How-To: Configure Smart Card Certificate Settings in Keytos Shield

Learn how to configure Keytos Shield certificate settings, including Entra CBA high affinity, encryption key backup, and downloading your Root and Issuing CA certificates.

Overview - What are Keytos Shield Certificate Settings?

When you use smart card (CBA) credentials, Keytos Shield issues certificates to your users’ security keys from your cloud PKI. The Certificates settings control how those certificates are registered in Entra ID, whether encryption keys are backed up, and give you the CA certificates that Entra ID needs to trust them.

Prerequisites for Configuring Certificate Settings

  1. You have completed Keytos Shield identity security onboarding.
  2. You have the Owner or Identity Administrator role on your Keytos Shield subscription.

Step-by-Step Guide - How to Configure Certificate Settings in Keytos Shield

Step 1 - How to Open the Certificate Settings

  1. Open the Keytos Shield global portal in your browser (US Government Portal) and open your region-specific Shield endpoint under Existing subscriptions.

  2. From the left-hand menu, expand Identity security and click Identity settings.

  3. Click Certificates.

    Keytos Shield Identity settings page listing Domain, Enrollment and recovery, Smart cards, Certificates, and Alternative accounts with Identity settings highlighted in the left-hand menu

Step 2 - How to Configure Entra CBA High Affinity and Encryption Key Backup

  1. For Entra CBA high affinity, select Yes if your Entra ID certificate-based authentication policy uses high affinity bindings. Shield then saves each user’s smart card certificate to their user object in Entra ID, so you don’t have to add each certificate manually. Read our blog post to learn whether you should enable high affinity for your smart cards.

  2. For Backup and recovery of encryption keys, we recommend keeping this set to Yes. Shield backs up the encryption key so that if a user loses their security key, they can register a new one and get a certificate with the same encryption key, without losing access to their encrypted data.

    • This is the encryption key in the 9D slot, used for email encryption and macOS Keychain encryption. It is not the authentication key in the 9A slot.
    Keytos Shield Certificates identity settings with Entra CBA high affinity set to No and Backup and recovery of encryption keys set to Yes

  3. Click Save changes at the top right of the page.

Step 3 - How to Download Your Shield CA Certificates for Entra ID

For users to sign in with their smart card certificates, Entra ID must trust the Certificate Authorities that issued them.

  1. Under Trust your smart card certificates, click Download next to Download root CA certificate file to download rootca.cer.

  2. Click Download next to Download issuing CA certificate file to download issuingca.cer.

    Keytos Shield Certificates identity settings Trust your smart card certificates section with Download buttons for the root and issuing CA certificates highlighted

Next, add both certificates to Entra ID’s trust store and turn on certificate-based authentication. See how to configure Entra ID certificate-based authentication (CBA) for Keytos Shield.