To use smartcards and PIV credentials for network authentication, all the Domain Controllers need to have Domain Controller Authentication certificates.
Devices authenticate too!
When your users are using certificates to authenticate to the network, the Domain Controllers are also authenticating as devices using certificates. Each works together to create secure connections. To learn more, search other online resources for information on PKINIT protocols.
This page contains information on domain controller certificate profiles, and issuing domain controller certificates.
The domain controller certificates need to be issued with a set of specific extensions and values. The certificate for each domain controller must meet these requirements:
US Federal Civilian agencies have a variety of policies on whether you should use a Domain Controller certificate issued from your agency’s local enterprise Certificate Authority, or whether the certificate must be issued from a Certificate Authority managed and certified under the Federal Public Key Infrastructure (FPKI). Providing a common guide and recommendation is challenging as each agency’s information security policy should be followed.
It is not recommended to set up a local enterprise certificate authority just to issue domain controller certificates without ensuring the proper management and security protections are enabled, and your Chief Information Security Officer (CISO) has awareness and oversight for the certificate authority management.
The best option is to collaborate with your Chief Information Security Officer (CISO) or Information Security office for a definitive answer and direction.
