UniToken Integration Guide Windows 2003 Server Smart Card Configuration
Network Configuration
From the Start Menu, click on [Connect To], [Show all connections]
Right-click on the connection interface between the domain controller and client and select [Properties].
In the properties window of the connection, select [Internet Protocol (TCP/IP)] and click on [Properties].
In the "Internet Protocol (TCP/IP) Properties" window, select [Use the following IP address] and input a static IP address, subnet mask and default gateway for your server.
Select [Use the following DNS server addresses] and input the same IP address as your static IP address. We will use this server as the main DNS server
Click on [OK] on all windows to finish.
Active Directory Installation
From the start menu, click on “Run...”
Input "dcpromo", without quotation marks, and click [OK] to launch the Active Directory wizard.
On the "Active Directory Installation Wizard" welcome screen, click on [Next].
On the "Operating System Compatibility" page, click on [Next].
On the "Domain Controller Type" page, verify that [Controller for a new domain] is selected, then click [Next].
On the "Create New Domain" page, verify that [Domain in a new forest] is selected, then click [Next].
On the [New Domain Name] page, input a name for your domain, then click [Next].
On the "NetBIOS Domain Name" page, input a NetBIOS name or otherwise leave the suggested name, then click on [Next].
On the "Database and Log Folders" page, click on [Next].
On the "Shared System Volume" page, click on [Next].
On the [DNS Registration Diagnostics] page, select [Install and configure the DNS server on this computer, and set this computer to use this DNS server as its preferred DNS server], then click on [Next].
On the "Permissions" page, select [Permissions compatible only with Windows 2000 or Windows Server 2003], then click on [Next].
On the "Directory Service Restore Mode Administrator Password" page, input a restore mode password, then click on [Next].
On the "Summary" page, confirm the entered settings, then click on [Next].
After the configuration of Active Directory is completed, the Windows Server 2003 CD-ROM is required to complete the procedure.
Verify that the Active Directory has been installed successfully, then click on [Finish] to close the wizard.
IIS Installation
From the Start Menu, click on [Control Panel], [Add or Remove Programs].
Under the "Add or Remove Programs" window, choose [Add/Remove Windows Components] from the left-hand side menu.
Check [Application Server] and click on [Next].
Verify the installation was successful after completion.
Certification Authority Installation
If continuing from the previous step, return to the "Add/Remove Windows Components" window. Otherwise, from the Start Menu, click on [Control Panel], [Add or Remove Programs], then choose [Add/Remove Windows Components] from the left-hand side menu.
In the "Add/Remove Windows Components" window, check [Certificate Services]. A warning message indicating the computer name and domain may not be changed once Certificate Services is installed will appear. Click [Yes] to continue.
Verify that [Certificate Services] has been checked, and click on [Next].
In the "CA Type" step, select [Enterprise root CA], then click on [Next].
In the "CA Identifying Information" step, input the name for the CA in the field [Common name for this CA], and check that [Distinguish name suffix] corresponds to the domain name. Click on [Next] when done.
On the "Certificate Database Settings" page, click on [Next]
During the installation, a warning message indicating the IIS service must be stopped temporarily will be displayed. Click on “Yes” to continue the installation.
The installation changes will be applied.
A warning message asking if Active Server Pages is to be enabled will appear. Click on [Yes] to continue.
Verify that the component has been installed successfully and click on [Finish] to close the wizard.
Update CertSrv for Windows Vista/7
This update makes the CA web interface compatible with Windows Vista and 7, and improves the reliability with Windows XP. You can download it from Microsoft website. Double-click the downloaded file to launch the installation.
Back up your data before installing this update! SecuTech cannot be held as responsible for any data loss caused by this update.
To continue the installation, click on [Next].
In the license agreement screen [License Agreement], select [I agree] and click on [Next].
Please wait until your system is updated.
Verify that the update has been installed successfully and click on [Finish]
Secure Access to Certsrv with SSL
Select Internet Information Services (IIS) Manager from [Start] [Administrative Tools] [Internet Information Services (IIS) Manager]
Right click on [Default Website] located in the tree list on the left [Web Sites] [Default Website].
In the tab [Directory Security], click on [Server Certificate] in the section [Secure communications]
On the first screen of the Web Server Certificate wizard, click on [Next] to begin.
On the [Server Certificate] page, select [Create a new certificate] and click on [Next].
On the [Delayed or Immediate Request] page, select [Prepare the request now, but send it later] and click on [Next].
On the [Name and Security Settings] page, enter the name of the certificate and click on [Next].
Enter the name of the company and the organizational unit name and click on [Next]
Indicate the name of your website and click on [Next].
Indicate [Country/region] [State/province] [city/locality] and click on [Next].
Indicate where to save the certificate request file and its name.
On the [Request File Summary] page, check that your information is correct and click on [Next].
Click on [Finish] to create the request file.
Open Internet Explorer and go to http://(server address)/certsrv/.
Click on [Advanced certificate request]
On the page “Advanced Certificate Request”, choose [Submit a certificate request by using a base 64 encoded CMC or PKCS#10 file, or submit a renewal request by using a base 64 encoded CMC or PKCS#7 file]
With the file explorer, go to the folder where certreq.text is located and open it.
Except the first and last line, copy the whole contents of Certreq.txt and paste it in the corresponding text area in Internet Explorer.
Choose [Web server] for the Certificate template and click on [submit].
Check that DER encoded is selected and click on [Download certificate]
Click on [Save] and choose the saving destination.
Go back to the [Default web site Properties] screen and open [Server Certificate]
On the first screen of the wizard, click on [Next]
In the pending certificate Request screen, select [Process the pending request and install the certificate]
On the [Process a Pending Request] page, check that the correct file is selected and click on [Next]. If the file path is incorrect, click on [Browse…] and select the correct file.
On the [SSL Port] page, check that the SSL port is correct and click on [Next]
Click on the button [Finish] to close the wizard.
Go back to the screen [Internet Information Service (IIS) manager] and expand [Default web site], Right-click on the element [CertSrv] inside it, select [Properties]
In the tab [Directory Security], click on the [Edit…] button located under Secure communications.
In the tab [Secure Communications], check [Require secure channel (SLL)] and [Require 128-bit encryption]. Verify that [Ignore client certificates] is selected and select [Enable client certificate mapping].
Create Users in Active Directory
Click in order on [Start] [Administrative tools] [Active directory Users and Computers]
From the tree list on the left, right click on [domain] [Users], then from the right menu [New] [User].
Enter the information about the new user and click on [Next]
Fill in the [password] and [confirm password] fields. Depending on your needs, select the corresponding options and click on [Next]
Verify the information about the new user and click [Finish] to close the window.
Set Access Rights for Certificate Templates
In the start menu, select [Run…]
Type [certtmpl.msc] and press [OK]
On the Certtmpl page, right-click [SmartCard User] from the list on the right and select [Properties]
In the [security] tab, click on [Add] to add a new user to the list.
Select the user previously created (UniTokenPRO) and click OK to apply.
In the [security] tab, select UniTokenPRO and check [Read] and [Enroll]. Click on [OK] to finish.
Choose Certification Authority from [Start] [Administrative tools]
On the [Certification Authority] page, right-click on certificate template, select [New] – [Certificate template to issue]
Select [SmartCard User] and press OK.
