Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

MSFT smart card authentication is listed in PKINIT RFC 4556 however I don't see any OIDs listed.

Based on this and this KB article the EKU section of the certificate should contain "Client Authentication" or "Microsoft smart card".

I believe I found the OID of the EKU section here

OID=       ; XCN_OID_PKIX_KP_CLIENT_AUTH  Client Authentication (KB291010)

I also found a list of possible OIDs here


What are the requirements for SmartCard encryption with Windows?

share|improve this question
up vote 2 down vote accepted

Many of the requirements are listed in this KB article

The smart card certificate has specific format requirements:

The CRL Distribution Point (CDP) location (where CRL is the Certification Revocation List) must be populated, online, and available.

For example:

CRL Distribution Point Distribution Point Name: Full Name: URL=

Key Usage = Digital Signature

Basic Constraints [Subject Type=End Entity, Path Length Constraint=None] (Optional)

Enhanced Key Usage =

Client Authentication ( (The client authentication OID) is only required if a certificate is used for SSL authentication.)

Smart Card Logon (

Subject Alternative Name = Other Name: Principal Name= (UPN). For example:


The UPN OtherName OID is : ""

The UPN OtherName value: Must be ASN1-encoded UTF8 string

Subject = Distinguished name of user. This field is a mandatory extension, but the population of this field is optional.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.