Alacris, one of our key PKI partners, just released version 3 of their excellent idNexus product. idNexus is a registration authority front end that provides smart card provisioning and lifecycle management capabilites. It's built on .NET and heavily leverages / integrates with Active Directory to provide great customization and workflow capabilities. If you've ever done a smart card deployment with our CA technology, you've probably noticed that our smart card management UI is rather, uh, limited. That's because the smart card enrollment pages were designed mainly as a developer reference to illustrate the programatic capabilities of our CA platform. Because of this, we don't offer 'in the box' mechanisms to deal with PIN unblocks, customized issuance workflows, reporting, or many of the other things my clients want. So, I always use idNexus for any client I'm working with where we're doing a large smart card deployment.