The system requires Scep messages to be signed and encrypted. Therefore, a certificate with both signing and encrypting usages must be generated.. The process below describes how to generate a client certificate using the Microsoft CA.
Client certificate requirements
The client must have the following usages:
-
Client Authentication (1.3.6.1.5.5.7.3.2)
-
Digital Signature
-
Key Encipherment
Microsoft CA Template
The Microsoft certificate template that is can be used is the User certificate. This certificate template provides the Client Authentication key usage by default.