UniToken Integration Guide Windows 2008 Server Smart Card Configuration
Network configuration
Click on the start button, and choose “Server Manager”
Click on [View Network Connections] on the right of the window.
Right-click on the icon of the connection between clients and the server and select “Properties”
In the properties window of the connection, select “Internet Protocol (TCP/IPv4)” and click on the “properties” button just below.
In the Internet Protocol (TCP/IP) Properties window, select [Use the following IP address] and input the static IP address, subnet mask and default gateway for your server.
For DNS settings, select [Use the following DNS server addresses] and input the same IP address as your static IP address.(We will use this server as the main DNS server)
Active Directory Installation
In the start menu, choose “Run…”
Wait while the binaries for Active Directory Services are being installed.
On the Active directory wizard welcome screen, click on [Next]
On the screen [Operating system compatibility], click on [next].
On the screen [Choose a Deployment Configuration], Verify that [Create a new domain in a new forest] is selected and click [Next]
On the screen [Name the Forest Root Domain], input a name for your domain and click on [Next]
On the screen [Set Forest Functional level(1)], keep the default settings and click on [Next]
On the screen [Set Forest Functional level(2)], keep the default settings and click on [Next]
In the screen [Additional Domain Controller Options], make sure that the option [DNS Server] is checked and click on [Next]
In the dialog box [Active Directory Domain Services Installation Wizard], click on the button [Yes] when you are asked [Do you want to continue?]
Please note, in this tutorial, we suppose that the preferred DNS on the local network is our server and that DNS information are distributed to clients by the DHCP service installed on this server.
On the [Location for Database, Log files, and SYSVOL], click on [Next]
In the screen [Directory Service Restore Mode Administrator Password], set the password for the administrator of the restore mode and click on [Next].
In the screen [Summary], verify the settings that you have input until now and click on [Next].
Wait until the configuration of Active Directory ends.
This screen reports if Active Directory has been installed correctly or not. Check that there is no error and click [Finish] to close the wizard.
Certification Authority Installation
Please open [Start] – [Server Manager]
From the left pane, click on [Roles]
In the right of the window, Click on [Add Roles]
On the screen [Before You Begin], click on [Next]
Select [Active Directory Certificate Services]
On the [Introduction to Active Directory Certificates Services] page, click on [Next]
On the [Select Roles Services] page, make sure that [Certification Authority] is checked, and also check [Certification Authority Web Enrollment]
In the dialog bog asking you if you want to install the required services and function for web enrollment appears, click on [Add Required Role Services]
Make sure that [Certification Authority Web Enrollment] and click on [Next]
On the [Specify Setup Type] page, select [Enterprise]
On the [Specify CA Type] page, select [Root CA]
On the [Set Up Private Key] page, click on [Next]
On the [Configure Cryptography for CA] page, click on [Next]
On the [Configure CA Name] page, accept the proposed CA Name or enter another name. Click on [Next]
On the [Set Validity Period] page, click on [Next]
On the [Configure Certificate Database] page, click on [Next].
On the [Web Server(IIS)] page, click on [Next]
On the [Select Role Services], verify that the required services have been automatically selected and click on [Next].
On the [Confirm Installation Selections] page, verify the information about the installation and click on [Install] to begin the installation.
On the [Installation Results] page, verify that the installation has been completed correctly and click on [Close]
Secure Access to Certsrv with SSL
In the [Start] menu, choose [Administrative Tools] then [Internet Information Services (IIS) Manager]
In the left pane, click on the computer icon, then in the main window double-click on [Server Certificate] to open.
On the [Server Certificates] page, from the menu on the right, choose [Self-Signed Certificates]
On the [Specify Friendly Name] page, enter a name for the certificate and click on OK.
In the left pane, right click on [Default web site] and choose [Edit Bindings…]
On the [Site Bindings] page, click on [Add]
Perform the following settings
- Type: https
- IP address: All Unassigned
- Port: 443
- Certificate: (the certificate created just before)
Click on [OK].
Click on [CertSrv] located inside [Default Web Site]. Related icons will appear in the main window. Double-click on [SSL settings].
On the [SSL Settings] page, Check [Require SSL] and [Require 128-bit SSL]. Under Client certificates, select [Ignore] and click on [Apply] to save changes.
Create the user in Active Directory
Click in order on [Start] [Administrative tools] [Active directory Users and Computers]
From the tree list on the left, right click on [domain] [Users], then from the right menu [New] [User].
Enter the information about the new user and click on [Next]
Fill in the [password] and [confirm password] fields. Depending on your needs, select the corresponding options and click on [Next]
Verify the information about the new user and click [Finish] to close the window.
Set access rights for certificate templates
In the [Start] menu, type [certtmpl.msc] and press the Enter key.
In the screen Certtmpl, right-click [SmartCard User] from the list on the right and select [Properties]
In the [Security] tab, click on [Add] to add a new user to the list.
Select the user previously created (UniTokenPRO) and click OK to apply.
In the [security] tab, select UniTokenPRO and check [Read] and [Enroll]. Click on [OK] to finish.
Choose Certification Authority from [Start] [Administrative tools]
In the screen [Certification Authority], right-click on certificate template, select [New] – [Certificate template to issue]
Select [SmartCard User] and press OK.
