{"id":247,"date":"2012-11-20T16:35:24","date_gmt":"2012-11-21T00:35:24","guid":{"rendered":"http:\/\/unmitigatedrisk.com\/?p=247"},"modified":"2012-11-21T12:03:21","modified_gmt":"2012-11-21T20:03:21","slug":"making-a-windows-smartcard-login-certificate-with-openssl","status":"publish","type":"post","link":"https:\/\/unmitigatedrisk.com\/?p=247","title":{"rendered":"Making a Windows smartcard login certificate with OpenSSL."},"content":{"rendered":"

I use OpenSSL for testing certificate related stuff all the time, while using its test clients as a administrative tool can require contortions sometimes it\u2019s very useful thing to have in my toolbox.<\/p>\n

Today I needed to throw together a certificate for Windows smartcard login, a valid Windows Smart Card Login certificate has the following attributes:<\/p>\n

    \n
  1. Is issued by an CA that is trusted as an Enterprise CA<\/li>\n
  2. Is issued by a CA that has the \u201cSmartcard Logon\u201d EKU (1.3.6.1.4.1.311.20.2.2)<\/li>\n
  3. Has the \u201cSmartcard Logon\u201d EKU<\/li>\n
  4. Has the \u201cDigital Signature\u201d \u201cKey Usage\u201d<\/li>\n
  5. Has the principal name of the subscriber in the SubjectAltName extension as a UPN (1.3.6.1.4.1.311.20.2.3)<\/li>\n<\/ol>\n

    With that background how does one do this in OpenSSL? Well lets focus on the last 3 (3,4,5) as they are about the subscriber certificate.<\/p>\n

    To create this certificate you would create an OpenSSL section that looks something like this:<\/p>\n

    [ v3_logon_cert ]<\/p>\n

    # Typical end-user certificate profile<\/p>\n

     <\/p>\n

    keyUsage = critical, nonRepudiation, digitalSignature, keyEncipherment<\/p>\n

    extendedKeyUsage = critical, clientAuth, emailProtection,\u00a0msSmartcardLogin<\/p>\n

    basicConstraints = critical, CA:FALSE<\/p>\n

     <\/p>\n

    subjectKeyIdentifier = hash<\/p>\n

    authorityKeyIdentifier = keyid,issuer<\/p>\n

     <\/p>\n

    authorityInfoAccess = @customerca_aia<\/p>\n

     <\/p>\n

    subjectAltName = otherName:msUPN;UTF8:john.doe@example.com, email:john.doe@example.com<\/p>\n

     <\/p>\n

    certificatePolicies=ia5org,@rootca_polsect<\/p>\n

    There are a few other \u201creference\u201d sections you can find the INF file I used these additions with in my script for testing Qualified Subordination.<\/p>\n

    Hope this helps you too,<\/p>\n

    Ryan<\/p>\n","protected":false},"excerpt":{"rendered":"

    I use OpenSSL for testing certificate related stuff all the time, while using its test clients as a administrative tool can require contortions sometimes it\u2019s very useful thing to have in my toolbox. Today I needed to throw together a certificate for Windows smartcard login, a valid Windows Smart Card Login certificate has the following […]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_monsterinsights_skip_tracking":false,"footnotes":""},"categories":[3],"tags":[22,67,5],"class_list":["post-247","post","type-post","status-publish","format-standard","hentry","category-security","tag-openssl","tag-smartcard-logon","tag-smartcards"],"_links":{"self":[{"href":"https:\/\/unmitigatedrisk.com\/index.php?rest_route=\/wp\/v2\/posts\/247","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/unmitigatedrisk.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/unmitigatedrisk.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/unmitigatedrisk.com\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/unmitigatedrisk.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=247"}],"version-history":[{"count":0,"href":"https:\/\/unmitigatedrisk.com\/index.php?rest_route=\/wp\/v2\/posts\/247\/revisions"}],"wp:attachment":[{"href":"https:\/\/unmitigatedrisk.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=247"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/unmitigatedrisk.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=247"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/unmitigatedrisk.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=247"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}