Strong Certificate Mapping Enforcement for offline certificate requests

Hello Federico

To manually add the OID 1.3.6.1.4.1.311.25.2 and the binary SID of a device account to a certificate request, you’ll need to extract the SID from Active Directory and format it correctly in the request file.

To proceed, you can retrieve the SID of the printer's AD account using PowerShell:

• Get-ADComputer -Identity "PrinterName" | Select-Object SID

Once you have the string SID, you'll need to convert it to binary format. This can be done using .NET interop in PowerShell or tools like Lord of the SID. Then, include the binary SID in your certificate request using an INF file with the otherName field under the Subject Alternative Name extension.

Here’s a sample snippet:

[Extensions]

2.5.29.17 = "{text}"

continue = "otherName = 1.3.6.1.4.1.311.25.2;UTF8:<binary SID in hex>"

--

After preparing the INF file, use certreq -new to generate the request and submit it to your internal CA. If this answer helps resolve your issue, feel free to click “Accept Answer” so others can benefit too 😊.

Harry.