Authorization by certificates?

Question

User identification

Good day to you.
There is such a situation.
There is a user, he has a certificate for https access to a remote host.
We throw the machine into the domain. Under the old user logged in locally works.
Under the new domain user with the copied profile does not work. Under it with the reinstalled certificate does not work.
I decided that the certificate is bound to the username
BUT!
Under the old user with the changed password too does not work.
In general, so far the user is working with one foot in the domain. But that's not the point. Any ideas why it might work so crookedly?
Z.Y. WinXp SP3 client, IE browser, DC Win2k3. If you need more input, please specify.

Answer 1

When the password is changed, the user's private key expires. The only solution is to reissue the certificate. Under a domain account with a freshly issued certificate, it should work without problems (before changing the password, again), there is experience of more than a thousand users in this form. How do you issue a certificate?