To create our Device Authentication certificate template, we're going to
duplicate the Workstation Authentication template this time.
So we'll right‑click, choose Duplicate Template. And once again,
uncheck Show resulting changes, select 2016 for the server, Windows
10 for the endpoint. Go to the General tab, and we'll give it a
name. Once again, your one‑year validity period is fine. Don't
publish in Active Directory.
We'll go to the Cryptography tab. Here, we're going to
select Key Storage Provider once more.
And in this case, once again,
much like the User Authentication template, this is a certificate
that's going to be enrolled for by devices that we don't have
physical control over all the time, right?
So these are laptops and tablets.
We want to select Requests must use one of the following providers and
select Platform Crypto Provider. And much like I discussed on the User
template, if you have exceptions to this,
I would treat them as such and have a separate template that uses the KSP
and have them enroll manually for them and know that you are actually
enrolling a certificate in a rather non‑secure way.
So we'll bump the Request hash up to SHA256. We'll go to the Subject Name
field, and here we want to select DNS name from the Subject name format and
ensure that DNS name is selected here and only the DNS name. We'll go to the
Extensions tab. And here, the application policy that's already defined is
Client Authentication, and we don't have to make any changes here because
that's all we need for this template.
So we'll go to the Security tab, and here we want to remove Domain
Computers, and we'll add our VPN Devices group, and we'll also grant Read, Enroll, and Autoenroll permissions here as well.