How To Issue Entra CBA Smart Cards with Azure PKI

Prerequisites for Creating Entra CBA Smart Cards with EZCMS and EZCA

  1. EZCA Subscription

Overview

Having certificate based authentication requires you to have a Certificate Authority that will issue certificates for your smart cards. We recommend using a PKI as a service CA such as our EZCA tool to have a compliant, HSM backed CA without all the management overhead.

Getting Started - Creating a Cloud PKI for Entra CBA

  1. Go to https://portal.ezca.io/
  2. Login with an account that is registered as a PKI Admin in EZCA.
  3. Navigate to Certificate Authorities. Cloud CA Menu for Entra CBA Certificates Cloud CA Menu for Entra CBA Certificates
  4. Click on the “Create CA” Create Cloud PKI for Entra CBA Create Cloud PKI for Entra CBA
  5. Select Subordinate/Intermediate CA. Select Subordinate/Intermediate Cloud CA Select Subordinate/Intermediate Cloud CA
  6. Click Next

Entering Cloud CA Information

  1. Enter Common Name: This is the name of the CA how it will appear in the certificate.
  2. (Optional) Enter CA Friendly Name This is the name that will appear in the EZCA portal, by default we will use the Common Name
  3. (Optional) Enter the Organization The Organization field is an optional certificate field that usually has the company name.
  4. (Optional) Enter the Organization Unit The Organization Unit field is an optional certificate field that usually contains the unit that runs this CA (For example: IT or HR).
  5. (Optional) Enter the Country Code The Country Code field is an optional certificate field that identifies the country where this CA is located.
  6. Click Next. CA Details for Entra CBA Cloud PKI CA Details for Entra CBA Cloud PKI

Cryptographic Requirements

  1. Unless you have specific compliance or security requirements, leave the default cryptographic values for best security and compatibility. Crypto Details For Entra CBA Crypto Details For Entra CBA

Validity Period

  1. Select your Validity Period Learn more about Validity Period best practices
  2. Enter a Notification Email this email address (as well as the PKI Administrators) will get all the notifications for the lifecycle of the CA.
  3. Select the lifecycle action you want EZCA to take when expiry of the CA is approaching (for now we recommend manually rotating the Certificate Authorities since Entra CBA does not support automatic CA rotation).
  4. Select the percentage of lifetime of the certificate when you want EZCA to start taking Lifecycle actions. Lifecycle Details Lifecycle Details

CA Certificate Revocation List

  1. Select if you want this CA should issue a CRL (Highly recommended)
  2. Click Next. CRL Details CRL Details

CA Certificate Revocation List Advance Settings

Warning

Changes to this section are only recommended for PKI experts with specific requirements.

  1. Click the expand button CRL Details CRL Details
  2. Enter the desired CRL Validity Period in days
  3. Enter the desired CRL Overlap Period in hours
  4. (Optional) Enter the CRL endpoint where you will publish your CRLs
    Warning

    Custom CRL endpoints are supported by EZCA by adding the CRL endpoint as the CRL endpoint in the certificate. However, your PKI admins are responsible from getting the CRL from EZCA and posting it in that specific endpoint.

  5. Do not Enable OCSP, this is not supported by Entra CBA.
  6. Click Next. CRL Details CRL Details
  7. Change the issuing template to “Smart Card Template”. Smart Card Template for Entra CBA Certificate Issuance Smart Card Template for Entra CBA Certificate Issuance
  8. Set the desired smart card certificate lifetime.
  9. In another tab, open your EZCMS instance and in the settings page copy the Subscription ID. EZCMS Subscription ID EZCMS Subscription ID
  10. Paste the subscription ID into the “EZCMS Instance ID” field. EZCMS Subscription ID in EZCA EZCMS Subscription ID in EZCA
  11. Click Next.

Select Cloud PKI Location for Entra CBA

  1. Select the location where you want your CA to be created. Create Certificate Authority for Entra CBA Create Certificate Authority for Entra CBA

Add Geo-Redundancy to your Cloud PKI for Entra CBA

EZCA Allows you to create multiple CAs across many regions to create Geo-Redundancy.

Warning

Each location will be charged as an extra Certificate Authority.

  1. Click the “Add Secondary Location” Button. Create Secondary Location Create Secondary Location
  2. Enter the Location information. Create Secondary Location Create Secondary Location
  3. Add as many locations as needed.

Create Cloud CA for Entra CBA

  1. Click Create. Create CA for Entra CBA Create CA for Entra CBA

Chaining to EZCA Root CA

  1. Once the CA is requested, a Certificate Signing Request (CSR) will be created for each location. CSR Created CSR Created
  2. If your desired Root CA is an EZCA CA, Select it from the dropdown and click create CA. If you do not have a Root CA, you can create one by following the EZCA Root CA Creation Guide CSR Created CSR Created
  3. Repeat these steps for each location.
  4. Your CA is ready to be used!

Chaining to Offline Root CA

  1. Once the CA is requested, a Certificate Signing Request (CSR) will be created for each location. CSR Created CSR Created
  2. Click the “Save CSR” Button. CSR Created CSR Created
  3. Once the CSR is download, follow your internal guidance to transfer that CSR to your offline Root CA.
  4. Open “Certificate Authority”. ADCS ADCS
  5. Right click the CA.
  6. Select All Tasks -> Submit new Request. ADCS ADCS
  7. Select the downloaded CSR. ADCS ADCS
  8. Click on pending requests. ADCS ADCS
  9. Right click on the newly created request.
  10. Select All Tasks -> Issue.
  11. Click on Issued Certificates. ADCS ADCS
  12. Double click on the newly created certificate. ADCS ADCS
  13. Click on Details. ADCS ADCS
  14. Click on the “Copy ti File…” Button. ADCS ADCS
  15. Click next
  16. Select the “Base-64 encoded X.509 (.CER) option. ADCS ADCS
  17. Click next.
  18. Select where you want to save the newly created certificate. ADCS ADCS
  19. Click next.
  20. Click Finish. ADCS ADCS
  21. This should create a .cer file in the location you selected. ADCS ADCS
  22. Follow you PKI team’s guidance on transferring the certificate file out of the offline CA into an internet connected computer.
  23. Once you have the certificate in an internet connected computer, go to https://portal.ezca.io/
  24. Login with an account that is registered as a PKI Admin in EZCA.
  25. Navigate to Certificate Authorities. CA Menu CA Menu
  26. Click View details of the CA you want to import the certificate for. CA Menu CA Menu
  27. Scroll down to the location you want to import, and click the “Upload CA Certificate” button. CA Import CA Import
  28. Select the newly created certificate file. CA Import CA Import
  29. Click on the “Save Certificate” button CA Import CA Import
  30. Repeat these steps for each location.
  31. Your CA is ready to be used!

Registering 3rd Certificate Authority with Active Directory

If you are going to use these certificates with Active Directory, you will need to register the CA with Active Directory. the certificates will have all the information required for Smartcard Certificate Authentication in AD, but you will need to register the CA with AD, and ensure that your Domain Controllers have the CA certificate in their Trusted Root Certification Authorities store.

Registering the Root CA with Active Directory

First we are going to going to add the Root CA to the Trusted Root Certification Authorities store on the Domain Controllers. Run the following command an elevated powershell prompt.

certutil.exe -dspublish -f <path to Cloud PKI root CA certificate> RootCA

Registering the Subordinate CA with Active Directory

Next we are going to add the Subordinate CA to the Intermediate Certification Authorities store on the Domain Controllers. Run the following command an elevated powershell prompt.

certutil.exe -dspublish -f <path to Cloud PKI Subordinate CA certificate> SubCA

How to add the Smart Card to the NTAuth Store

Finally, we are going to add the Smart Card template to the NTAuth store. Run the following command an elevated powershell prompt.

certutil.exe -dspublish -f <path to Cloud PKI issuing CA certificate> NtAuthCa