# Set up certificate templates

> Create a CA template that controls which issuer signs a certificate, which private key algorithms are allowed, and which subject values are prefilled for requesters.

Section: PKI & CLM  
Source: https://www.itva.com/docs/pki-clm/set-up-certificate-templates  
Last updated: 2026-11-03

Every certificate enrollment request uses a CA template. The template connects the request to an issuer, limits the private key algorithms that enrollments can use, and fills in the organization details of the certificate subject. By the end of this guide, you will have an enabled template that requesters can select.

## Before you begin

- Add at least one issuer. See [Add a Windows ADCS issuer](https://www.itva.com/docs/issuers/add-a-windows-adcs-issuer) or [Add a DigiCert issuer](https://www.itva.com/docs/issuers/add-a-digicert-issuer).
- Make sure your role has the manage permission for **CA Templates**. Without it, you cannot create, edit, or enable templates.

## Where templates come from

When you sync a Windows ADCS issuer, ITVA imports the templates that the CA publishes. Each imported template gets its name, CA name, and the **Standalone** setting from the CA. A later sync updates only the CA name and the standalone setting, so your changes to the other fields stay.

DigiCert issuers do not import templates. Create each DigiCert template yourself.

All templates start disabled, both imported and new ones. Requesters can only select a template after you enable it.

## Create a template

1. In the PKI menu, open **CA Templates**.
2. Select **New**. The **New Certificate Authority Template** drawer opens.
3. In **Name**, type a name for the template. Each name must be unique for its issuer.
4. Optional: in **Description**, tell requesters what the template is for.
5. In **Issuer**, select the issuer that signs the certificates. The drawer then shows the settings for that issuer kind.
6. Fill in the issuer settings. See **Windows ADCS settings** or **DigiCert settings** below.
7. Set the allowed private key algorithms and the organization information. The next sections explain both.
8. Select **Save**.

To change a template later, open it from the **CA Templates** page and select **Edit**.

### Windows ADCS settings

- **CA Name** (required): the CA configuration name that ITVA sends the request to. An imported template already has this value.
- **Standalone CA**: select this if the CA is a standalone CA. If it is clear, ITVA treats the CA as an enterprise CA and asks it to use the ADCS template with the same name as this template. For an enterprise CA, keep the template name the same as the name in ADCS.

If you select **Standalone CA**, the drawer also shows **Extended Key Usages** with two options: **Server Authentication** and **Client Authentication**. The usages you select here are preselected on each enrollment request, and the requester can change them. A standalone CA issues the usages that the request asks for. An enterprise CA applies the usages from its own ADCS template.

### DigiCert settings

- **Organization ID** (required): the number of the CertCentral organization that the certificates are ordered for.
- **Product Name ID** (required): the CertCentral product to order.

For where to find these values, see [Add a DigiCert issuer](https://www.itva.com/docs/issuers/add-a-digicert-issuer).

## Lock down private key algorithms

Use the **Private Key Algorithms** section to set which keys are allowed for certificates from this template. By default, all algorithms are selected. Clear the ones that your security policy does not permit.

| Family | Options |
| --- | --- |
| RSA | RSA 2048, RSA 3072, RSA 4096, RSA 8192 |
| ECDSA | ECDSA 256, ECDSA 384, ECDSA 521 |
| ML-DSA (post-quantum) | ML-DSA-44, ML-DSA-65, ML-DSA-87 |

ITVA checks the key each time an enrollment issues, renews, or reissues a certificate. The check applies to every key source: a key that ITVA generates, a key generated on a device, and a CSR that you upload. For an uploaded CSR, ITVA reads the algorithm from the public key in the CSR.

If the key is not allowed, ITVA stops the request before it reaches the issuer. The enrollment history shows an error such as:

```
RSA 2048 is not allowed by the Web Servers template. Allowed private key algorithms: RSA 4096, ECDSA 384.
```

ITVA also rejects keys that are not in the list at all, for example RSA 1024 or an unsupported curve.

**Caution:** the allowed list also applies to enrollments that already use the template. Before you remove an algorithm, find the enrollments that use it. If you do not change their key source, their next renewal fails, including automatic renewals.

## Prefill organization information

The **Organization Information** section is optional. When a requester selects the template in the **New Certificate Enrollment Request** drawer, ITVA copies these values into the request form. This saves typing and keeps the certificate subjects consistent.

| Template field | Request form field | Subject attribute |
| --- | --- | --- |
| Organization Name | Organization | O |
| Organization Unit Name | Organization Unit | OU |
| Locality Name | City | L |
| State Or Province Name | State / Province | ST |
| Country Name | Country | C |

_Each value goes into the subject of the certificate signing request._

The prefilled values are defaults, not locks. The requester can change them before saving the request. All five fields are required on the request, so a template without them makes the requester type each value.

If the requester selects a different template, ITVA replaces the five fields with the values from the new template.

## Enable the template

1. Open the **CA Templates** page.
2. In the row for the template, turn on the **Enabled** switch.

You can also use the **Enabled** switch on the template details page. Users who can only view CA templates see enabled templates only. Users with the manage permission see all templates.

To stop new requests from using a template, turn the switch off.

## Check that it worked

1. Open the template. Make sure that **Enabled** is on and **Allowed Private Key Algorithms** shows only the algorithms you selected.
2. Start a new certificate enrollment request and select the template in **Template**.
3. Make sure that the organization fields show the values from the template.

## Troubleshooting

| Message or symptom | Cause and fix |
| --- | --- |
| CA name is required | The issuer is Windows ADCS and CA Name is empty. Type the CA configuration name. |
| Digicert organization ID is required | The issuer is DigiCert and Organization ID is empty. Type the CertCentral organization ID. |
| Digicert product name ID is required | The issuer is DigiCert and Product Name ID is empty. Type the CertCentral product name ID. |
| <algorithm> is not allowed by the <name> template | The key does not match the allowed list. Use an allowed algorithm, or edit the template to allow it. |
| A requester cannot find the template | The template is disabled. Turn on Enabled for the template. |
| An enterprise CA rejects the request | The template name in ITVA does not match a template on the CA. Sync the issuer and use the imported template. |