Set up certificate templates

Every certificate enrollment request uses a CA template. The template connects the request to an issuer, limits the private key algorithms that enrollments can use, and fills in the organization details of the certificate subject. By the end of this guide, you will have an enabled template that requesters can select.

Before you begin

• Add at least one issuer. See Add a Windows ADCS issuer or Add a DigiCert issuer.
• Make sure your role has the manage permission for CA Templates. Without it, you cannot create, edit, or enable templates.

Where templates come from

When you sync a Windows ADCS issuer, ITVA imports the templates that the CA publishes. Each imported template gets its name, CA name, and the Standalone setting from the CA. A later sync updates only the CA name and the standalone setting, so your changes to the other fields stay.

DigiCert issuers do not import templates. Create each DigiCert template yourself.

All templates start disabled, both imported and new ones. Requesters can only select a template after you enable it.

Create a template

1. In the PKI menu, open CA Templates.
2. Select New. The New Certificate Authority Template drawer opens.
3. In Name, type a name for the template. Each name must be unique for its issuer.
4. Optional: in Description, tell requesters what the template is for.
5. In Issuer, select the issuer that signs the certificates. The drawer then shows the settings for that issuer kind.
6. Fill in the issuer settings. See Windows ADCS settings or DigiCert settings below.
7. Set the allowed private key algorithms and the organization information. The next sections explain both.
8. Select Save.

To change a template later, open it from the CA Templates page and select Edit.

Windows ADCS settings

• CA Name (required): the CA configuration name that ITVA sends the request to. An imported template already has this value.
• Standalone CA: select this if the CA is a standalone CA. If it is clear, ITVA treats the CA as an enterprise CA and asks it to use the ADCS template with the same name as this template. For an enterprise CA, keep the template name the same as the name in ADCS.

If you select Standalone CA, the drawer also shows Extended Key Usages with two options: Server Authentication and Client Authentication. The usages you select here are preselected on each enrollment request, and the requester can change them. A standalone CA issues the usages that the request asks for. An enterprise CA applies the usages from its own ADCS template.

DigiCert settings

• Organization ID (required): the number of the CertCentral organization that the certificates are ordered for.
• Product Name ID (required): the CertCentral product to order.

For where to find these values, see Add a DigiCert issuer.

Lock down private key algorithms

Use the Private Key Algorithms section to set which keys are allowed for certificates from this template. By default, all algorithms are selected. Clear the ones that your security policy does not permit.

ITVA checks the key each time an enrollment issues, renews, or reissues a certificate. The check applies to every key source: a key that ITVA generates, a key generated on a device, and a CSR that you upload. For an uploaded CSR, ITVA reads the algorithm from the public key in the CSR.

If the key is not allowed, ITVA stops the request before it reaches the issuer. The enrollment history shows an error such as:

RSA 2048 is not allowed by the Web Servers template. Allowed private key algorithms: RSA 4096, ECDSA 384.

ITVA also rejects keys that are not in the list at all, for example RSA 1024 or an unsupported curve.

Caution: the allowed list also applies to enrollments that already use the template. Before you remove an algorithm, find the enrollments that use it. If you do not change their key source, their next renewal fails, including automatic renewals.

Prefill organization information

The Organization Information section is optional. When a requester selects the template in the New Certificate Enrollment Request drawer, ITVA copies these values into the request form. This saves typing and keeps the certificate subjects consistent.

The prefilled values are defaults, not locks. The requester can change them before saving the request. All five fields are required on the request, so a template without them makes the requester type each value.

If the requester selects a different template, ITVA replaces the five fields with the values from the new template.

Enable the template

1. Open the CA Templates page.
2. In the row for the template, turn on the Enabled switch.

You can also use the Enabled switch on the template details page. Users who can only view CA templates see enabled templates only. Users with the manage permission see all templates.

To stop new requests from using a template, turn the switch off.

Check that it worked

1. Open the template. Make sure that Enabled is on and Allowed Private Key Algorithms shows only the algorithms you selected.
2. Start a new certificate enrollment request and select the template in Template.
3. Make sure that the organization fields show the values from the template.

Troubleshooting