Q: Can Encrypting File System (EFS) certificates and Web application client certificates conflict with one another? In our environment, we use EFS to secure the My Documents folder on laptops. We also have a key business partner whose extranet requires some of our users to install a client certificate for secure Web-based access to logistics information. One such user’s client certificate recently expired, so I deleted it and requested a new one from our business partner’s Certification Authority (CA). After the CA issued the new certificate, I installed it on the user’s workstation and everything appeared to be working fine. A short time later, however, I received a call from the user saying that he couldn’t access his encrypted My Documents folder. I knew I hadn't deleted the user’s EFS certificate, and I quickly confirmed that by using the Microsoft Management Console (MMC) Certificates snap-in. Luckily, we were able to recover the user’s files using the EFS Recovery Agent certificate. Apparently, the client certificate—rather than the EFS certificate that we provide through the domain—had encrypted the user's files. Is that possible, and if so, why? Aren’t certificate templates supposed to define what purposes a certificate can be used for? . . .
Register
