smartcard , IE

smartcard , IE

Secure Home | Search | About
 Microsoft Applications Security    Post an article   get this group's latest topics as an RSS feed add this group's latest topics to your My MSN content add this group's latest topics to your My Yahoo content add this group's latest topics to your Google content
Subject Author Date
smartcard , IE krishna.chaganti 08-28-2006
|--> Re: smartcard , IE David H. Lipman08-28-2006
---> Re: smartcard , IE Brian Komar [MV...08-28-2006
  ---> Re: smartcard , IE krishna.chaganti08-31-2006
    `--> Re: smartcard , IE Brian Komar [MV...08-31-2006
Posted by on August 28, 2006, 9:52 am
If you were  Registered and logged in, you could reply and use other advanced thread options
For windows login I use username/password.
-------------------------
I see the same certificate in IE certificates list the certificate in
the SmartCard.

But IE never try to read the certificate and send to the server when
the Server is asking client
certificate during SSL handshake.

If I have a non smartcard certificate in the personal tab of IE
Certificate list, It is working fine.
IE sending that certificate to Server.

What am I missing to make IE read the certificate from SmartCard and
send to the server?

I am using XP SP2

Regards
Krishna


Posted by David H. Lipman on August 28, 2006, 4:26 pm
If you were  Registered and logged in, you could reply and use other advanced thread options

| For windows login I use username/password.
| -------------------------
| I see the same certificate in IE certificates list the certificate in
| the SmartCard.
|
| But IE never try to read the certificate and send to the server when
| the Server is asking client
| certificate during SSL handshake.
|
| If I have a non smartcard certificate in the personal tab of IE
| Certificate list, It is working fine.
| IE sending that certificate to Server.
|
| What am I missing to make IE read the certificate from SmartCard and
| send to the server?
|
| I am using XP SP2
|
| Regards
| Krishna

Domain or workgroup ?

--
Dave
http://www.claymania.com/removal-trojan-adware.html
http://www.ik-cs.com/got-a-virus.htm



Posted by Brian Komar [MVP] on August 28, 2006, 8:01 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
krishna.chaganti@gmail.com says...
> For windows login I use username/password.
> -------------------------
> I see the same certificate in IE certificates list the certificate in
> the SmartCard.
>
> But IE never try to read the certificate and send to the server when
> the Server is asking client
> certificate during SSL handshake.
>
> If I have a non smartcard certificate in the personal tab of IE
> Certificate list, It is working fine.
> IE sending that certificate to Server.
>
> What am I missing to make IE read the certificate from SmartCard and
> send to the server?
>
> I am using XP SP2
>
> Regards
> Krishna
>
>
The problem is that you have not indicated where the certificate is
located by typing in the PIN to the smart card.
Your scenario will work if you login using the smart card and PIN, as
the login process will then tie the private key to the certificate after
you access the private key with the PIN.

Brian

Posted by on August 31, 2006, 8:34 am
If you were  Registered and logged in, you could reply and use other advanced thread options
It is domin.
But I login into to domain using regular password. I want to use the
Samrtcard only on IE when a site asks for certificate.
After I insert the card in the card reader i see the certificate in
IE certificate list.
But when I go to the server, it never asks me the PIN for the reader.
If I log into reader using pin by entering the reader application, IE
still never sees the certificate. The certificate is not associated to
the current login user in the domain.
The domain does not support certificate login.


Regards
Krishna
Brian wrote:
> krishna.chaganti@gmail.com says...
> > For windows login I use username/password.
> > -------------------------
> > I see the same certificate in IE certificates list the certificate in
> > the SmartCard.
> >
> > But IE never try to read the certificate and send to the server when
> > the Server is asking client
> > certificate during SSL handshake.
> >
> > If I have a non smartcard certificate in the personal tab of IE
> > Certificate list, It is working fine.
> > IE sending that certificate to Server.
> >
> > What am I missing to make IE read the certificate from SmartCard and
> > send to the server?
> >
> > I am using XP SP2
> >
> > Regards
> > Krishna
> >
> >
> The problem is that you have not indicated where the certificate is
> located by typing in the PIN to the smart card.
> Your scenario will work if you login using the smart card and PIN, as
> the login process will then tie the private key to the certificate after
> you access the private key with the PIN.
>
> Brian


Posted by Brian Komar [MVP] on August 31, 2006, 10:32 am
If you were  Registered and logged in, you could reply and use other advanced thread options
krishna.chaganti@gmail.com says...
> It is domin.
> But I login into to domain using regular password. I want to use the
> Samrtcard only on IE when a site asks for certificate.
> After I insert the card in the card reader i see the certificate in
> IE certificate list.
> But when I go to the server, it never asks me the PIN for the reader.
> If I log into reader using pin by entering the reader application, IE
> still never sees the certificate. The certificate is not associated to
> the current login user in the domain.
>
The problem is that IE has no way of knowing what CSP was used to access
the certificate's private key, since you are not logging on with the
smart card.

You do state that the certificate appears in the user's store, so that
is a good thing. You can use the following command to associate the
certificate with your smart card's CSP:

certutil -f -csp "smart card provider name" -repairstore my
"CertificateSerialNumber"

The Smart Card Provider Name can be found in the Certificate Templates
console, by looking at the names of the CSPs in the certificate
templates console (or by running the certificate request wizard using
the certmgr.msc)

You must match the provider name *exactly* (not case, but spacing,
etc...

You must run this command *every* time that you log on to the network,
so that IE will know what CSP to use to access the certificate. If you
were logging on with the smart card, this would not be necessary.

Brian

Similar ThreadsPosted
SmartCard and Key Archival March 28, 2006, 9:41 am
ANN: Smartcard component for VS.NET May 26, 2006, 9:31 am
Smartcard help! GemPlus.. April 15, 2007, 7:54 am
OCSP and smartcard logon October 21, 2005, 7:20 am
how to authenticate via IE with a smartcard certificate November 28, 2005, 5:42 pm
SmartCard logons to domain November 30, 2005, 9:17 am
Signing email using SmartCard CSP December 28, 2005, 6:56 am
DRA certificate on smartcard - vista May 1, 2007, 3:20 pm
Digital Signature with SmartCard October 20, 2007, 4:16 am
Can smartcard for logon be disabled? January 30, 2008, 1:06 pm

The site map in XML format XML site map

Contact Us | Privacy Policy