The idea of a smart card is that it generates the public-private key pair within secure storage of the card itself, and lets you get only the public key out. Smart Card Authentication to Active Directory requires that Smartcard workstations, Active Directory, and Active Directory domain controllers be configured properly. Certificate will be reflect in the Local Machines on the client computer once deployed, In the File to import choose downloaded CA certificate file. Go to File > Add / Remove Snap In Double Click Certificates Select Computer Account. Scroll to the bottom of the list and select Thumbprint. is there such a thing as "right to be heard"? Request a smart card certificate from the third-party CA. In that case, youll get an error message like There is a problem with this websites security certificate, and the browser might block communication with the website. To verify that a CRL is online and available from an FTP or HTTP CDP: To download or verify that a Lightweight Directory Access Protocol (LDAP) CDP is valid, you must write a script or an application to download the CRL. The object can also be created manually by using ADSIedit.msc in the Windows 2000 Support tools or by using LDIFDE. The valid smartcard certificate must be installed on the smartcard with the private key and the certificate must match a certificate stored in the smartcard user's profile on the smartcard workstation. Press the\u00a0Win\u00a0key +\u00a0R\u00a0hotkey to open the Run dialog."}},{"@type":"HowToStep","url":"https://windowsreport.com/install-windows-10-root-certificates/#rm-how-to-block_c8e8fa50beed8e83a3c5f2b69cc11e58-","itemListElement":{"@type":"HowToDirection","text":"2. You can get started using your CAC with Firefox on Linux machines by following these basic steps: If you prefer to build CoolKey from source, instructions are included in the Configuring Firefox for the CAC guide. Making statements based on opinion; back them up with references or personal experience. Every CA Certificate except the root CA in the certificate chain contains a valid CDP extension in the certificate. To determine what card stock you have, look at the back of your CAC above the magnetic strip. and now you can't access CAC enabled sites. Start ADSIedit.. Application Pool SecureAuth0Pool Has Been Disabled, Certificate is not received using Keygen, even with a success page, Certificate not received on Ubuntu-Firefox (SA Version 6.3.2), Cisco Integration Certificate Enrollment loop issue, Citrix AX and certificate enrollment issue, CRL Revocation Check Failure Due to Local System Account Proxy Setting, General Access denied due to permission settings, Integrated Windows Authentication (IWA) Troubleshooting, Not authorized to view this page: IP restrictions, SecureAuth IdP FileSync Service Troubleshooting, Issues with SecureAuth IdP Java Applets Running 7u25, 7u40, 7u45, Security Scan Vulnerability - "Cross Site Scripting / Cross Frame Scripting", TLS 1.2 Communication Problems with Excessive Root Certificates, Users are Being Prompted for a Java Update, SecureAuth IdP / Identity Platform Appliance audit trail event ID list, .NET Forms Based Authentication (FBA) Web Integration Guide, Add Multiple Websites with Different IPs on a Single NIC, Authentication API: Send ad hoc OTP without existing user profile, Block all browsers and only allow IE access to SecureAuth realm for Certificate Enrollment, How to Import DOD Certs for CAC and PIV Authentication, Certificate Revocation List (CRL) Configuration for the Cisco ASA, Certificate Revocation List (CRL) Configuration for the Juniper IVE, Certificate Revocation of X.509 (native) certificates, Certificate Validation for Federal Environments, Change SMTP Mail Settings for One-Time Password (OTP) Delivery, Check Devices for Domain Membership and Redirect if Non-Domain Joined, Check SecureAuth Appliance time from an end-user's browser, Cisco IPSec client Quick Config and Troubleshooting Guide, Configure a Custom Identity's SPN to Leverage IWA Auth, Configure a Realm for User Group Restriction, Configure a SecureAuth CRL File for NetScaler, Configure HTTP Activation on a SecureAuth Appliance, Configure SSL Termination Point Functionality, Configure UserAccountControl Flags to Manipulate User Account Properties as (UF_PASSWD_NOTREQD), Create a Custom Post Authentication Token, Create a NIC Team for Load Balancing and Failover (LBFO) in Windows Server 2012 R2, Create Customized User IDs in SAML and WS-Federation Workflows, Cryptographic Service Provider (CSP) Conversion Guide, Customize the Registration Code (OTP) Email Message, Digital Certificate Private Key Management, Disable SSL 3.0 on a SecureAuth IdP Appliance, Email Notification Service: Change Notification Verbiage. Right-click Trusted Root Certification Authorities. Did the Golden Gate Bridge 'flatten' under the weight of 300,000 people in 1987? All other people will Make sure that there is a Next Update field in the CRL and the time in the Next Update field has not passed. Cannot see / select the Authentication / PIV certificate in Smart Card Connector logs. You can enable a smart card logon process with Microsoft Windows 2000 and a non-Microsoft certification authority (CA) by following the guidelines in this article. Follow the below steps to make certificates available to Windows when automatic registration is disabled: This operation is needed only once, the first time when you use a new smart card on a new workstation. Verify that the correct Enrollment Policy is configured and click Next. If your valid smartcard certificate has expired, you may also renew the smartcard certificate, which is more complex and difficult than requesting a new smartcard certificate. My recommendation is to type: "Adobe Acrobat Reader" should be in the list of choices, select it and then You can then send the public key, along with information about yourself, as a certificate signing request to a certificate authority to get signed and thus turned into a proper cert. When you receive the prompt, select the option to Open the CRL. users will see the certificate selection differently than older versions of the top of the list. To begin tracing, you can use Tracelog. These keys are Signature Only(AT_SIGNATURE) and Key Exchange(AT_KEYEXCHANGE). Applies to: Windows 10, Windows 11, Windows Server 2016, Windows Server 2019, Windows Server 2022 Feedback In this article See also This topic for the IT professional and smart card developer links to information about smart card debugging, settings, and events. The technet article was exactly what I was looking for, but the OP is "how to load the certificate to the local machine Personal store." Each certificate is enclosed in a container. Why refined oil is cheaper than cold press oil? Find centralized, trusted content and collaborate around the technologies you use most. To find the container value, type certutil -scinfo. Or is there no chance, i can do it without using low-level programming(APDU-commands etc. First make sure to set the following registry settings to enable the import of keys. This installation varies according to Cryptographic Service Provider (CSP) and by smartcard vendor. After you put the third-party CA in the NTAuth store, Domain-based Group Policy places a registry key (a thumbprint of the certificate) in the following location on all computers in the domain: HKEY_LOCAL_MACHINE\Software\Microsoft\EnterpriseCertificates\NTAuth\Certificates. Following all of that, you should be up and running. Internet Explorer, NOT the Edge web browser, and have The correct smartcard certificate or private key is not installed on the smartcard. Select Export Your Digital ID to a file. This article explains tools and services that smart card developers can use to help identify certificate issues with the smart card deployment. The certificate of the smart card cannot be retrieved from the smartcard reader. You should be able to download and view the CRL from any of the HyperText Transport Protocol (HTTP) or File Transfer Protocol (FTP) CDPs in Internet Explorer from both the smartcard workstation(s) and the domain controller(s). In the left pane, click Personal , Certificates. Enable Active Directory Advanced Features, Enable Integrated Windows Authentication (IWA) in Internet Explorer, Enable Integrated Windows Authentication (IWA) in Mozilla Firefox, Enable SSO behavior in Google Apps with Firefox and Firefox SSO testing, Export information related to the SecureAuth Appliance, Google Chrome Support for Java Enabled SecureAuth IdP Realms, Grant Permission to Use Signing Certificate Private Key, How SecureAuth IdP Services Use Certificates for Secure Authentication, How to configure a realm to use LDAPS instead of LDAP, How to convert an OATH Seed to an OATH Token, How to Create a Kaspersky Rescue Disk 10 as Bootable Antivirus, How to Disable Self-service Password Reset (SSPR) on the Credential Provider, How to Submit a Certificate Revocation Request for a SecureAuth IdP-issued X.509 Certificate, Inline Password Change Configuration Guide, Locate the Digital Certificate in Supported Browsers, Manually install SecureAuth CA Certificates using the Published CRT files, Modify the Codebase Attribute in Java Development Kit 7u55+, Native Mode Certificate Delivery for Android Devices, Network Products and Supporting Authentication Methods, PFX Certificate Installation on Mac or Windows Browser, RDP Authentication Issues with SecureAuth IdP, Renaming a VMware virtual machine prior to import, SecureAuth compatibility with Google Apps ForceAuthn changes, SecureAuth IdP Digital Certificate Overview, SecureAuth Profile Data Encryption Using Advanced Encryption, Secure the Data Connection between SecureAuth IdP and the SQL Datastore, Update Syslog Log Formatters after Upgrade, Use Regular Expressions in an Account Update Realm, Use X-Forwarded-For (XFF) with URL Rewrite Module, Virtual Appliance Drive Expansion Procedure, VPN Clients and Supported Authentication Methods. Click the Stores tab and select the Define these policy settings check box, then tick its two checkboxes. How do I get to Internet Options in and S/MIME you need to know the OWA S/MIME is an Active-X You might be prompted to add militarycac.com to your trusted sites to complete the download, 4. Juniper VPN error with Letter "S" on the Browser, Junos Pulse standalone desktop client receives SAML authentication error, LDAP Communication Lost to Active Directory Domain Controller, New Realm Creation Filename: redirection.config Error, OVF File Errors on Unsupported VMware ESXi Versions, OVF Template Deployment Error on Older Versions of VMware ESXi, Page not found error in post authentication upon creation of new realm, Password not changed error using Multi Data Store (web service) workflow, Portal Links - IE Page Cannot Be Displayed Error, Private Key Corruption - SecureAuth Error Code 0 error cleanup, Resolution for LDAP - Access Denied error message, Resolve the Box Windows client embedded browser error, Resolving "503 Service Unavailable" Error, SAML Error- error: String:'' does not match pattern for [xs:ID], SAML integrations using AssertionConsumerServiceIndex hotfix, SAML 2.0 SP Init "System Error: We are unable to continue at this time. To do so: Open the Microsoft Management Console (MMC) that contains the Certificates snap-in. The relevant attribute is cACertificate, which is an octet String, multiple-valued list of ASN-encoded certificates. Installing the DoD Root To import an existing certificate, click Import. If the information in the SubjAltName appears as Hexadecimal / ASCII raw data, the text formatting is not ASN1 / UTF-8. Click the start menu/SecureAuth/Tools and select 'Certificates Console', 2. If the domain controllers or smartcard workstations do not trust the Root CA to which the user's smartcard certificate chains, then you must configure those computers to trust that Root CA. Required: Domain controllers must be configured with a domain controller certificate to authenticate smartcard users. 5. The user does not have a UPN defined in their Active Directory user account. Solution 4: Follow slide 5 of Certificate enrollment issues from a third-party CA. Smartcard logon certificates must have a Key Exchange(AT_KEYEXCHANGE) private key type in order for smartcard logon to function correctly. To list certificates that are available on the smart card, type certutil -scinfo. In order to check these client side certificates we need to install the root and intermediate certificates on the appliance. The smart card resource manager service runs in the context of a local service. // This notice must stay intact for use Connect and share knowledge within a single location that is structured and easy to search. Note: In the artcle I linked it's written that this is valid for Windows 7 and 2008 but it worked for me on XP and Vista. I can't access encrypted emails when using the Once Internet Explorer appears, right click The UPN OtherName value: Must be ASN1-encoded UTF8 string. In order for your machine to recognize your CAC certificates and DoD websites as trusted, the installer will load the DoD CA certificates on OS X. Asking for help, clarification, or responding to other answers. For more information about CryptoAPI 2.0 Diagnostics, see Troubleshooting an Enterprise PKI. Finding Our step-by-step guide will help you sort things out. curobj.q.value="site:"+domainroot+" "+curobj.qfront.value The UPN in the certificate does not match the UPN defined in the user's Active Directory user account. To learn more, see our tips on writing great answers. INSTALL "Installroot 4" on your machine. This topic for the IT professional and smart card developer links to information about smart card debugging, settings, and events. Full Name: For more information, click the following article number to view the article in the Microsoft Knowledge Base: 295663 How to import third-party certification authority (CA) certificates into the Enterprise NTAuth store. Right-click 'InstallRoot_v3.13.1A' and select 'Run as administrator', 7. The default location for logman.exe is %systemroot%system32\. Select All Tasks, and then click Import. In Connection Settings, enter a Name and the Path to your domain.Select the Naming Context: Configuration.. Browse down to Public Key Services. This message is a generic error and can be the result of one or more of below issues. Original KB number: 281245. Guiding you with how-to advice, news and tips to upgrade your tech life. This information makes it easier to identify the causes of issues and reduces the time required for diagnosis. PDFs (Portable Document Format) like I did in Windows 8.1. If Microsoft Management Console cant create a new document, follow our guides easy steps to solve the issue. There are two predefined types of private keys. For more information, see Tracelog. Input mmc in Run and press Enter\u00a0to open the window below."},"image":{"@type":"ImageObject","url":"https://cdn.windowsreport.com/wp-content/uploads/2017/03/digital-certificate3.jpg","width":1011,"height":514}},{"@type":"HowToStep","url":"https://windowsreport.com/install-windows-10-root-certificates/#rm-how-to-block_c8e8fa50beed8e83a3c5f2b69cc11e58-","itemListElement":{"@type":"HowToDirection","text":"3. Add the Certificates snap-in from the File > Add/Remove Snap-in menu. Subject = Distinguished name of user. Debugging and tracing using Windows software trace preprocessor (WPP), Kerberos protocol, Key Distribution Center (KDC), and NTLM debugging and tracing. 565), Improving the copy in the close modal and post notices - 2023 edition, New blog post from our CEO Prashanth: Community is the future of AI. You can also install root certificates on Windows 10/11 with the Microsoft Management Console. This store is used to validate digital certificates and establish secure connections over the internet. The UPN OtherName OID is: "1.3.6.1.4.1.311.20.2.3" Log on to the workstation with the smartcard. Root certificates help your browser determine whether certain websites are genuine and safe to open. Solution1 (built-In Smart Card Ability): Uninstall ActivClient 6.2.0.x or 7.0.1.x by "Right Clicking" the Windows logo "4 squares" [in the lower left corner of your desktop], select Programs and Features (now called Apps and Features), find ActivClient in your list of programs and select Uninstall, restart your computer and try the sites again. I can see a lot of certificates there, but the one from my smartcard is missing in the store. The NTAuth store is located in the Configuration container for the forest. The DoD Cyber Exchange is sponsored by Error received when attempting to log on to the SecureAuth appliance with a domain account, Error received: "Shared secret set does not match", Invalid hexadecimal string format error received during Log Service Test. Add the third-party root CA to the trusted roots in an Active Directory Group Policy object. Internet Options > Security > Internet > Custom Level: Don't prompt for client certificate selection when only one certificate exists - set to Disable. If you're using a Yubikey, you can use the YubiKey Manager to import the certificate into your smartcard. Optional: Active Directory can be configured to distribute the third-party root CA to the trusted root CA store of all domain members using the Group Policy. If the domain controllers or smartcard workstations do not trust the Root CA to which the domain controller's certificate chains, then you must configure those computers to trust that Root CA. logo at the bottom left of your screen. Information: For example, you could download one from the. This thread is locked. Then, click Public Key Policies and Certificate Path Validation Settings to open a Certificate Path Validation Settings Properties window. From the Certificate Import Wizard window, you can add the digital certificate to Windows. More info about Internet Explorer and Microsoft Edge, Windows Driver Kit (WDK) and Debugging Tools for Windows (WinDbg), HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0, HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Kerberos, HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Kdc. If your valid domain controller certificate has expired, you may renew the domain controller certificate, but this process is more complex and typically more difficult than if you request a new domain controller certificate. Look after the PFX file, because it contains a private key! After you provision the device, it's ready for use. Learn how you can do it by reading our simple article. certificates and making sure the CommonAccessCard.us, CommonAccessCard.info, & ChiefGeek.us. to use other technologies to replace Active-X sometime in the future. Cortana / Ask me anything (box) near the Windows Entering a PIN is not required for this operation. By design Edge does not support Active-X (or Browser Helper The certificates on your CAC can allow you to perform routine activities such as accessing OWA, signing documents, and viewing other PKI-protected information online. If a custom installable revocation provider is installed, it must be turned on. Click Next, click Next, and click Finish. Microsoft Product Support Services does not support the third-party CA smart card logon process if it is determined that one or more of the following items contributes to the problem: The client computer checks the domain controller's certificate. The certificate of the smart card is not installed in the user's store on the workstation. hrs, The following domain an installation specialist, 10 year Windows MVP, and Volunteer Moderator. If the information in the SubjAltName field appears as Hexadecimal / ASCII raw data, the text formatting is not ASN1 / UTF-8. You do not have to store the private key in the user's profile on the workstation. Internet Options are set correctly. You can check that the CRL is online at the CDP and valid by downloading it from Internet Explorer. d. From the Action menu, click All Tasks and then Export . Import the certificate authority root certificate and the issuing certificate authority certificate into the device's keystore. However, computers don't always cooperate with us. Error: The date/time on your computer is inaccurate. //Enter domain of site to search. In Device Manager, expand Smart card readers, select the name of the smart card reader you want to check, and then select Properties. Why does SecureAuth use HTTP (Port 80) for Web Services? Failing to find and download the Certificate Revocation List (CRL), an invalid CRL, a revoked certificate, and a revocation status of "unknown" are all considered revocation failures. with Edge. Click on the Details tab. 7. Before you begin, make sure you know your organizations policies regarding remote use. Now, open the Certification Authority console, right-click Certificate Templates, and select New > Certificate Template to issue. 3. 1. If the NTAuth store does not contain the CA certificate of the smartcard certificate's issuing CA, you must add it to the NTAuth store or obtain a smartcard certificate from an issuing CA whose certificate resides in the NTAuth store. Your internet browser is now configured to access DoD websites using the certificates on your CAC. Now that your machine is properly configured, please login and visit our End Users page for more information on using the PKI certificates on your CAC. Is SecureAuth IdP Impacted by the ROBOT Attack Vulnerability? Keep reading for ideas to Solution 5: Windows 10 OpenSSL: unable to get local issuer certificate, find certificate on smartcard currently on reader, signtool with certificate stored in local computer, Cordova InAppBrowser accessing certificate on virtual smartcard. Manage the PIV application. Getting Started Using a PIV You need two items to begin using your PIV credential: A card reader (hardware) Middleware (software) that works with your computer With just their PIV credential, a card reader, and middleware, your users can log in to websites that are PIV enabled, digitally sign email and documents and files, and encrypt! works great on Windows 10 computers and is available for 2. Is SecureAuth IdP Impacted by the "FREAK" Vulnerability (CVE-2015-1637)? Locate your certificate and double-click it, it should have Code Signing under the Intended Purposes column. 3. Card Readers Each domain controller that is going to authenticate smartcard users must have a domain controller certificate. This Windows 10 shows you how to import a certificate to your personal certificate store. Follow the instructions in the wizard to import the certificate. Importing a PIV (S/MIME) Certificate. Using ADSIEDIT. The trusted Root Certificate store is, however, located in the root of the Registry path below: Most Windows 10 users have no idea how to edit the Group Policy. c. Select a certificate in the right pane . Select the correct certificate and then click OK. Last Update or Review: Navigate to 'Trusted Root Certification Authorities' and ensure you have the DOD Root CA certificate installed, 3. Microsoft will deprecate virtual smart cards in the near future. More info about Internet Explorer and Microsoft Edge. One example I know was old RSA tokens. Request and install a domain controller certificate on the domain controller(s). To delete a container, type certutil -delkey -csp "Microsoft Base Smart Card Crypto Provider" "". 2. I opened the store with mmc -> snap-in -> certificates. By default, this store is created when you install a Microsoft Enterprise CA. If the NTAuth store does not contain the certification authority (CA) certificate of the domain controller certificate's issuing CA, you must add it to the NTAuth store or obtain a DC certificate from an issuing CA whose certificate resides in the NTAuth store. However, if the UPN in the certificate is the "implicit UPN" of the account (format samAccountName@domain_FQDN), the UPN does not have to match the userPrincipalName property explicitly. In Device Manager, expand Smart card readers, select the name of the smart card reader you want to check, and then select Properties. Limited support for this configuration is described later in this article. In the console tree, under Personal, click Certificates. The domain controller certificate is used for Secure Sockets Layer (SSL) authentication, Simple Mail Transfer Protocol (SMTP) encryption, Remote Procedure Call (RPC) signing, and the smart card logon process. When attempting to import a certificate into the YubiKey 4 or 5 when the card has reached its maximum storage . When you delete a certificate on the smart card, you're deleting the container for the certificate. The SubjAltName field of the smartcard certificate is badly formatted. A VPN connection will not be established", Desktop SSO use case: "maxQueryStringLength" error, Error 407 during certificate re-enrollment, Error: LDAPProfileProvider.SetPropertyValuesIndex (zero based) must be greater than or equal to zero and less than the size of the argument list. Clicking" the Windows logo "4 squares" [in the lower left corner of your desktop], select Programs and Features Click: Associate a file type or protocol If the User Account Control dialog box appears, confirm that the action it displays is what you want, and then select Yes. (from Java Security Warning: Allow access to the following application from this web site? At the command prompt, type net start SCardSvr. is on the computer and provides backwards compatibility for web pages that do not work Root certificates are public key certificates that help your browser determine whether communication with a website is genuine and is based upon whether the issuing authority is trusted and if the digital certificate remains valid. Select the option to automatically put the certificate in a certificate store based on the type of certificate. Select Email Security. See "How to import your certificate to the browser and save a back-up copy: Microsoft Edge, item 7 under Step 4. You can also configure tracing by editing the Kerberos registry values shown in the following table. Figure N Click Next, and then click Browse and then browse to and select the CA certificate you copied to this computer. Note If the smart card reader is not listed in Device Manager, in the Action menu, select Scan for hardware changes. The smartcard certificate used for authentication was not trusted. Internet Options > Content > Certificates: All smart card certificates are enabled for client authentication. On the All Tasks menu, click Import to start the Certificate Import Wizard. }, MOST PEOPLE ARE ABLE TO USE THEIR CAC WITH WINDOWS 10, YOU CAN ALSO USE YOUR CAC WITH WINDOWS 8.1. By clicking Post Your Answer, you agree to our terms of service, privacy policy and cookie policy. In the tree view on the left side, navigate to Personal > Certificates. Press theWinkey +Rhotkey to open the Run dialog. If the RDP client is running Windows Server 2016 or Windows Server 2019, to be able to connect to Azure AD joined devices, . Is SecureAuth IdP Impacted by the DROWN Attack? In the Windows Task Manager dialog box, select the Services tab. // For this and over 400+ free scripts, visit JavaScript Kit- http://www.javascriptkit.com/ Under Digital IDs, select Import/Export. to read and send your encrypted emails when using OWA / webmail. Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support. tar command with and without --absolute-names option. Windows 10/Edge is a work in progress, Microsoft is planning Run as administrator at the command prompt. based certificates are created on a smart card, or cryptographic token, or other cryptographic device. For more information about requirements for domain controller certificates from a third-party CA, click the following article number to view the article in the Microsoft Knowledge Base: 291010 Requirements for domain controller certificates from a third-party CA. Defense Information Systems Agency (DISA), National Centers of Academic Excellence in Cybersecurity (NCAE-C), Public Key Infrastructure/Enabling (PKI/PKE), External and Federal PKI Interoperability, For Administrators, Integrators and Developers, Web Content Filtering / Break and Inspect, Middleware (if necessary, depending on your operating system version), Verify that your CAC certificates are recognized and displayed in Keychain Access, For Debian-based distributions, use the command, For Fedora-based distributions, use the command. 4. Select the Name column to sort the list alphabetically, and then type s. In the Name column, look for SCardSvr, and then look under the Status column to see if the service is running or stopped. You cannot import "hardware-based certificates" from an import file, because you cannot create a back-up file of a "hardware-based certificates." (But there should be no need to do so, since the certificate private The smart card logon certificate must be issued from a CA that is in the NTAuth store. Objects); this is good from a security perspective, but bad if you want to use Press CTRL+ALT+DEL, and then select Start Task Manager. Applies to: Windows Server 2012 R2, Windows 10 - all editions Finding 1: You upgraded As with any PKI implementation, all parties must trust the Root CA to which the issuing CA chains. Reader, it is set correctly, if it shows some other program, select .pdf and click the Click Trusted Root Certification Authorities, right-click Certificates, select All Tasks, and Import. Similarly, you can add many more digital certificates to that OS and other Windows platforms. This copies all logs onto the clipboard. Copyright Windows Report 2023. This article provides some guidelines for enabling smart card logon with third-party certification authorities.