So let's move on and deploy a PKCS certificate using Intune.
So to begin,
what we're going to do is create a certificate template that we're
going to use for Intune to enroll our certificates for.
So I'm going to open the Certification Authority Management console snap‑in,
and again, you can do this on a CA or a management workstation,
it really doesn't matter.
I'm going to right‑click on Certificate Templates and then choose Manage.
Now I'll find the User authentication certificate template.
I'm going to right‑click, choose Duplicate Template,
and then here, I'm going to uncheck Show resulting changes and in for the CA,
I'm going to select 2008 R2 and for the recipient,
Windows 7 2008 R2.
This is critical because if you choose a version later,
this will basically make this template unusable for PKCS.
So if it sounds like I'm choosing an older certificate,
I'm actually doing that by design.
PKCS does not support anything newer than version 3
templates, and this is the latest server version and client
version for a version 3 template.
So we'll click General, and now I'm going to give this a descriptive name,
and I'm going to uncheck Publish in Active Directory,
that's not required here.
Then I will go to the Request Handling tab and want to ensure that
Allow private key to be exported is selected,
and this is critical because, again,
the PKCS server where we installed the connector on
is going to generate the key pair.
So we'll select that.
So we'll go to the Cryptography tab, and here,
we'll select Key Storage Provider, we'll leave the RSA algorithm as the default,
2048‑bit is the standard key size for RSA,
and then you can select SHA256 for the request hash size.
We'll go to the Subject Name,
and here we're going to check Supply in the request.
Now it's going to give us a bit of a scary warning
here telling us that this is a risk.
Indeed it is because anytime you allow a principle to
supply the subject name in the request, that is,
again, inherent security risk here, but it's a necessary evil,
it's one that we need to kind of accept in order to use this technology.
So moving on, we'll go to the Extensions tab.
Here, we're going to click Edit, and we're going to remove everything,
except Client Authentication.
The only thing we need on this certificate template is Client Authentication,
that's the only requirement there.
And then finally, we're going to go to the Security tab,
and here I'm going to remove Domain Users,
and then I'm going to add, in this case,
the server name of the the server where I've installed the PKCS connector.
We're going to do that in a little bit here,
but in this case, I already have a server prepared.
It's just a domain join member server,
so I'll go ahead and enter that information here.
And then I'm going to grant that Read and Enroll.
So then we'll click OK.
And next, I'm going to go ahead and publish this template.
So I'm going to actually come back to the Certificate
Template folders and choose New, Certificate Template to Issue,
and hopefully this shows up.
And if it does not,
you may have to wait for Active Directory replication in your environment,
but here, we just have a single domain controller,
so we'll just click OK. And now we have published this certificate.