1- We use MS certificate mapping to login to multiple AD user accounts with the same smartcard. Caroline Philie smartcard is allowed to login to the Caroline Philie AD user account and the ARole AD user account.
2- When I select the following options in the smartcard logon certificate template:
- In the subject name tab: Build from Active Directory information, Fully distinguished name, E-mail name
- In the Issuance Requirement tab: This number of authorized signature = 1, Application policy, Certificate Request Agent, Valid existing certificate
- Caroline Philie smartcard can login successfully to the Caroline Philie user account and she can renew her logon certificate successfully.
- Caroline Philie smartcard can login successfully to the ARole user account but
she cannot renew her certificate. This error message is displayed: CERTSRV_E_SIGNATURE_REJECTED One or more signatures did not include the required application or issuance policies. The request is missing one or
more required valid signature.
3- To support certificate renewal in the ARole AD user account for Caroline smartcard, I select the following options in the smartcard logon certificate template:
- In the subject name tab: Supply in the request, Use subject information from existing certificates for autoenrollment renewal requests
- In the Issuance Requirement tab: This number of authorized signature = 1, Application policy, Certificate Request Agent, Valid existing certificate
- Caroline Philie smartcard can login successfully to the Caroline Philie user account and she can renew her logon certificate successfully.
- Caroline Philie smartcard can login successfully to the ARole user account and she can renew her logon certificate successfully.
4- But, with this template the Enrollment Agent has to supply the subject name manually when issuing certificates. He cannot select an AD User.
5- Does a configuration exists to build the subject name from active directory when issuing certificates and use the subject information from existing certificates for autoenrollment and renewal requests?
