1 Overview

This document is mainly about how to configure Certificate Authority at Windows Server before smart card login certificates can be requested and loaded to FIDO keys. There are five main parts:

Create a smart card login template
Publish the template in the Certification Authority
Edit Group Policy about user enrollment
Auto-enroll certificate at user 's machines
Manually enroll for current user

2 Prerequisites

A Windows Server with domain controller and certificate authority configured. In this document, Windows Server 2016 with AD CA is used.
Guest machines (could be the Windows Server itself) and available Windows accounts which have already joint in the CA 's domain. In this document a Windows 10 enterprise is used.
The FIDO product supports PIV function.
The Minidriver of EsMiniTokenSetup.exe is installed in relevant machines.

3 Set up the Smart Card Login Template for User Self-Enrollment

A smart card login certificate template is required before loading certificate to your keys. Follow the steps on the Windows Server that runs CA:

3.1 Create a Smart Card Login Template for User Self-Enrollment

Press Win+R, type "certtmpl.msc" and press Enter.

SafeKey > Enroll PIV Smartcards by Users via Self-Enrollment > worddav5435424ec38a74961b32555b48b94952.png

Click Certificate Templates, right-click Smartcard Logon, and select Duplicate Template.

SafeKey > Enroll PIV Smartcards by Users via Self-Enrollment > worddav1a8456bcc0bd55234803ce30b3f501e3.png

Select the General and Compatibility tab, and make the following changes:

SafeKey > Enroll PIV Smartcards by Users via Self-Enrollment > worddavb4a1dd647b2187714104309914489544.png The Certification Authority should be your CA server 's OS version and the Certificate recipient should be your oldest OS version that the domain includes.

Select the Request Handling and Cryptography tab, and make the following changes as needed.

SafeKey > Enroll PIV Smartcards by Users via Self-Enrollment > worddav4a4f28a744e5ada78b4524ffc3f79350.png

Algorithm name: Select either RSA, ECDH_P256,or ECDH_P384 from the dropdown. Note: ECDH_P521 is not supported.
Note that if an ECDH algorithm is selected, the client Windows systems need to have Elliptic Curve Cryptography (ECC) Certificate Login support added using Group Policy or by editing the registry.
Minimum key size: If you selected RSA in the previous step, enter 2048. If you selected ECDH_P256 or ECDH_P384 in the previous step, this field automatically populated.
In general, do not check "Allow private key to be exported" unless you need to help other client users of this domain to enroll their keys.

On the Security tab, make sure to add Read, Write and Enroll to administrator groups and Enroll and Autoenroll permissions to the target users.

SafeKey > Enroll PIV Smartcards by Users via Self-Enrollment > worddavc7461f8eee6f2bcbe3a22ee083c27e04.png

Make sure there are "Domain Users" and ensure the options for all users are checked for at least Read, Enroll, and Autoenroll. Other user 's permission could be set by needs.

Click Apply, and then click OK to close the template properties window. Close the Certificate Templates window.

3.2 Adding the Template to the Certification Authority

Right-click the Windows Start button and select Run.
Type "certsrv.msc" and press Enter.
Click Certification Authority, double-click your server, right-click Certificate Templates, select New and then select Certificate Template to Issue.

SafeKey > Enroll PIV Smartcards by Users via Self-Enrollment > worddav3a0d0abb99746e79aa046cfda8e7f663.png

Locate and select the recently created self-enrollment template, and then click OK

SafeKey > Enroll PIV Smartcards by Users via Self-Enrollment > worddave3ef58bf03a8b9a061cde3afb06eb617.png

3.3 Editing Group Policy to Enable Auto-Enrollment

Right-click the Windows Start button and select Run.
Type "gpmc.msc" and press Enter.
Navigate to the AD forest and Domain containing your server, double-click your server and double-click Group Policy Objects.
Right-click on the group policy you want to edit, and then select Edit.

SafeKey > Enroll PIV Smartcards by Users via Self-Enrollment > worddav36e35c8a560b7fef4efb14033c59f862.png

Expand Computer Configuration > Policies > Windows Settings > Security Settings > Public Key Policies.
Right-click Certificate Services Client – Certificate Enrollment Policy and select Properties.

SafeKey > Enroll PIV Smartcards by Users via Self-Enrollment > worddav94be515eb764a2906a55ecdefdd3c8cb.png

Make changes as below:

SafeKey > Enroll PIV Smartcards by Users via Self-Enrollment > worddave6fa726d2f9b8d8ce51189246e8f6811.png

Right-click Certificate Services Client – Auto-Enrollment Policy and select Properties and make changes as below:

SafeKey > Enroll PIV Smartcards by Users via Self-Enrollment > worddav6760493ec0673487c7313e570ff694be.png

Expand User Configuration > Policies > Windows Settings > Security Settings > Public Key Policies. Apply same changes to same polices.

You may need to restart your machine to apply these changes

4 Using Auto-Enrollment to Enroll Users

This section describes the steps users will need to follow to auto-enroll their key for Login.

Log into a user account on a Windows 10 PC connected to the domain. A Certificate Enrollment notification appears above the System Tray.

SafeKey > Enroll PIV Smartcards by Users via Self-Enrollment > worddav7ba01421011477efab7bc866a124df87.png

Click the Certificate Enrollment notification to open the Certificate Enrollment wizard. If the popup has disappeared (or didn't initially appear) click the arrow in the System Tray to expand the list of options and click on the certificate icon.
On the initial screen, click Next.

SafeKey > Enroll PIV Smartcards by Users via Self-Enrollment > worddava3875a69946572087edd346bfaace37e.png

Select the newly created certificate template and click Enroll.

SafeKey > Enroll PIV Smartcards by Users via Self-Enrollment > worddav842eb021f9dde72a45ec7f4de655bb2c.png

Enter your key 's PIV PIN and then click OK. If that PIN has not been set, enter the default PIN:123456.

SafeKey > Enroll PIV Smartcards by Users via Self-Enrollment > worddav001c7ade688f1f1be9b9193808964789.png
Note: Mini drier: 'EsMiniTokenStepup' is required in this stage, otherwise, it will be 'read-only'.

Windows will enroll the for Windows login. After the process succeeds, click Finish.

SafeKey > Enroll PIV Smartcards by Users via Self-Enrollment > worddav249fe14c18292fe4e3c95b9c339de144.png

Check the windows certificate store, the new cert is also stored in the cert store, as well as the smart card token.

SafeKey > Enroll PIV Smartcards by Users via Self-Enrollment > worddav34ae67c94244d99297e9793727f5c66d.png

When you login to this machine next time, you can select Smart Card method to logon.

SafeKey > Enroll PIV Smartcards by Users via Self-Enrollment > worddav63bf6619e715973f857afb50fca5f6ff.png
Enter Smart Card Pin, default '123456', and then you are logged in.

5 Enroll manually

If you want to enroll the certificate manually, or something unexpectedly stop the auto enrollment, you can change the properties of the certificate template and enroll it by userself.
First open the certificate template at certtmpl.msc, move to Security tab and uncheck the Autoenroll permission at certificate template security tab.
SafeKey > Enroll PIV Smartcards by Users via Self-Enrollment > worddav947538b7e2475c062d11b3566fcdbc77.png
And then run certmgr.msc, move to Personal-Certificates, right click, All tasks, Request New Certificate.

Next,

Click 'next'

Select the certificate template you created at previous steps.
SafeKey > Enroll PIV Smartcards by Users via Self-Enrollment > worddavc315d9849653fb6f98a625c5ec25498b.png
Success. Next time you login to this account with our key inserted, you can use smart card logon method.