1

I have a Yubikey 5 NFC and I am trying to configure it on a test bench for windows login authentication. I cannot seem to get the certificate to enroll on the Yubikey. I have followed the Yubikey Smartcard deployment guide, but does not seem to be working as expected.

So far, I have:

  • Created Domain Controller (Windows Server 2012 R2) and configured it with Active Directory, and Certificate Authority
  • I created a Windows 10 workstation and connected it to the domain controller
  • Configured CA for smartcard authentication
  • Confirmed the Smartcard mini driver is installed on the Windows 10 correctly
  • Created a smartcard login template for self enrollment
  • Published the template and added it to the GPO 'default domain policy'

When I login to the Windows 10 machine as a new user, it prompts the user to configure a certificate. The Enroll certificate wizard creates and issues the certificate to MMC --> Console Root --> Certificates - Current User --> Personal --> Certificates

It does not ask for a Yubikey PIN and it just completes the setup wizard. I cannot seem to get the certificate to go to the Yubikey. I've tried a workaround where I export the certificate and private key and then manually add it to a slot on the Yubikey, but when I plug it into the Windows 10 machine, I get an error when trying to login with smartcard saying "No valid certificates were found on this smartcard. Please try another smartcard or contact your administrator".

Any help or guidance would be greatly appreciated!

1

Have you eliminated the three potential causes described in the Troubleshooting "No Valid Certificates Were Found on This Smart Card" article on Yubico's knowledge base?

  1. The YubiKey was enrolled using one of the PIV tools and the computer has the YubiKey Smart Card Minidriver v3.3 installed.
  2. The certificate chain is not trusted.
  3. The usage attributes on the certificate do not allow for smart card logon.
| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.