To enhance security when provisioning certificates for DirectAccess (computer) or Windows 10 Always On VPN (user) it is recommended that private keys be stored on a Trusted Platform Module (TPM) on the client device. A TPM is a dedicated security processor included in nearly all modern computers. It provides essential hardware protection to ensure the highest levels of integrity for digital certificates and is used to generate, store, and restrict the use of cryptographic keys. It also includes advanced security and protection features such as key isolation, non-exportability, and anti-hammering to prevent brute-force attacks.
To ensure that private keys are created and stored on a TPM, the certificate template must be configured to use the Microsoft Platform Crypto Provider. Follow the steps below to configure a certificate template required to use a TPM.
- Open the Certificate Templates management console (certtmpl.msc) and duplicate an existing certificate template. For example, if creating a certificate for DirectAccess, duplicate the Workstation Authentication certificate template. For Always On VPN, duplicate the User certificate template.
- On the Compatibility tab, ensure the Certification Authority and Certificate recipient compatibility settings are set to a minimum of Windows Server 2008 and Windows Vista/Server 2008, respectively.
- Select the Cryptography tab.
- Choose Key Storage Provider from the Provider Category drop down list.
- Choose the option Requests must use one of the following providers and select Microsoft Platform Crypto Provider.
Note: If Microsoft Platform Crypto Provider does not appear in the list above, got to the Request Handling tab and uncheck the option Allow private key to be exported.
Complete the remaining certificate configuration tasks (template display name, subject name, security settings, etc.) and publish the certificate template. Client machines configured to use this template will now have a certificate with private key fully protected by the TPM.
Additional Resources
Jamie Holmes
/ March 12, 2018For extra assurance, you can also enable Key Attestation using either Endorsement Certificate or Endorsement Key mode.
This is to verify that the certificate is definitely being issued to a TPM, and not a crypto provider that’s simply been renamed!
Richard M. Hicks
/ March 12, 2018Thanks for the tip, Jamie! I’ll be authoring a post on that topic hopefully soon. 🙂
Eric Yew
/ June 13, 2018Any update on when this post will be available? Thanks!
Richard M. Hicks
/ June 15, 2018It’s still on my list, just haven’t gotten to it yet. Here are some details from Microsoft – https://docs.microsoft.com/en-us/windows-server/identity/ad-ds/manage/component-updates/tpm-key-attestation.
Enjoy!
Eric Yew
/ June 17, 2018Yes, have tried it but unfortunately it’s not as easy as the document states. I configured as per documentation utilising “Trust based on user credential” and the VPN will never connect. The moment I disable TPM attestation and reissue the cert, it works. Any help or directions would be greatly appreciated. Thanks.
Richard M. Hicks
/ June 18, 2018Sorry to hear that. This is not a common requirement in my experience, so it’s not a high priority at the moment. However, I’ll try do some validation testing when time permits and let you know what I find.
Patrick
/ June 11, 2018Hello Richard
does Always On VPn device tunnel work with TPM module for authenfication device?
Richard M. Hicks
/ June 11, 2018It certainly can. 🙂
Matt
/ December 10, 2018Does anyone have Key Attestation working with AOVPN yet?
Richard M. Hicks
/ December 10, 2018I’ve done some testing in the pass and didn’t have any issues. Which trust model are you using?
Matt
/ December 10, 2018I haven’t tried it, but I have only seen failures posted with no solutions. So, I didn’t want to attempt it if it isn’t known to work.
Richard M. Hicks
/ December 10, 2018It’s not trivial to get working correctly, but it is possible. Best documentation and guidance for enabling/configuring key attestation can be found here: https://docs.microsoft.com/en-us/windows-server/identity/ad-ds/manage/component-updates/tpm-key-attestation.
Volker
/ August 29, 2019How can I enforce that only TPM certificates are accepted by the vpn Server?
Richard M. Hicks
/ August 29, 2019You can really configure the VPN server to only accept certificates with private keys store on a TPM. What you can do is ensure that clients can only use a TPM with this certificate template (as outlined in this post). You can take additional steps to increase assurance that key material is generated and store on a TPM by using key attestation as well.
korman
/ July 9, 2020Can this also be done with a Machine or computer certificate?
Richard M. Hicks
/ July 10, 2020Absolutely, and recommended.