UniToken Integration Guide Windows 2003 Server Smart Card Configuration
Network configuration
Click on the start button, inside “Connect To”, open “Show all connections
Right-click on the icon of the connection between clients and the domain controller and select “Properties”
In the properties window of the connection, select Internet Protocol (TCP/IP) and click on the “properties” button just below.
In the Internet Protocol (TCP/IP) Properties window, select [Use the following IP address] and input the static IP address, subnet mask and default gateway for your server.
For DNS settings, select [Use the following DNS server addresses] and input the same IP address as your static IP address.(We will use this server as the main DNS server)
Active Directory Installation
In the start menu, choose “Run…”
Input “dcpromo” and click OK to launch the Active Directory wizard.
On the Active directory wizard welcome screen, click on [Next]
On the [Operating system compatibility] page, click on [next].
On the [Domain Controller Type] page, Verify that [Controller for a new domain] is selected and click [Next]
On the [Create New domain] page, verify that [Domain in a new forest] is selected and click on the button [Next]
On the [New Domain Name] page, input a name for your domain and click on [Next]
On the [NetBios domain name] page, accept the suggested NetBios name or input a new one. Then, click on [Next]
On the [Database and log folders] page, click on [Next]
On the [Shared System Volume] page, click on the button [Next]
On the [DNS Registration Diagnostics] page, select [Install and configure the DNS server on this computer, and set this computer to use this DNS server as its preferred DNS server] and click on [Next].
On the [Permissions] page, select [Permissions compatible only with Windows 2000 or Windows Server 2003] and click on [Next].
On the [Directory Service Restore Mode Administrator Password] page, set the password for the administrator of the restore mode and click on [Next].
On the [Summary] page, verify the settings that you have input until now and click on [Next].
Wait until the configuration of Active Directory ends. To complete the procedure, Windows Server 2003 CD-ROM is required.
This screen reports if Active Directory has been installed correctly or not. Check that there is no error and click [Finish] to close the wizard.
IIS Installation
Choose [Start] – [Control panel] – [Add or Remove Programs]
Choose [Add/Remove Windows Components]
Check [Application Server] and click on [Next]
Wait until the installation of IIS completes.
Certification Authority Installation
Return to the [Add/Remove Windows Components screen] and check the box Certificate Services. A message warning you that you cannot change computer name and domain once you have installed Certificate services will appear. Click on “Yes” to continue.
Verify that [Certificate Services] has been checked correctly and click on [Next]
Select [Enterprise root CA] and click on [Next]
Indicate the name for the CA inside the field [Common name for this CA] and check that [Distinguish name suffix] matches the domain name.
On the [Certificate Database Settings] page, click on [Next]
During the Installation, a warning message [To complete the installation, the IIS service must be stopped temporarily] will be displayed. Click on “Yes” to continue the installation.
Please wait while the installation files are copied
When the warning message [Do you want to enable ASP now] is displayed, click on [Yes].
Verify that the component has been installed successfully and click on “finish” to close the wizard.
Update the CertSrv pages for Windows Vista/Seven
This update makes the CA web interface compatible with Windows Vista and 7, and improves the reliability with Windows XP. You can download it from Microsoft website. Double-click the downloaded file to launch the installation.
Back up your data before installing this update! SecuTech cannot be held as responsible for any data loss caused by this update.
To continue the installation, click on [Next].
In the license agreement screen [License Agreement], select [I agree] and click on [Next].
Please wait until your system is updated.
Verify that the update has been installed successfully and click on [Finish]
Secure Access to Certsrv with SSL
Select Internet Information Services (IIS) Manager from [Start] [Administrative Tools] [Internet Information Services (IIS) Manager]
Right click on [Default Website] located in the tree list on the left [Web Sites] [Default Website].
In the tab [Directory Security], click on [Server Certificate] in the section [Secure communications]
On the first screen of the Web Server Certificate wizard, click on [Next] to begin.
On the [Server Certificate] page, select [Create a new certificate] and click on [Next].
On the [Delayed or Immediate Request] page, select [Prepare the request now, but send it later] and click on [Next].
On the [Name and Security Settings] page, enter the name of the certificate and click on [Next].
Enter the name of the company and the organizational unit name and click on [Next]
Indicate the name of your website and click on [Next].
Indicate [Country/region] [State/province] [city/locality] and click on [Next].
Indicate where to save the certificate request file and its name.
On the [Request File Summary] page, check that your information is correct and click on [Next].
Click on [Finish] to create the request file.
Open Internet Explorer and go to http://(server address)/certsrv/.
Click on [Advanced certificate request]
On the page “Advanced Certificate Request”, choose [Submit a certificate request by using a base 64 encoded CMC or PKCS#10 file, or submit a renewal request by using a base 64 encoded CMC or PKCS#7 file]
With the file explorer, go to the folder where certreq.text is located and open it.
Except the first and last line, copy the whole contents of Certreq.txt and paste it in the corresponding text area in Internet Explorer.
Choose [Web server] for the Certificate template and click on [submit].
Check that DER encoded is selected and click on [Download certificate]
Click on [Save] and choose the saving destination.
Go back to the [Default web site Properties] screen and open [Server Certificate]
On the first screen of the wizard, click on [Next]
In the pending certificate Request screen, select [Process the pending request and install the certificate]
On the [Process a Pending Request] page, check that the correct file is selected and click on [Next]. If the file path is incorrect, click on [Browse…] and select the correct file.
On the [SSL Port] page, check that the SSL port is correct and click on [Next]
Click on the button [Finish] to close the wizard.
Go back to the screen [Internet Information Service (IIS) manager] and expand [Default web site], Right-click on the element [CertSrv] inside it, select [Properties]
In the tab [Directory Security], click on the [Edit…] button located under Secure communications.
In the tab [Secure Communications], check [Require secure channel (SLL)] and [Require 128-bit encryption]. Verify that [Ignore client certificates] is selected and select [Enable client certificate mapping].
Create the user in Active Directory
Click in order on [Start] [Administrative tools] [Active directory Users and Computers]
From the tree list on the left, right click on [domain] [Users], then from the right menu [New] [User].
Enter the information about the new user and click on [Next]
Fill in the [password] and [confirm password] fields. Depending on your needs, select the corresponding options and click on [Next]
Verify the information about the new user and click [Finish] to close the window.
