Knowledge Base

• Introduction
  • About Windows Hello for Business
  • How DigiCert Contributes in Windows Hello for Business
    • Windows Hello for Business Authentication Process
    • Windows Hello for Business Certificate Issuance Process
• Pre-requisites
  • Supported Deployment Model and Trust Type
  • Required Windows Hello for Business Setup
  • Required Autoenrollment Server Setup
• Setting Up Windows Hello for Business with Autoenrollment Server
  • Creating Certificate Profiles
  • Downloading and Importing Autoenrollment Configuration File
  • Assigning Group/User Access for Each Template
  • Issuing Domain Controller Certificates
  • Setting Up Active Directory Federation Services
  • Adding User Principal Name to Service Account
  • Provisioning
• Windows Hello for Business Authentication Certificate Lifecycle
  • Renewal
  • Expiration
  • Revocation
  • Reset
• Troubleshooting
• Known Issue

Introduction

This chapter includes the following topics:

• About Windows Hello for Business
• How DigiCert Contributes in Windows Hello for Business

About Windows Hello for Business

Windows Hello® for Business, a feature by Microsoft® starting from Windows 10, introduced password replacement with strong two-factor authentication, consisting of a new type of user credential bound to a device and accessed using a biometric or PIN. DigiCert now has an offering to issue certificates from the DigiCert® Trust Lifecycle Manager hosted Certificate Authorities for this new user credential.

For a detailed overview of Windows Hello for Business, please refer to the official Microsoft documentation: Windows Hello for Business Overview.

How DigiCert Contributes in Windows Hello for Business

Windows Hello for Business depends on multiple technology stacks, but Public Key Infrastructure (PKI) is one of its many foundations. DigiCert® Trust Lifecycle Manager can provide all certificates which are required to enable Windows Hello for Business through our Certificate Authority, and automatically provision them via our Autoenrollment Server.

The following table shows the type of certificates required by Windows Hello for Business.

Please refer to the DigiCert® Trust Lifecycle Manager | Autoenrollment Server deployment guide, section “Creating Autoenrollment Certificate Profile”, which will guide you through how to create certificate profiles for Autoenrollment Server. When selecting a certificate template, ensure that you are selecting from one of the three templates described above.

After you create the profiles, make sure that you note the Profile GUID for the two profiles created from the following templates.

1. Microsoft® Enrollment Agent
2. Windows Hello for Business Authentication

This information will be required later in section “Setting Up Active Directory Federation Services”.

NOTE: Microsoft® Enrollment Agent template Seat ID will be mapped to ‘cn’ (Common Name) by default. This should not be changed to mail when the AD FS is run by Service Accounts, since Service Accounts do not have an email address.

Downloading and Importing Autoenrollment Configuration File

After you have successfully created the required three certificate profiles, you will need to download and import the Autoenrollment configuration file.

To do so, refer to the DigiCert® Trust Lifecycle Manager | Autoenrollment Server deployment guide section “Import the Autoenrollment Configuration File”.

Assigning Group/User Access for Each Template

After you have imported the Autoenrollment configuration file into the Autoenrollment Server, you will need to assign access permissions to the imported templates. The required permission for each template is described below. Refer to the DigiCert® Trust Lifecycle Manager | Autoenrollment Server deployment guide section “About the Preparation of Certificate Templates” and “About the Assignment of Group/User Access to Templates“ for more details on how to configure them. 

Issuing Domain Controller Certificates

After you have assigned access permissions to the Domain Controller template for the Domain Controllers, Domain Controller certificate will be issued automatically to the Domain Controllers. The timing depends on how the operating system handles them. To make sure that the certificate has been issued properly to the Domain Controllers, follow the instructions below.

To check for Domain Controller certificate:

1. Sign in to the Domain Controller machine with Domain Admin equivalent credentials.
2. Open Microsoft Management Console by typing [Windows] + [R], type mmc, and click OK.
   
3. Add the Certificates Snap-in for the local computer.
   • Open File menu, select Add/Remove Snap-in…
     
   • Select Certificates and click Add
     
   • Select Computer account and click Next
     
   • Select Local computer and click Finish
     
   • Click OK to close the Add or Remove Snap-ins window
   • On the left pane, select Certificates (Local Computer) → Personal → Certificates and check if the Domain Controller certificate exists here. 
     

Setting Up Active Directory Federation Services

After certificate templates are imported and access permission is set, you will need to configure the Registration Authority templates to use for Windows Hello for Business with AD FS. This section covers the first part of “Active Directory Federation Services“ from the Microsoft official documentation but provides little more information about what to specify for Windows Hello for Business Enrollment Agent and Windows Hello for Business Authentication template names when using DigiCert Autoenrollment Server.

To configure the Registration Authority:

1. Sign in the AD FS server with Domain Admin equivalent credentials.
2. Open a Windows PowerShell prompt.
3. Enter the following command:

For <Windows Hello for Business Enrollment Agent Profile GUID>, enter the Profile GUID for profile created using Microsoft® Enrollment Agent certificate template. For <Windows Hello for Business Authentication Profile GUID>, enter the Profile GUID for profile created using Windows Hello for Business Authentication certificate template. For example, it will look something like the following:

After the above configuration is completed, continue from “Group Memberships for the AD FS Service Account” in “Active Directory Federation Services“ from the Microsoft official documentation. 

Adding User Principal Name to Service Account

This section will guide you on how to add User Principal Name (UPN) to Service Account. You will need to follow the direction here if your AD FS is configured to run using a Service Account. You can check whether AD FS is using Service Account by using the Services Tool (open Start Menu and type services). If Log On As for Active Directory Federation Services ends with '$' (dollar sign), this indicates that your AD FS is running using a Service Account. 

UPN is required to identify the end entity of the issued certificate, but since Service Account does not have UPN by default, it is required that this information is filled out before issuing Enrollment Agent certificate to the Service Account.

To add UPN to Service Account:

1. Open Active Directory Users and Computers from Windows Administrative Tools.
2. Click View and enable Advanced Features by selecting the option. This will enable editing the attribute of the Service Account.
   
3. In the tree window at the left, collapse the domain in which the Service Account exists, and select Managed Service Accounts. Right-click the Service Account configured for AD FS and select Properties.
   
4. In the Properties dialog, select the Attribute Editor tab, scroll down and select userPrincipalName. Click Edit.
   
5. In the String Attribute Editor dialog, enter userPrincipalName of the Service Account. UPN will need to be in the format, <cn of the Service Account>$@<domain name>. For this example, the cn (or the shown name) of the Service Account is “gmsa_adfs”, and domain is “whfb.pkidev.bbtest.net”. Resulting UPN for this example will be “gmsa_adfs$@whfb.pkidev.bbest.net”.
   
6. Click “OK” twice to apply the change and close the dialogue.

Provisioning

After all configurations have been set and user logs on to their device, the user should be prompted to provision Windows Hello for Business. Refer to “Sign-in and Provision” from the Microsoft official documentation for details.

Windows Hello for Business Authentication Certificate Lifecycle

This chapter includes the following topics:

• Renewal
• Expiration
• Revocation
• Reset

Renewal

Renewal of the certificate will occur in the background automatically when the certificate nears the expiration period. But for the certificate to renew, it requires the user to be logged in to the machine. If the user misses the renewal period for some reason, the certificate will reach expiration.

During Windows Hello for Business Authentication certificate renewal, only the certificate information is updated (such as validity notBefore and notAfter) and asymmetric keys are not regenerated.

Expiration

When the automatic renewal does not occur during the renewal period for some reason, the certificate will expire. But users should be able to log on to their machine using the Windows Hello credential for the first time after certificate reaches the expiration. After successful login, the operating system will try to re-issue the certificate in the background. If the user logs out of the machine before this takes place, the user will not be able to login using their Windows Hello credential, with a screen like below.

The user will need to login using Active Directory credential if this happens, but Windows Hello credential should be re-issued after some time automatically after successful login.

During re-issuance, only the certificate information is updated (such as validity notBefore and notAfter) and asymmetric keys are not regenerated.

Revocation

When Windows Hello for Business Authentication certificate is revoked, the user will not be able to log in using their Windows Hello credential, with a screen like below.

The timing in which OS identifies that the certificate is revoked depends on the update time of CRL or OCSP, so it may not be reflected immediately after the certificate is revoked.

The user will need to reset Windows Hello credential by such method as using “I forgot my PIN” in the login screen. See below “Reset” for more details.

Reset

When the user resets their Windows Hello credential such as using “I forgot my PIN” in the login screen, the user will be re-provisioned, and the certificate will be issued again. Asymmetric keys will be regenerated, and the new certificate will be issued. However, this will not revoke the previous user certificate on DigiCert® Trust Lifecycle Manager.

Troubleshooting

Refer to the following documents for troubleshooting.

• Windows Hello for Business Deployment Known Issues
• Windows Hello errors during PIN creation

Known Issue

Active Directory Federation Service tries to issue a certificate for the Service Account from the Microsoft® Enrollment Agent profile every 12 hours to check the status of the Certificate Authority in spite of the certificate validity, configured on the Microsoft® Enrollment Agent profile. However, since the default value for Allow duplicate certificates is Disabled for the template, DigiCert Certificate Authority will reject the request, resulting in an error showing up under Windows Event Log (“Applications and Services Logs” → “AD FS” → “Admin”):

Screenshot of Windows Event Viewer Log

Also following CR_DISP_DENIED log entries will appear in AEServer logs for this request:

DigiCert has already reported this issue to Microsoft, but we have come to a conclusion that this error entry will not impact the overall functionality of the Windows Hello for Business.

Even if you Enable the Allow duplicate certificates for Microsoft® Enrollment Agent profile, it will eventually result in the same error after 10 successful certificate issuance. This is due to DigiCert® Trust Lifecycle Manager only allowing 10 duplicate certificate issuance against the same Seat Id even if the profile allows it.