A Smart Card enrollment station for use in enterprises with Microsoft Active Directory Certificate Services and certificate-based logons. This software package will streamline some operations such as enrolling and terminating Smart Card devices.
This project is an entry in the YubiKing 2015 competition and should be considered a work in progress.
The original project is archived. (https://github.com/CSIS/EnrollmentStation) But we need the application including Yubikey 5 Support for hybrid environments with Linux, Windows and MacOS clients. Using container based Yubikeys with help of the Yubico Windows smartcard minidriver was not an option.
- Windows PKI (Active Directory Certificate Services)
- Enrollment Agent Certificate (see prerequisites)
- CCID smart cards from Yubico (currently Yubikey NEO, Yubikey 4 and Yubikey 5 NFC)
- (optional) YubiHSM
You can find the latest binaries at our releases page.
To use this tool you will need an Enrollment Agent Certificate which allows you to enroll certificates on behalf of other users. This certificate template is available on a default Active Directory Certificate Services (Windows CA) installation but is normally not permitted for any users other than Domain Admins. For added security, create a dedicated user which is used as the enrollment station user.
A. Setup Enrollment Agent certificate template permissions
- Log on to your Windows Certificate Authority
- Open the Certificate Authority control panel
- Right-click the
Certificate Templates
folder and choseManage
- Find the
Enrollment Agent
template, right-click on it and choseProperties
- In the security tab, allow your enrollment station user to enroll the certificate.
After a while, the template should be available to the enrollment station user through the Certificates snap-in in MMC.
B. Enroll the Enrollment Agent certificate
- Log on to your enrollment station as your enrollment user and open MMC.
- In MMC, add the Certificates snap-in for the current user, and expand the Personal folder.
- Right-click on the Certificates folder and chose
Request new Certificate
. Follow the wizard, and select theEnrollment Agent
template when asked for a template.
After setting up the Enrollment Agent certificate, you need a YubiKey set to CCID Smart Card mode.
C. Changing YubiKey to CCID Smart Card mode
- Download YubiKey YubiKey Manager from here https://developers.yubico.com/yubikey-manager/
- In the GUI application (ykman-gui.exe) under
Interfaces
select on the left USB sectionPIV
- Save the new settings with click on
Save Interfaces
Alternativ use the CLI application (ykman.exe) and enter ykman mode CCID
You can also read our Manual to find methods with accompanying screenshots.
See the pdf manual, at Manual-GUI.pdf
This project makes use of the following open source projects
- Handle more diverse PKI setups
- Encrypt the configuration
- Describe revoke procedure and requirements thereto (permissions, COM object .. )
- Support to save multiple certificates into slot 9a