I came across two user object attributes User-Cert (ldap name: userCert) and X509-Cert (ldap name: userCertificate) in Active Directory that sound similar, but doesn't seem so.

As per documentation (https://docs.microsoft.com/en-us/windows/win32/adschema/a-usercertificate), X509-Cert (userCertificate) holds the DER-encoded X.509v3 certificates and contains the public key certificates issued to the user by Microsoft Certificate Service. This can be then used for authentication purposes.

However, there is no clarity on what is User-Cert (userCert) attribute is and its uses. The documentation says Nortel v1 or DMS certificates - https://docs.microsoft.com/en-us/windows/win32/adschema/a-usercert.

Could somebody please shed some light on this? Thanks.

1 Answer 1


user-cert originally used to store certificates for S/MIME purposes (to lookup for recipient certificates). But it is replaced with userCertificate attribute. For example, MS Outlook reads user-cert attribute, but do not use it in any way (ignores its value completely).

  • Thanks @Crypt32. There is a separate User-SMIME-Certificate attribute as well, which also seem to be intended for S/MIME purposes. Isn't it? Is user-cert kind of obsolete now, with no practical use?
    – ramtech
    May 11, 2020 at 8:57
  • user-cert is obsolete. In fact, there are enough obsolete attributes in Active Directory and replaced with other attributes. In LDAP you cannot remove (only disable, but yet not remove) attributes from classes, only add and by the time, the number of attributes (both, used and unused) only increases.
    – Crypt32
    May 11, 2020 at 9:00

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .