So the process of creating a user authentication
certificate using PKCS is quite similar.
So we'll go through the same steps here.
So we'll go to Devices,
Configuration profiles, and then we'll select Create profile. And once
again select Windows 10, Templates, and PKCS certificate.
So we'll click Create, and we'll give this one another name. Choose Next.
And once again, 20% is the kind of standard there. Validity period 1 year.
KSP, same thing. We want to enroll two KSP, otherwise fail.
Our CA, again, is our CA servers, or in this case, the
issuing CA's fully qualified domain name.
And we'll paste in our CA authority name here as well.
And the template name is, again, this is the same template as we used before.
Again, you can use the same template, and whether or not it's a device or
user certificate is really dictated here by this profile.
And in this case, the Certificate type is a User certificate, so we'll leave
that as the default. And then the Subject name format,
the default here is okay, although I would caution you not to use the email
address because if it's not present on the AD account,
then it can cause problems.
But the username will always be there, so I'm just going to remove
that. And for the Subject alternative name here,
I'm going to select UPN, and then I will enter a user principal
name here in the curly braces. Scroll down.
And for our Extended key usage, again, we're going to use Client Authentication.
It's the same for both Device and User certificates.
They just require Client Authentication.
So finally we'll choose Next,
add a group here, and I'm going to assign this to my VPN Users because it's
a User certificate. Next and Next again and then Create.
And at that point, I have deployed a PKCS
certificate for our Always On VPN users.
Any users in that group now, once they sync within Intune, will pick up that certificate.