Certificate and Smart Card Authentication
Overview
Section titled “Overview”Certificate-based authentication uses public key certificates instead of shared passwords. In Windows, smart card logon and client certificate authentication are major use cases.
Common Methods
Section titled “Common Methods”- Smart card logon: Uses Kerberos PKINIT to obtain a TGT with a certificate.
- TLS client certificates: Presents a client certificate for authentication through Schannel.
Benefits
Section titled “Benefits”- Reduces the risk of password exposure.
- Allows stronger controls through physical tokens and certificate revocation.
Operational Considerations
Section titled “Operational Considerations”- Protecting the CA (certificate authority) is critical.
- Revocation management (CRL/OCSP) and key protection are essential.
- Processes are needed for lost devices and certificate renewal.