userCertificate Attribute Role

i looking understand usercertificate attribute role. networks work use smart card authentication , usercertificate attribute tends filled expired smart cards , @ times third party encryption certificates. 2 questions:

• is there white / paper or deep dive discussion on role attribute plays in email or other encryption in windows environment?
• when performing encryption based on usercertificate attribute certificates, process choosing certificate use encryption when more 1 not expired or revoked?

my assumption usercertificate attribute purely public key encryption , used users public key encrypt message. if have more 1 certificate, not sure how right 1 gets selected.

the usercertificate attribute used publish certificate public key of associated user/computer. typically used 2 things in ad - smime encryption , encrypted file system. in case of smime, when email encrypted prior sending user, recipients public key used. in case of efs, when user chooses add individual list of users can unencrypt file, ad picker users public key of selected users.

as far how specific certificate selected, application choosing iterate attribute define rules want use. generally, best practice ensure single active public key certificate published given user. eliminates complexity.

here little info on how outlook works: http://blogs.technet.com/b/pki/archive/2008/12/17/outlook-s-mime-certificate-selection.aspx

---

mark b. cooper, president , founder of pki solutions inc., former microsoft senior engineer , subject matter expert microsoft active directory certificate services (adcs). known “the pki guy” @ microsoft 10 years.

Windows Server  >  Security