Can a user have a certificate or does only a machine have a certificate?

[zaza]

If say you want to set up a PKI and use EAP-TLS to authenticate all users and computers.

A computer's certificate is stored on that computer. But how can a user have a certificate? Where is it stored? What if a user logs in from another computer, how will he provide his certificate for client authentication?

[cappalli · Accepted solution]

There is a system cert store and a user store. Machine certs are stored in the system store and user certs are stored in the user store.

[zaza]

cappalli, what if the domain user is logging in from another computer? Do you mean to say the certificate of every single user is stored in the user store on EVERY SINGLE MACHINE IN THE DOMAIN?

[cjoseph]

In practice, it is worse than that...  Typically user certificates are only distributed via group policy when that user logs in successfully via a wired computer.  The user would have had to login to a wired computer to even have the certificate distributed to the user's profile before using it wirelessly.  That is why many secure environments only have wireless eap-tls with machine certificates and machine-only wireless authentication...  Having a multi-user device with wireless user certificates is a headache to provision in practice for multiple user.

[zaza]

Thank you cjoseph but that doesn't answer the question.

[cappalli]

The machine cert is unique per device. The user cert is downloaded into the user cert store after the user logs in. This can cause complications when using machine + user authentication because the first time a user authenticates, the certificate is not available until after the login process completes.

[zaza]

cappalli I'm still confused. If by simply logging into the domain with his username and password he will get a certificate, then what's the point of a user certificate? Isn't the whole idea of a user certificate to authenticate the user?

[cappalli]

For the network, yes. To use a certificate to log on to the machine itself, you'd need to use a smartcard.