UniToken Integration Guide Windows 2003 Server Smart Card Configuration
Network Configuration
From the Start Menu, click on [Connect To], [Show all connections].
Right-click on the connection interface between the domain controller and client and select [Properties].
In the properties window of the connection, select [Internet Protocol (TCP/IP)] and click on [Properties].
In the "Internet Protocol (TCP/IP) Properties" window, select [Use the following IP address] and input a static IP address, subnet mask and default gateway for your server.
Select [Use the following DNS server addresses] and input the same IP address as your static IP address. We will use this server as the main DNS server
Click on [OK] on all windows to finish.
Active Directory Installation
From the start menu, click on “Run...”
Input "dcpromo", without quotation marks, and click [OK] to launch the Active Directory wizard.
On the "Active Directory Installation Wizard" welcome screen, click on [Next].
On the "Operating System Compatibility" page, click on [Next].
On the "Domain Controller Type" page, verify that [Controller for a new domain] is selected, then click [Next].
On the "Create New Domain" page, verify that [Domain in a new forest] is selected, then click [Next].
On the [New Domain Name] page, input a name for your domain, then click [Next].
On the "NetBIOS Domain Name" page, input a NetBIOS name or otherwise leave the suggested name, then click on [Next].
On the "Database and Log Folders" page, click on [Next].
On the "Shared System Volume" page, click on [Next].
On the [DNS Registration Diagnostics] page, select [Install and configure the DNS server on this computer, and set this computer to use this DNS server as its preferred DNS server], then click on [Next].
On the "Permissions" page, select [Permissions compatible only with Windows 2000 or Windows Server 2003], then click on [Next].
On the "Directory Service Restore Mode Administrator Password" page, input a restore mode password, then click on [Next].
On the "Summary" page, confirm the entered settings, then click on [Next].
After the configuration of Active Directory is completed, the Windows Server 2003 CD-ROM is required to complete the procedure.
Verify that the Active Directory has been installed successfully, then click on [Finish] to close the wizard.
IIS Installation
From the Start Menu, click on [Control Panel], [Add or Remove Programs].
Under the "Add or Remove Programs" window, choose [Add/Remove Windows Components] from the left-hand side menu.
Check [Application Server] and click on [Next].
Verify the installation was successful after completion.
Certification Authority Installation
If continuing from the previous step, return to the "Add/Remove Windows Components" window. Otherwise, from the Start Menu, click on [Control Panel], [Add or Remove Programs], then choose [Add/Remove Windows Components] from the left-hand side menu.
In the "Add/Remove Windows Components" window, check [Certificate Services]. A warning message indicating the computer name and domain may not be changed once Certificate Services is installed will appear. Click [Yes] to continue.
Verify that [Certificate Services] has been checked, and click on [Next].
In the "CA Type" step, select [Enterprise root CA], then click on [Next].
In the "CA Identifying Information" step, input the name for the CA in the field [Common name for this CA], and check that [Distinguish name suffix] corresponds to the domain name. Click on [Next] when done.
On the "Certificate Database Settings" page, click on [Next]
During the installation, a warning message indicating the IIS service must be stopped temporarily will be displayed. Click on “Yes” to continue the installation.
The installation changes will be applied.
A warning message asking if Active Server Pages is to be enabled will appear. Click on [Yes] to continue.
Verify that the component has been installed successfully and click on [Finish] to close the wizard.
Update CertSrv for Windows Vista/7
An update available from Microsoft configures the CA web interface to be resolve an issue with enrolling web certificates against a Windows Server 2003 Certificate Services Web enrollment, and improves the CA's compatibility with Windows XP to Windows Vista and 7. The file can be downloaded from https://www.microsoft.com/en-us/download/details.aspx?id=4758.
Back up your data before installing this update! SecuTech cannot be held as responsible for any data loss caused by this update.
Double-click the downloaded file to launch the installation.
Click on [Next] in the "Software Update Installation Wizard" screen.
On the [License Agreement] step, select [I agree] and click on [Next] to continue.
Changes will be applied.
Verify that the update has been successfully installed and click on [Finish] to complete.
Secure Access to Certsrv with SSL
From the Start Menu, click on [Administrative Tools], [Internet Information Services (IIS) Manager].
In the "Internet Information Services (IIS) Manager" window, navigate to [Web Sites], [Default Website] in the tree list on the left. Right-click on [Default Website], then click on [Properties].
Under the [Directory Security] tab, in the [Secure communications] section, click on [Server Certificate].
Click on [Next] in the Web Server Certificate Wizard to begin.
On the "Server Certificate" page, select [Create a new certificate], then click on [Next].
In the "Delayed or Immediate Request" step, select [Prepare the request now, but send it later] and click on [Next].
On the "Name and Security Settings" page, enter the name of the certificate, then click on [Next].
On the "Organization Information" step, input the organization and organizational unit information and click on [Next].
In the "Your Site's Common Name" step, input the name of your website and click on [Next].
Input the [Country/region], [State/province], [City/locality] and click on [Next].
Indicate the certificate request file path and name in the "Certificate Request File Name" page. Click on [Next] afterwards.
On the "Request File Summary" page, verify the information is correct, then click on [Next].
Click on [Finish] to complete the wizard.
Open Internet Explorer and go to http://(server address)/certsrv/.
Click on [Advanced certificate request]
On the page “Advanced Certificate Request”, choose [Submit a certificate request by using a base 64 encoded CMC or PKCS#10 file, or submit a renewal request by using a base 64 encoded CMC or PKCS#7 file]
With the file explorer, go to the folder where certreq.text is located and open it.
Except the first and last line, copy the whole contents of Certreq.txt and paste it in the corresponding text area in Internet Explorer.
Choose [Web server] for the Certificate template and click on [submit].
Check that DER encoded is selected and click on [Download certificate]
Click on [Save] and choose the saving destination.
Go back to the [Default web site Properties] screen and open [Server Certificate]
On the first screen of the wizard, click on [Next]
In the pending certificate Request screen, select [Process the pending request and install the certificate]
On the [Process a Pending Request] page, check that the correct file is selected and click on [Next]. If the file path is incorrect, click on [Browse…] and select the correct file.
On the [SSL Port] page, check that the SSL port is correct and click on [Next]
Click on the button [Finish] to close the wizard.
Go back to the screen [Internet Information Service (IIS) manager] and expand [Default web site], Right-click on the element [CertSrv] inside it, select [Properties]
In the tab [Directory Security], click on the [Edit…] button located under Secure communications.
In the tab [Secure Communications], check [Require secure channel (SLL)] and [Require 128-bit encryption]. Verify that [Ignore client certificates] is selected and select [Enable client certificate mapping].
Create Users in Active Directory
Click in order on [Start] [Administrative tools] [Active directory Users and Computers]
From the tree list on the left, right click on [domain] [Users], then from the right menu [New] [User].
Enter the information about the new user and click on [Next]
Fill in the [password] and [confirm password] fields. Depending on your needs, select the corresponding options and click on [Next]
Verify the information about the new user and click [Finish] to close the window.
Set Access Rights for Certificate Templates
In the start menu, select [Run…]
Type [certtmpl.msc] and press [OK]
On the Certtmpl page, right-click [SmartCard User] from the list on the right and select [Properties]
In the [security] tab, click on [Add] to add a new user to the list.
Select the user previously created (UniTokenPRO) and click OK to apply.
In the [security] tab, select UniTokenPRO and check [Read] and [Enroll]. Click on [OK] to finish.
Choose Certification Authority from [Start] [Administrative tools]
On the [Certification Authority] page, right-click on certificate template, select [New] – [Certificate template to issue]
Select [SmartCard User] and press OK.
