalf of" template.

Next, the template needs to be assigned to the active Certification Authority.  This is done in the CA snap-in in the Server Manager in the same way as described above, choosing the new Certificate Template to Issue.

Note:  If you will be using the standard Windows PIV minidriver, or any other middleware that supports PIV cards, (Option 2 for deployment from article PIVKey Deployment Overview), you must map the PIV certificates.  This can be done using the PIVKey Tool or it can be done in the templates.  To do so in the templates, please see article Mapping a PIV Certificate using an OID, which explains how to set it up in the Extensions tab.

See the next article on Enrolling a Smart Card certificate on behalf of another user