So the user certificate requires a little extra attention to detail.
We'll talk about that.
The VPN user certificate is quite obviously a user certificate.
It's stored in the user's certificate store on the endpoint.
The only required EKU for user certificates is client authentication.
You will commonly see S/MIME or secure email, an encrypted file
system, and some other EKUs that are included.
And that's fine if you want to use that certificate for those
other things, but the minimum requirement to support VPN user
authentication is client authentication.
The subject name of the certificate is the user's common name.
But importantly, the alternative name needs to be populated
with the UPN, the User Principal Name.
That's what we're actually going to use to authenticate to Active Directory.
It's also essential to enroll this certificate to a
TPM exclusively whenever possible.
And the reason for that is the TPM affords us a great deal of
security for a certificate that's pretty important.
If an attacker were to compromise this certificate,
they could access our network without even knowing the user's passwords.
So we want to ensure that this certificate is well protected,
especially on mobile devices or portable platforms like laptops and tablets.
A TPM, if you're not familiar with it,
is actually baked into or built into the system board on laptops
and tablets, and it is a dedicated crypto processor that has many
capabilities that allow it to protect at a very high level the
private key of the certificate,
which is really the important part. It ensures that an attacker
cannot easily gain access to that, and I say not easily because
it is prohibitively difficult.
Nation‑state attackers,
perhaps NSA and those types of things, governments,
may have some way to get to this,
but the vast majority of attackers are not going to be
able to get to this certificate.
So storing it on a TPM is critical.
So let's see how we create this user certificate template tied to a TPM using Active Directory.