0

I'm playing with the Windows Server CA role and Smart Card logons. We have a working PKI setup and smart card issuance/logon working. What I'm curious about is the "Require this number of authorized signatures" option in the "Smartcard Logon Template" and how to view the signatures. To me, it makes sense that this option is useful since a certificate from this template will need an authorized signature from another trusted person/party, and prevent arbitrary people from issuing smart card logon certificates (provided the Enrollment Agent is secured properly). I'm able to issue certificates with this option checked, but I'm not sure how to view what certificate was used to sign the logon certificate.

My signing certificate was taken from a nearly unedited copy of the "Enrollment Agent" certificate template, and issued without trouble. When I issue a smart card logon certificate, I'm prompted to select a signing certificate (which is the Enrollment Agent certificate) and after selecting it, I can issue the logon certificate just fine. When I inspect the certificate (double click the cert in the Windows CA snap-in) the chain only shows my CA, with the certificate itself right below that. I understand I'm only signing the certificate, not an intermediate CA, but shouldn't something from my signing cert appear in the chain/details?

certutil -scinfo shows the chain is verified and has two "CertContext" entries, though nothing there nor in the validation chain, or anywhere in the output is any indication that I signed the certificate.

tl;dr, if my signature is required for certificate issuance, shouldn't something relating to me appear in the final certificate data?

Improve this question
2
  • The Enrollment Agent signs the request, not the certificate. The CA checks for this additional signature before it allows a certificate to be issued.
    – garethTheRed
    Jul 3, 2018 at 6:25
  • Ahh, ok. Is there any record of the Enrollment Agent signature on the CA side of things? If we needed to go back and see who signed a cert, could we see a record if it was signed with the Enrollment Agent certificate?
    – Nicholas Dechert
    Jul 3, 2018 at 14:59

1 Answer 1

Reset to default
0

You can see who the Enrollment Agent was by looking at the original request within the Certification Authority MMC (certsrv.mmc).

Select the Issued Certificates folder in the left hand pane and find the certificate you're interested in. Right click on the certificate and select All Tasks -> Export Binary Data.... In the dialogue that opens, select Binary Request and confirm View formatted text version of data is selected before clicking on the OK button.

Notepad will now open with a textual representation of the request. This is rather messy and difficult to read, but if you scroll to the bottom you'll see a certificate delimited with ================ Begin Nesting Level 1 ================ and ================ End Nesting Level 1 ================. This is the EA's certificate. Check the Subject: for details.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .