UniToken Integration Guide Windows 2008 Server Smart Card Configuration
Network Configuration
From the Start Menu, and click on [Server Manager].
Click on [View Network Connections]on the right-hand side of the window under "Server Summary", "Computer Information".
Right-click on the connection interface used between clients and the server and select [Properties].
In the properties window of the connection, highlight [Internet Protocol (TCP/IPv4)] and click on [Properties] below.
In the "Internet Protocol Version 4 (TCP/IPv4) Properties" window, select [Use the following IP address] and input a static IP address, subnet mask and default gateway for your server.
Select [Use the following DNS server addresses] and input the same IP address as your static IP address. This server will be used as the main DNS server.
Click on [OK] on all windows to finish.
Active Directory Installation
From the Start Menu, click [Run...] or in the search box from the Start Menu, type "dcpromo", without quotation marks, and press [Enter].
Wait while the binaries for Active Directory Services are being installed.
On the "Active Directory Domain Services Installation Wizard" welcome screen, click on [Next].
On "Operating System Compatibility" step, click on [next].
On the "Choose a Deployment Configuration" step, verify that [Create a new domain in a new forest] is selected and click [Next].
On the "Name the Forest Root Domain" step, input a name for the domain and click on [Next].
On the "Set Forest Functional Level" step, keep the default settings and click on [Next].
On the following "Set Forest Functional Level" step, keep the default settings and click on [Next].
In the screen [Additional Domain Controller Options], check the option [DNS Server] and click on [Next]
In the dialog box "Active Directory Domain Services Installation Wizard", click on [Yes] when asked "Do you want to continue?" to continue.
Please note, in this tutorial, we are assuming the preferred DNS on the local network is our server and that DNS information is distributed to clients by the DHCP service installed on this server.
On the "Location for Database, Log Files, and SYSVOL" step, click on [Next].
On the "Directory Service Restore Mode Administrator Password" ste[, set the password for the administrator of restore mode and click on [Next].
In the "Summary" screen , verify the settings up to now are correct, then click [Next] to continue.
Wait until the configuration of Active Directory is completed.
Click [Finish] to close the wizard.
Certification Authority Installation
From the Start Menu, click on [Server Manager].
From the left-hand side pane, click on [Roles].
In the right-hand side of the window, click on [Add Roles].
Click [Next] on the screen [Before You Begin] to begin.
On the "Select Server Roles" step, select [Active Directory Certificate Services], then click [Next].
On the "Introduction to Active Directory Certificates Services" page, click on [Next]
On the "Select Role Services" page, check [Certification Authority] and [Certification Authority Web Enrollment], then click [Next].
In the "Add Roles Wizard" dialog box, click on [Add Required Role Services].
Make sure that [Certification Authority Web Enrollment] and click on [Next].
On the "Specify Setup Type" page, select [Enterprise], then click [Next].
On the "Specify CA Type" page, select [Root CA], and click [Next].
On the "Set Up Private Key" page, click [Next].
On the "Configure Cryptography for CA" page, click [Next].
On the "Configure CA Name" page, accept the proposed CA Name or otherwise input a new CA name. Click on [Next].
On the "Set Validity Period" page, click on [Next].
On the "Configure Certificate Database" page, click on [Next].
On the "Web Server(IIS)" page, click on [Next]
On the "Select Role Services", verify that the required services have been selected and click on [Next].
On the "Confirm Installation Selections" page, verify installation information is correct, then click on [Install] to begin the installation.
On the "Installation Results" page, verify that the installation has been completed successfully, then click on [Close] to complete.
Secure Access to Certsrv with SSL
From the Start Menu, click [Administrative Tools], [Internet Information Services (IIS) Manager].
In the left pane, select the corresponding server under "Connection", then in the main window double-click on [Server Certificates].
On the [Server Certificates] page, from the "Actions" menu on the right, click on [Create Self-Signed Certificate...].
In the "Create Self-Signed Certificate" window, on the "Specify Friendly Name" step, enter a name for the certificate and click on [OK].
In the left pane, under "Sites", right-click on [Default Web Site] and click [Edit Bindings...].
On the [Site Bindings] window, click [Add].
Modify the following settings"
- Type: https
- IP address: All Unassigned
- Port: 443
- Certificate: (the certificate created earlier)
Click [OK].
Click on [CertSrv] within [Default Web Site] from the left pane. Double-click on [SSL settings].
On the "SSL Settings" page, check [Require SSL] and [Require 128-bit SSL]. Under "Client certificates", select [Ignore] and click on [Apply] to save changes.
Create Users in Active Directory
From the Start Menu, click [Administrative tools], [Active directory Users and Computers].
From the tree list on the left under the "Active Directory Users and Computers" window, right click on [(Domain)], [Users], then from the popup menu [New], [User].
Complete the form on the new user and click [Next].
Fill in the [Password] and [Confirm password] fields. Choose the corresponding options as needed and click on [Next].
Verify information about the new user is correct and click [Finish] to close the window.
Set Access Rights for Certificate Templates
From the Start Menu, click [Run...] or in the search box from the Start Menu, type "certtmpl", without quotation marks, and press [Enter].
In the "Certificate Templates Console" window, right-click [Smartcard User] from the list on the right and click [Properties].
Under the [Security] tab, click on [Add] to add a new user to the list.
Select the user previously created (UniTokenPRO in this example) and click [OK] to apply.
Back on the [Security] tab, select the newly added user and check [Read] and [Enroll] for the user's permissions. Click on [OK] to finish.
From the Start Menu, click on [Administrative Tools], [Certification Authority].
On the "Certification Authority" window, right-click on [Certificate Template], and select [New], [Certificate Template to Issue].
Under the "Enable Certificate Templates" window, select [Smartcard User] and click [OK] to finish.
