Buypass SmartCard Enrollment Agent - MS WIN 2016 Server

General:

• Validity = 3 years
• Renewal Period = 6 weeks
• Published in Active Directory

Compatability:

Default setting

Request Handling:

• Purpose = Signature means that the operator who is requesting the certificate is signing with the Enrollment Agent certificate
• Enroll Subject without requiring any user input, which means you do not need to supplement the certificate with additional information, as the information is obtained from the user account logged in

Cryptography:

• Key Size = 1024
• Requests can use any provider available on the subject’s computer

Key Attestation:

Default setting

Subject Name:

Name is obtained from Active Directory based on the Fully distinguished name and the User’s UPN.

Issuance Requirements:

• This number of authorized signatures = 1
• Policy = Application Policy and Certificate Request Agent
• Reenrollment = Same criteria as for enrollment

Superseded Templates:

No settings = Default

Extensions:

• Application Policies = Certificate Request Agent

Extensions:

• Basic Constraints = Default settings

Extentions:

• Certificate Template Information = Default Setting

Extensions:

• Issuance Policies = Default Setting

Extensions:

• Key usage: Digital signature – Critical extension

Security:

These settings determine the privileges for the Certificate for read, modify and enroll of certificate

Only the DL_CA_ADM and the DL_LRA_ADM groups should this certificate via Enroll

• DL_CA_Admins = Read, Write, Enroll
• DL_CA_LRA_Admins = Read, Enroll