So to create this user certificate template,
we are going to duplicate the, yes you guessed it, User certificate template.
So we'll right‑click, choose Duplicate Template.
And here, we're going to once again uncheck Show resulting changes,
choose Windows Server 2016 or whatever your latest CA is
there, and the same thing, Certificate recipient is
Windows 10 or Windows Server 2016.
Go to the General tab, and we'll provide a descriptive
name here. And here, once again,
validity period's fine, one year. The option to
publish in Active Directory is checked.
We need to make sure that we uncheck this.
This is completely unnecessary for 99.9% of the certificates you'll ever use.
It is not necessary here, so please uncheck it. Checking it doesn't
do anything in terms of performance or security.
It doesn't break anything, but it does kind of populate Active Directory user
objects with a certificate that is completely unnecessary.
So, it can lead to object bloat and user account bloat in Active
Directory, so we definitely don't want to choose that.
So we'll go to the Request Handling tab. And by default,
Allow private key to be exported is checked.
We want to uncheck that.
That's very critical.
And then we'll go to the Cryptography tab. And here, once again,
we'll choose the Key Storage Provider, and this is critical for a
user certificate or any certificate that's going to be deployed to
a mobile or portable platform.
We want to select the option Requests must use one of the following providers.
And here we're going to select Microsoft Platform Crypto Provider.
The Microsoft Platform Crypto Provider is the provider used by the
TPM on the endpoint. So this ensures that this request can only be
made from a device that has a TPM.
Now, I will give you or will share with you that it's possible you may want to
enroll a certificate for a user who does not have a TPM.
I would avoid that as much as possible.
Most modern hardware devices today have the TPM, so we want to
make sure we use it as much as possible.
I would also suggest that if you have a need or requirement to issue
a user certificate to a user who has a device that does not have a
TPM, that that would be an exception.
My suggestion is make another template that uses the software
key storage provider and go that route.
It is possible to prefer the platform crypto provider by
clicking this green arrow button here,
pushing it to the top, and also selecting Software Key Storage Provider.
This means that it would prefer the crypto provider, but fall
back to the KSP, or the key storage provider.
I prefer not to do that because it's an unknown.
It means that I don't know for certain that most of my
devices or all of them have the platform crypto provider or
the TPM‑protected certificate.
So in this case, I'm recommending that you uncheck this box. that you
leave it set to Platform Crypto Provider only and then deal with anybody
who needs a certificate on a device without a TPM as exceptions. Create a
separate template and maybe a manual enrollment process, and make sure
that somebody in your organization accepts the risk for that because that
is a huge risk.
We'll also bump the Request hash up to SHA256, and then we'll go
to the Extensions tab. And here, as I said before, the default is
to conclude EFS and Secure Email.
We don't need either of these.
You certainly can leave them, but I prefer to remove them.
So we'll click Edit, and we'll remove EFS, and we will remove Secure
Email. That leaves us with just Client Authentication, and honestly
that's all we need for this template.
So we'll click OK, and we'll move to the Subject Name field. Here again,
we'll build from Active Directory. We're going to select the
Common name as the Subject name format. By default, the Include
e‑mail name in subject name is selected.
We don't need that.
And I suggest that you remove it because if you do have
the email name in the user account,
that's great, but if you don't have it defined, it can be
problematic in the future. I also suggest removing it from
the alternative name field as well.
The only thing we really need here is UPN, or User Principal Name,
and that's really the critical aspect of that.
So then we'll go to the Security tab, and here we're
going to remove our Domain Users.
And now we will add our VPN Users group. And we will grant this group
Read, Enroll, and Autoenroll. Once that's done, click OK.