MSFT smart card authentication is listed in PKINIT RFC 4556 however I don't see any OIDs listed.

Based on this and this KB article the EKU section of the certificate should contain "Client Authentication" or "Microsoft smart card".

I believe I found the OID of the EKU section here

OID=       ; XCN_OID_PKIX_KP_CLIENT_AUTH  Client Authentication (KB291010)

I also found a list of possible OIDs here


What are the requirements for SmartCard encryption with Windows?


Many of the requirements are listed in this KB article http://support.microsoft.com/kb/281245

The smart card certificate has specific format requirements:

The CRL Distribution Point (CDP) location (where CRL is the Certification Revocation List) must be populated, online, and available.

For example:

CRL Distribution Point Distribution Point Name: Full Name: URL=http://server1.name.com/CertEnroll/caname.crl

Key Usage = Digital Signature

Basic Constraints [Subject Type=End Entity, Path Length Constraint=None] (Optional)

Enhanced Key Usage =

Client Authentication ( (The client authentication OID) is only required if a certificate is used for SSL authentication.)

Smart Card Logon (

Subject Alternative Name = Other Name: Principal Name= (UPN). For example:

UPN = user1@name.com

The UPN OtherName OID is : ""

The UPN OtherName value: Must be ASN1-encoded UTF8 string

Subject = Distinguished name of user. This field is a mandatory extension, but the population of this field is optional.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.