Certificate Templates

Certificate Templates allow customization of certificates issued by Certificate Services, including both how certificates are issued and what they contain.

Although all issued certificates are based on a certificate template, certificate templates can only be issued by an enterprise certification authority running on XOX, or XOX.

  • For tips about using Certificate Templates, see Best practices.
  • For help with specific tasks, see How to.
  • For general background information, see Concepts.
  • For problem-solving instructions, see Troubleshooting.

Note

  • XOX


Best practices

Do not delete the Certificate Publishers security group

  • The Certificate Publishers security group contains each certification authority's computer account and is used when publishing certificate templates to Active Directory. If this group is removed, the certification authority may not publish certificates to Active Directory correctly. To avoid this, the group should not be deleted and its membership should not be modified.

Do not exceed the certificate lifetime of the issuing certification authority

  • Certificate lifetimes work as a subset of the certification authority's (CA) certificate lifetime. All certificates, including the CA certificate, have an expiration date that they are no longer valid after. As a result, a certificate cannot be issued with a lifetime that exceeds the lifetime of the issuing CA. Issuing such a certificate would allow it to be valid for longer than the issuing CA certificate, which is impossible. A CA will therefore continue to issue certificates until the CA's certificate expires or until the requested template's renewal period is greater than the CA's certificate remaining lifetime.

Plan certificate templates before deployment

  • Certificates can be issued to subjects in many ways, including manual enrollment, autoenrollment and Web enrollment. In addition, there are many certificate strategies including issuing one all-inclusive certificate to all subjects and issuing several application-specific certificates to subjects as needed. Because there are so many options, planning should be done well in advance of certificate deployment.

Upgrade the certificate templates in Active Directory before upgrading from Windows 2000

  • XOX, and XOX, certification authorities use newer versions of certificate templates than those used by Windows 2000. These templates must be upgraded before the certification authorities are upgraded to ensure proper operation.

    • For more information, see To install new templates and upgrade existing templates.

Duplicate new templates from existing templates closest in function to the intended template

  • New certificate templates are duplicated from existing templates. Many settings are copied from the original template. Because of this, duplicating one template to another of a totally different type may carry over some unintended settings. When duplicating a template, examine the subject type of the original template and ensure that you duplicate one that has a similar function to that of the intended template. Although most settings for certificate templates can be edited once the template is duplicated, the subject type cannot be changed.

    • For a list of certificate templates and their subject types, see Default certificate templates.


How to...

  • Install new templates and upgrade existing templates
  • Create a new certificate template
  • Delete a certificate template
  • Add a certificate template to a certification authority
  • Allow subjects to request a certificate that is based on the template
  • Re-enroll all certificate holders
  • Remove a certificate template from a certification authority
  • Modify a certificate template


Install new templates and upgrade existing templates

Microsoft Windows Graphic

To install new templates and upgrade existing templates

  1. Open Certificate Templates.
  2. When prompted to install new certificate templates, click OK.

Notes

  • To perform this procedure, you must be a member of both the Enterprise Admins group and the root domain's Domain Admins group in Active Directory. As a security best practice, consider using Run as to perform this procedure.
  • To open Certificate Templates, click Start, click Run, type certtmpl.msc, and then press Enter.
  • If this procedure has already been performed in your enterprise, you will not receive a prompt when you open Certificate Templates.
  • This procedure must be performed before any Windows 2000 enterprise certification authorities are upgraded to Windows Server 2003 family certification authorities. If any Windows 2000 enterprise certification authorities currently exist or have ever existed in your enterprise, you must perform this procedure to ensure the certificate templates are added and updated correctly.
  • This procedure must be performed on a certification authority (CA) in the certification hierarchy. Performing this procedure on a different computer may not work correctly.
  • Performing this procedure is important to apply the proper security permissions on the existing certificate templates as well as create new certificate templates. If you do not perform this procedure before upgrading your certification authorities to the Windows Server 2003 family, you will be prompted when opening the Certification Authority snap-in.
  • You must prepare the Active Directory schema with Adprep.exe for the upgrade before installing the new certificate templates. For more information on Adprep.exe, see Related Topics.

Related Topics


Create a new certificate template

Microsoft Windows Graphic

To create a new certificate template

  1. Open Certificate Templates.
  2. Right-click the template to copy from and then click Duplicate Template.
  3. Type a new name for this certificate template.
  4. Make any necessary changes and click OK.

Notes

  • To perform this procedure, you must be a member of the Enterprise Admins group or the root domain's Domain Admins group in Active Directory. As a security best practice, consider using Run as to perform this procedure.
  • To open Certificate Templates, click Start, click Run, type certtmpl.msc, and then press Enter.
  • New certificate templates must be created by copying an existing template and using the existing template's properties as the default for the new template. Copy the existing certificate template closest to the configuration of the intended new template to minimize the work necessary.
  • Although Version 2 templates can be created and duplicated in XOX, certificates based on Version 2 templates can only be issued by a certification authority running XOX, or XOX.

Related Topics


Delete a certificate template

Microsoft Windows Graphic

To delete a certificate template

  1. Open Certificate Templates
  2. Right-click the template, and then click Delete.

Caution

  • When you delete a certificate template, certificates can no longer be issued based on it. If you are using Enterprise CAs, this will affect all CAs in the forest. Certificate templates cannot be recovered once they are deleted.

Notes

  • To perform this procedure, you must be a member of the Enterprise Admins group or the root domain's Domain Admins group in Active Directory. As a security best practice, consider using Run as to perform this procedure.
  • To open Certificate Templates, click Start, click Run, type certtmpl.msc, and then press Enter.

Related Topics


Add a certificate template to a certification authority

Microsoft Windows Graphic

To add a certificate template to a certification authority

  1. Open Certification Authority
  2. Right-click the Certificate Templates container, click New, then click Certificate Template to Issue.
  3. Select the certificate template and click OK.

Notes

  • To perform this procedure, you must be a member of the Enterprise Admins group or the root domain's Domain Admins group in Active Directory. As a security best practice, consider using Run as to perform this procedure.
  • To open Certificate Templates, click Start, click Run, type certtmpl.msc, and then press Enter.
  • This procedure is applicable to version 2 templates. For more information about version 2 templates, see Related Topics.

Related Topics


Allow subjects to request a certificate that is based on the template

Microsoft Windows Graphic

To allow subjects to request a certificate that is based on the template

  1. Open Certificate Templates.
  2. In the details pane, right-click the certificate template that you want to change, and then click Properties.
  3. On the Security tab, add the groups, computers, or users that you want.
  4. In Group or user names, click one of the new objects, and then, on Permissions for ObjectName, under the Allow column, select the Read and Enroll check boxes.
  5. Repeat the previous step for each new object.

Notes

  • To perform this procedure, you must be a member of the Enterprise Admins group or the root domain's Domain Admins group in Active Directory. As a security best practice, consider using Run as to perform this procedure.
  • To open Certificate Templates, click Start, click Run, type certtmpl.msc, and then press Enter.
  • The Autoenroll permission must also be set if the subject will be using client autoenrollment to obtain certificates. For more information on autoenrollment, see Related Topics.
  • To disallow subjects from requesting a certificate based on a template, clear the Read and Enroll check boxes using the same steps as above.

Related Topics


Re-enroll all certificate holders

Microsoft Windows Graphic

To re-enroll all certificate holders

  1. Open Certificate Templates.
  2. Right-click the template that you want to use and then click Reenroll All Certificate Holders.

Notes

  • To perform this procedure, you must be a member of the Enterprise Admins group or the root domain's Domain Admins group in Active Directory. As a security best practice, consider using Run as to perform this procedure.
  • To open Certificate Templates, click Start, click Run, type certtmpl.msc, and then press Enter.
  • This procedure is used when a critical change is made to the certificate template and you want all subjects that hold a certificate that is based on this template to re-enroll as quickly as possible. The next time the subject verifies the version of the certificate against the version of the template on the certification authority, the subject will re-enroll.

Related Topics


Remove a certificate template from a certification authority

Microsoft Windows Graphic

To remove a certificate template from a certification authority

  1. Open Certification Authority
  2. In the console tree, click Certificate Templates.
  3. In the details pane, right-click the certificate template that you want, and then click Delete.

Notes

  • To perform this procedure, you must be a member of the Enterprise Admins group or the root domain's Domain Admins group in Active Directory. As a security best practice, consider using Run as to perform this procedure.
  • To open Certification Authority, click Start, click Run, type certsrv.msc, and then press Enter.

Related Topics


Modify a certificate template

  • Supersede templates
  • Configure a certificate template for key archival and recovery
  • Configure a certificate template for client autoenrollment
  • Modify enrollment policy
  • Create an application policy
  • Create an issuance policy
  • Add an application policy
  • Add an issuance policy
  • Make certificate or application policy critical
  • Change key usage
  • Change basic constraints


Supersede templates

Microsoft Windows Graphic

To supersede templates

  1. Open Certificate Templates
  2. In the details pane, right-click the certificate template that you want to change, and then click Properties.
  3. Click the Superseded Templates tab.
  4. Click Add.
  5. Click one or more templates to supersede, then click OK.

Notes

  • To perform this procedure, you must be a member of the Enterprise Admins group or the root domain's Domain Admins group in Active Directory. As a security best practice, consider using Run as to perform this procedure.
  • To open Certificate Templates, click Start, click Run, type certtmpl.msc, and then press Enter.
  • This procedure is applicable to version 2 templates. For more information about version 2 templates, see Related Topics.
  • This procedure is used when a template replaces another template and you want subjects of certificates based on the old template to obtain new certificates based on the new template. It forces subjects to obtain a new certificate before their configured renewal period.

Related Topics


Configure a certificate template for key archival and recovery

Microsoft Windows Graphic

To configure a certificate template for key archival and recovery

  1. Open Certificate Templates.
  2. In the details pane, right-click the certificate template that you want to change, and then click Properties.
  3. On the Request Handling tab, select the Archive subject's encryption private key check box.

Notes

  • To perform this procedure, you must be a member of the Enterprise Admins group or the root domain's Domain Admins group in Active Directory. As a security best practice, consider using Run as to perform this procedure.
  • To open Certificate Templates, click Start, click Run, type certtmpl.msc, and then press Enter.
  • This procedure is applicable to version 2 templates. For more information about version 2 templates, see Related Topics.
  • In addition to this procedure, the certification authority must be configured to archive keys. For more information, see Related Topics.
  • Clients must be re-enrolled to receive a certificate that is based on the changed template if they already have a valid certificate that is based on the old template. For more information about re-enrolling clients, see Related Topics.

Related Topics


Configure a certificate template for client autoenrollment

Microsoft Windows Graphic

To configure a certificate template for client autoenrollment

  1. Open Certificate Templates.
  2. In the details pane, right-click the certificate template that you want to change, and then click Properties.
  3. On the Security tab, add the users or groups that you want and, under Allow, select the Read, Enroll, and Autoenroll check boxes.
  4. (Optional) To automatically enroll the subject without any more user input, on the Request Handling tab, click Enroll subject without requiring any user input.

Notes

  • To perform this procedure, you must be a member of the Enterprise Admins group or the root domain's Domain Admins group in Active Directory. As a security best practice, consider using Run as to perform this procedure.
  • To open Certificate Templates, click Start, click Run, type certtmpl.msc, and then press Enter.
  • This procedure is applicable to version 2 templates. For more information about version 2 templates, see Related Topics.
  • In addition to this procedure, other settings must be configured to allow client autoenrollment. For more information, see Related Topics.
  • Clients must be re-enrolled to receive a certificate based on the changed template if they already have a valid certificate based on the old template. For more information about re-enrolling clients, see Related Topics.
  • When autoenrollment retrieves a certificate that is configured to be stored on a smart card, you will receive a popup message when the certificate is ready to be stored on the smart card. If the message refers to a type of smart card that you do not have, click Cancel until the correct smart card type appears. You then provide the smart card PIN and the certificate will be stored on the smart card.
  • When autoenrollment enrolls for a certificate that requires user interaction for the enrollment process, you will receive a Certificate Enrollment popup message and an icon will appear on your taskbar. Clicking that icon or message begins the certificate autoenrollment process.

Related Topics


Modify enrollment policy

Microsoft Windows Graphic

To modify enrollment policy

  1. Open Certificate Templates
  2. In the details pane, right-click the certificate template that you want to change, and then click Properties.
  3. Click the Issuance Requirements tab.
  4. Provide the requested information.

Notes

  • To perform this procedure, you must be a member of the Enterprise Admins group or the root domain's Domain Admins group in Active Directory. As a security best practice, consider using Run as to perform this procedure.
  • To open Certificate Templates, click Start, click Run, type certtmpl.msc, and then press Enter.
  • This procedure is applicable to version 2 templates. For more information about version 2 templates, see Related Topics.
  • Clients must be re-enrolled to receive a certificate based on the changed template if they already have a valid certificate based on the old template. For more information about re-enrolling clients, see Related Topics.

Related Topics


Create an application policy

Microsoft Windows Graphic

To create an application policy

  1. Open Certificate Templates.
  2. In the details pane, right-click the certificate template that you want to change, and then click Properties.
  3. On the Extensions tab, click Application Policies, and then click Edit.
  4. In Edit Application Policies Extension, click Add.
  5. In Add Application Policy, click New.
  6. Provide the requested information.

Notes

  • To perform this procedure, you must be a member of the Enterprise Admins group or the root domain's Domain Admins group in Active Directory. As a security best practice, consider using Run as to perform this procedure.
  • To open Certificate Templates, click Start, click Run, type certtmpl.msc, and then press Enter.
  • This procedure is applicable to version 2 templates. For more information about version 2 templates, see Related Topics.
  • Clients must be re-enrolled to receive a certificate based on the changed template if they already have a valid certificate based on the old template. For more information about re-enrolling clients, see Related Topics.

Related Topics


Create an issuance policy

Microsoft Windows Graphic

To create an issuance policy

  1. Open Certificate Templates.
  2. In the details pane, right-click the certificate template that you want to change, and then click Properties.
  3. On the Extensions tab, click Issuance Policies, and then click Edit.
  4. In Edit Issuance Policies Extension, click Add.
  5. In Add Issuance Policy, click New.
  6. Provide the requested information.

Notes

  • To perform this procedure, you must be a member of the Enterprise Admins group or the root domain's Domain Admins group in Active Directory. As a security best practice, consider using Run as to perform this procedure.
  • To open Certificate Templates, click Start, click Run, type certtmpl.msc, and then press Enter.
  • This procedure is applicable to version 2 templates. For more information about version 2 templates, see Related Topics.
  • Clients must be re-enrolled to receive a certificate based on the changed template if they already have a valid certificate based on the old template. For more information about re-enrolling clients, see Related Topics.

Related Topics


Add an application policy

Microsoft Windows Graphic

To add an application policy

  1. Open Certificate Templates
  2. In the details pane, right-click the certificate template that you want to change, and then click Properties.
  3. On the Extensions tab, click Application Policies and then click Edit.
  4. In Edit Application Policies Extension, click Add.
  5. In Add Application Policy, click the application policy that you want, then click OK.

Notes

  • To perform this procedure, you must be a member of the Enterprise Admins group or the root domain's Domain Admins group in Active Directory. As a security best practice, consider using Run as to perform this procedure.
  • To open Certificate Templates, click Start, click Run, type certtmpl.msc, and then press Enter.
  • This procedure is applicable to version 2 templates. For more information about version 2 templates, see Related Topics.
  • Clients must be re-enrolled to receive a certificate based on the changed template if they already have a valid certificate based on the old template. For more information about re-enrolling clients, see Related Topics.

Related Topics


Add an issuance policy

Microsoft Windows Graphic

To add an issuance policy

  1. Open Certificate Templates.
  2. In the details pane, right-click the certificate template that you want to change, and then click Properties.
  3. On the Extensions tab, click Issuance Policies, and then click Edit.
  4. In Edit Issuance Policies Extension, click Add.
  5. In Add Issuance Policy, click New.
  6. Provide the requested information.

Notes

  • To perform this procedure, you must be a member of the Enterprise Admins group or the root domain's Domain Admins group in Active Directory. As a security best practice, consider using Run as to perform this procedure.
  • To open Certificate Templates, click Start, click Run, type certtmpl.msc, and then press Enter.
  • This procedure is applicable to version 2 templates. For more information about version 2 templates, see Related Topics.
  • Issuance Policies are also known as Certificate Policies.
  • Clients must be re-enrolled to receive a certificate based on the changed template if they already have a valid certificate based on the old template. For more information about re-enrolling clients, see Related Topics.

Related Topics


Make certificate or application policy critical

Microsoft Windows Graphic

To make certificate or application policy critical

  1. Open Certificate Templates.
  2. In the details pane, right-click the certificate template that you want to change, and then click Properties.
  3. On the Extensions tab, click Issuance Policies or Application Policies and then click Edit.
  4. Select the Make this extension critical check box.

Notes

  • To perform this procedure, you must be a member of the Enterprise Admins group or the root domain's Domain Admins group in Active Directory. As a security best practice, consider using Run as to perform this procedure.
  • To open Certificate Templates, click Start, click Run, type certtmpl.msc, and then press ENTER.
  • This procedure is applicable to version 2 templates. For more information about version 2 templates, see Related Topics.
  • Certificate Policies are also known as Issuance Policies.
  • Clients must be re-enrolled to receive a certificate based on the changed template if they already have a valid certificate based on the old template. For more information about re-enrolling clients, see Related Topics.

Related Topics


Change key usage

Microsoft Windows Graphic

To change key usage

  1. Open Certificate Templates.
  2. In the details pane, right-click the certificate template that you want to change, and then click Properties.
  3. On the Extensions tab, in the Extensions included in this template box, click Key Usage, and then click Edit.
  4. Make any necessary changes.

Notes

  • To perform this procedure, you must be a member of the Enterprise Admins group or the root domain's Domain Admins group in Active Directory. As a security best practice, consider using Run as to perform this procedure.
  • To open Certificate Templates, click Start, click Run, type certtmpl.msc, and then press Enter.
  • This procedure is applicable to version 2 templates. For more information about version 2 templates, see Related Topics.
  • Changing key usage is affected by the Purpose set for this certificate template on the Extensions tab.
  • Clients must be re-enrolled to receive a certificate based on the changed template if they already have a valid certificate based on the old template. For more information about re-enrolling clients, see Related Topics.

Related Topics


Change basic constraints

Microsoft Windows Graphic

To change basic constraints

  1. Open Certificate Templates
  2. In the details pane, right-click the certificate template that you want to change, and then click Properties.
  3. On the Extensions tab, click Basic Constraints and then click Edit.
  4. In Edit Basic Constraints Extension, provide the requested information.

Notes

  • To perform this procedure, you must be a member of the Enterprise Admins group or the root domain's Domain Admins group in Active Directory. As a security best practice, consider using Run as to perform this procedure.
  • To open Certificate Templates, click Start, click Run, type certtmpl.msc, and then press Enter.
  • This procedure only works with certificate templates that issue certificates that sign other certificates, such as Cross Certification Authority and Root Certification Authority.
  • This procedure is applicable to version 2 templates. For more information about version 2 templates, see Related Topics.

Related Topics


Concepts

This section provides general background information about Certificate Templates:

  • Certificate Templates overview
  • Understanding Certificate Templates
  • Deploying Certificate Templates
  • Using Certificate Templates
  • Resources


Certificate Templates overview

Certificate templates are an integral part of an enterprise certification authority (CA). They are an important element of the certificate policy for an environment, which is the set of rules and formats for certificate enrollment, use, and management.

When a CA receives a request for a certificate, groups of rules and settings must be applied to that request to perform the requested function, such as certificate issuance or renewal. These rules can be simple or complex and may apply to all users or specific groups of users. Certificate templates are the sets of rules and settings that are configured on a CA to be applied against incoming certificate requests. Certificate templates also give instructions to the client on how to create and submit a valid certificate request.

Although all issued certificates are based on a certificate template, certificate templates can only be issued by an enterprise CA running on XOX, or XOX. The templates are stored in Active Directory for use by every CA in the forest. This allows the CA to always have access to the current standard template and ensures homogenous application of certificate policy across the forest.


Understanding Certificate Templates

This section covers:

  • Key type and cryptographic service provider type
  • Certificate template enrollment policies
  • Validity and renewal periods
  • Subject name
  • Certificate Template extensions


Key type and cryptographic service provider type

Certificates contain public key information that is used to encrypt or verify the digital signature of information. Clients store this certificate in their certificate store and also store data that indicates which cryptographic service provider (CSP) stores the associated private key. This CSP could store the private key in memory, on disk, or on a hardware key store, such as a smart card. This allows the client to perform any public-key cryptography action based on the key pair. However, keys are created differently, depending on their purpose. Some keys will work for encrypting data but not signing data and vice versa. This is why key type and cryptographic service provider type must be configured correctly.

Key type

When a public/private key pair is generated, several types of keys can be created. Keys can be created to allow their use with encryption, digital signatures, or both. Certificate templates can be configured for a key purpose of encryption, signature, signature and encryption, or signature and smartcard logon. This setting is labeled Purpose in the Certificate Templates console.

Cryptographic service provider type

Cryptographic service providers (CSPs) are hardware and software components of Windows operating systems that provide generic cryptographic functions. These CSPs can be written to provide a variety of encryption and signature algorithms. Each of the CSPs that are configured to be used by a certificate template can potentially support different cryptographic algorithms and, therefore, different key lengths. This means that certificate templates must be configured to support one or more CSPs. Selecting specific CSPs allows the administrator to control what algorithms and key lengths are used with this certificate. Windows Server 2003 family includes a number of CSPs, and others can be added for enhanced functionality.


Certificate template enrollment policies

Certificates can be requested by any subject that has at least read and enroll permissions for the corresponding certificate template. In some cases, the administrator may want to place some restrictions on the process that occurs after a certificate request is made. This gives the administrator control of what certificates are issued and how the issuance process is implemented. This type of restriction is known as an enrollment policy. Enrollment policies can contain requirements for certificate manager approval, multiple authorized signature requirements, and whether application and issuance policies should be implemented for this certificate. For information about modifying enrollment policies, see To modify enrollment policy.


Validity and renewal periods

Certificate-based cryptography uses public-key cryptography to protect and sign data. Over time, evildoers can obtain data protected with the public key and attempt to derive the private key from it. Given enough time and resources, this private key could be compromised, effectively rendering all protected data unprotected. Also, over time, the names guaranteed by a certificate may need to be changed. Because a certificate is a binding between a name and a public key, when either of these change, the certificate should be renewed.

Validity periods

Certificates are enabled for a specific length of time, which is the validity period. This time is expressed in a length of time beginning from when a certificate is issued. When that length of time is reached, the certificate is no longer valid and cannot be trusted. Because an expired certificate can cause problems, certificates can be renewed to extend their validity period.

Renewal periods

A renewal period is the amount of time prior to the end of the validity period when the subject will renew the certificate using autoenrollment. Renewing the certificate during this interval ensures that last-minute requests for certificate renewal can be serviced before certificate expiration to allow uninterrupted use of the certificate.


Subject name

The holder of the private key associated with a certificate is known as the subject. This can be a user, a program, or virtually any object or service. Because the subject can vary greatly depending on who or what it is, some flexibility is needed when providing the subject name in the certificate request. Windows can either build the subject name automatically or request it from the subject manually. If it automatically provides the subject name, Windows obtains the information from Active Directory. You can configure this process to include or exclude information useful in the environment. If configured to manually provide the subject name, the subject supplies that information in the certificate request, for example by using the Web-based enrollment pages.


Certificate Template extensions

This section covers:

  • Issuance policies
  • Application policies
  • Key usage
  • Key archival
  • Basic constraints


Issuance policies

A certification authority (CA) processes each certificate request by a defined set of rules. The certification authority may issue some certificates with no proof of identification and require subjects of another type to submit some proof. This provides different levels of assurance for different certificates. These levels of assurance are represented in certificates as issuance policies.

An issuance policy (also known as a certificate policy) is a group of administrative rules that is implemented when issuing certificates. They are represented in a certificate by an object identifier (also known as an OID) that is defined at the certification authority. This object identifier is included in the issued certificate. When a subject presents its certificate, it can be examined by the target to verify the issuance policy and determine if that level of issuance policy is sufficient to perform the requested action.


Application policies

Application policies give you the important ability to decide which certificates can be used for certain purposes. This allows you to issue certificates widely without being concerned that they are misused for an unintended purpose.

Application policies are settings that inform a target that the subject holds a certificate that can be used to perform a specific task. They are represented in a certificate by an object identifier (also known as an OID) that is defined for a given application. This object identifier is included in the issued certificate. When a subject presents its certificate, it can be examined by the relying party to verify the application policy and determine if it can perform the requested action.

Application policies are sometimes called extended key usage or enhanced key usage. Because some implementations of public key infrastructure (PKI) applications may not understand application policies, both application policies and enhanced key usage sections appear in certificates issued by a Microsoft CA.


Key usage

A certificate enables the subject to perform a specific task. To help control the usage of a certificate outside its intended purpose, restrictions are automatically placed on certificates. Key usage is a restriction method and determines what a certificate can be used for. This allows the administrator to issue certificates that can only be used for specific tasks or certificates that be used for a broad range of functions.


Key archival

When subjects lose their private keys, any information that was persistently encrypted with the corresponding public key is inaccessible. To help avoid this, XOX, and XOX, have the ability to archive a subject's keys in its database when certificates are issued. These keys are encrypted and stored by the certification authority (CA). If a subject loses its keys, the information can be retrieved from the database and provided to the subject. This allows the encrypted information to be recovered instead of lost.

Important

  • Key archival and key recovery are only available on XOX, and XOX, running an enterprise CA.


Basic constraints

Certification authorities (CAs) must have a certificate before they can issue certificates. They use the private key associated with this certificate to digitally sign issued certificates. When a CA obtains a certificate from another CA, the parent CA may want to control whether that certificate can be used to issue certificates to other certificate servers. This is a basic constraint.

Basic constraints are used to ensure a certificate is only used in certain applications. An example is the path length that can be specified as a basic constraint. A path length is the maximum number of CA certificates above this one in a certification path. This path length constraint is used to ensure that CA certificates can only issue end entity certificates, not CA certificates. This is used to ensure that some certificates are used by a CA and some are used by other subjects.


Deploying Certificate Templates

This section covers:

  • Planning for autoenrollment deployment
  • Certificate templates deployment
  • Planning for certificate templates


Planning for autoenrollment deployment

Autoenrollment is a useful feature of certification services in XOX and XOX. Autoenrollment allows the administrator to configure subjects to automatically enroll for certificates, retrieve issued certificates, and renew expiring certificates without requiring subject interaction. The subject does not need to be aware of any certificate operations, unless you configure the certificate template to interact with the subject.

To properly configure subject autoenrollment, the administrator must plan the appropriate certificate template or templates to use. Several settings in the certificate template directly affect the behavior of subject autoenrollment.

  • On the Request Handling tab of the selected certificate template, the selection of an autoenrollment user interaction setting will affect autoenrollment:
    Setting | Affect on autoenrollment behavior
    Enroll subject without requiring any user input | This setting will allow "silent" autoenrollment without requiring the user to take any action. This setting is preferred when clients require certificates but may not be aware that they are using them.
    Prompt the user during enrollment | The user will receive a message and may need to take an action when enrollment is performed. This action may be necessary when the certificate is intended for a smart card, which would require the user to provide their personal identification (PIN).
    Prompt the user during enrollment and require user input when the private key is used This setting prompts the user both during enrollment and whenever the private key is used. This is the most interactive autoenrollment behavior, as it requires the user to confirm all use of the private key. It is also the setting that provides the highest level of user awareness regarding key usage.

    Caution

    • This setting is provided to the client during certificate enrollment. The client should follow the configuration setting, but the setting is not enforced by the certification authority.
  • On the Request Handling tab of the selected certificate template, the number of CSPs that are selected in the CSP Selection list box changes the behavior of autoenrollment for smart card templates. If you select more than one smart card CSP, users may receive more than one dialog box when XOX retrieves the autoenrolled certificate and begins to install it on the smart card. It is recommended that only one CSP be selected from this list for each template.
  • On the Subject Name tab of the selected certificate template, selecting the Supply in the request option disables autoenrollment based on this template. Enabling the option prompts the subject to interactively create the subject name in the request, which will not work with autoenrollment.
  • On the Issuance Requirements tab of the selected certificate template, selecting This number of authorized signatures and making the value greater than 1 disables subject autoenrollment based on this template.
  • On the Issuance Requirements tab of the selected certificate template, selecting This number of authorized signatures and setting the value to 1 requires the requestor to sign the request with a private key from a valid certificate in their certificate store. This certificate must contain the application and issuance policies that are specified in the Application policy and Issuance policies lists on the same tab. If an appropriate certificate exists in the requestor's certificate store, autoenrollment signs the request with this certificate's private key and obtains and installs the requested certificate automatically.
  • On the Issuance Requirements tab of the selected certificate template, the Valid existing certificate option may affect subject autoenrollment. This option tells the CA that the subject does not need to meet issuance requirements when renewing a valid certificate. Subjects who may have been unable to autoenroll for the initial certificate may be able to use autoenrollment to renew that certificate.
  • On the General tab of the selected certificate template, the Validity period and Renewal period settings specify the valid lifetime of the certificate and how long before the end of its lifetime autoenrollment will request a renewal. Because the validity period can be very short and the renewal period may overlap, autoenrollment will not renew a certificate until at least 20% of the certificate lifetime has expired. This prevents autoenrollment from endlessly renewing a certificate due to misconfigured validity and renewal period settings.

Note

  • XOX, or XOX, is required to configure version 2 certificate templates for autoenrollment requests. However, autoenrollment manages certificates or pending certificate requests based on any version of certificate template.


Certificate templates deployment

When deploying a Windows Server 2003 family enterprise certification authority (CA), certificate templates are stored in Active Directory. This centralizes the location for use by all CAs in the enterprise, as well as simplifies replication and security management. This also allows the CA to upgrade current certificate templates in Active Directory during installation. Note that this requires the root domain's Domain Admixs group to have full control access to all certificate templates or for this access to have been granted to another user or group.

Once you have planned and created the appropriate certificate templates, they will be replicated automatically to all domain controllers in the enterprise. This replication normally takes approximately eight hours to complete. Because of this interval, you should create the certificate template and allow it to replicate before deploying it to clients. This is best accomplished during an idle time in your environment. Configuring and using certificates before replication is completed can have unwanted effects.


Planning for certificate templates

This section covers:

  • Certificate template design considerations
  • Configuring a certification authority to support certificate template options


Certificate template design considerations

Before deploying certificates, you must plan in order to ensure that appropriate certificates are issued to subjects. The certificates must provide the capability to perform the tasks expected by the subject but must not allow the subject to use the certificate for unintended or malicious tasks. Some questions that must be considered at this stage are:

  • Who or what needs certificates?
  • What should I allow the subjects to do with the certificates?
  • How long will the certificates be valid for?
  • How many certificates could each subject possibly have?
  • How will the subjects obtain the certificates?

Each of these questions is further discussed in the following sections.

Name considerations

The holder of the private key associated with a certificate is known as the subject. This can be a user, a program, or virtually any object or service. Because the subject can vary greatly depending on who or what it is, you need some flexibility when providing the subject name in the certificate request. Windows can either build the subject name automatically or request it from the subject. If Windows automatically provides the subject name, it obtains the information from Active Directory. You can configure this process to include or exclude information that is useful in the environment. If it is configured to manually provide the subject name, the subject supplies that information in the certificate request using the Web-based enrollment pages.

Certificate lifetime

Certificate-based cryptography uses public key cryptography to protect and sign data. Over time, evildoers can obtain data that is protected with the public key and attempt to derive the private key from it. Given enough time and resources, this private key could be compromised, effectively rendering all protected data unprotected. Also, over time, the names guaranteed by a certificate may need to be changed. Because a certificate is a binding between a name and a public key, when either of these change, the certificate should be renewed.

Number of certificates per subject

Because subjects may have many uses for their certificates, an administrative decision must be made: whether to issue many specific certificates or a few broad certificates. This decision depends on the environment and the level of administration that you want and the possible effects on the subjects, as well as the effects of multiple certificates on applications that will use them.

One strategy of certificate administration creates a number of granular templates, one for each job function, such as file encryption or code signing. Subjects can then enroll for each certificate as needed for the appropriate function. This allows subjects to start with few certificates and only obtain new certificates that they need over time. The drawback to this strategy is that the subject may end up with a large number of certificates and private keys that become harder to manage over time.

A different strategy creates a few broad certificate templates that encompass job functions for most common groups of subjects. For example, if most employees use their certificates for mail signing and encryption as well as file encryption and IP Security, create one template that allows all those functions in the same certificate. This allows most subjects to obtain a single, all-purpose certificate. The drawback to this strategy is that there is no granular control of the usage of the certificates. The administrator cannot decide that subgroups cannot encrypt mail or use IP Security without modifying the template or changing the strategy.

Cryptographic service providers and key size

One or more cryptographic service providers (CSPs) are identified as usable by a template. This allows the administrator to control what types of cryptography subjects can use within an enterprise. This is very useful when security is of paramount importance. Because subjects use the CSP for both portions of any cryptographic service—either encryption and decryption or signing and confirming signature—it is necessary to ensure that all subjects can use the same CSP. Otherwise, subjects may not be able to communicate with each other or perform the necessary job tasks if the key types between their CSPs are not compatible.

The easiest way to do this is to configure each certificate template to identify exactly one CSP. Which CSP should be identified is up to the administrator and depends on the level of security required, the intended purposes of the certificate, and the presence of security hardware, such as smart cards. In addition, new CSPs can easily be installed and used after the certificate template is deployed.

Each CSP provides one or more cryptographic algorithms for encryption or digital signature. Because each algorithm is different and its strength relies directly on the length of the key it uses, the minimum key size is specified in the certificate template. As a general rule, larger keys provide more protection over shorter keys for the same algorithm. However, larger keys take longer to generate and use. Care should be given to select a minimum key size that ensures the necessary amount of protection without impacting performance.

When selecting the CSP to associate with a certificate template, the use of smart cards is also a consideration. Each type of smart card has an associated CSP that must be selected for the smart card to be used. If the correct smart card CSP is not associated with the template, the smart card will not be recognized and the template will fail.

Obtaining certificates

There are many ways that subjects can obtain certificates. The two general categories of these ways are manual and automatic. The subject can either manually obtain a certificate using a Web page or Microsoft Management Console (MMC) snap-in, or they can obtain it via autoenrollment that has been configured by the administrator. While autoenrollment requires a bit more initial configuration, it is effective for deploying required certificates to users and computers without the subject performing additional steps. For more information on autoenrollment, see Planning for autoenrollment deployment.


Configuring a certification authority to support certificate template options

Certificate templates are useful configuration elements of a XOX, certification authority (CA). Many of the benefits of editable templates work in conjunction with a properly configured certification authority. Although the default configuration of a certification authority will support most of the functions available, there may be deployment considerations which require reconfiguration of the certification authority.

Key archival and recovery

When you want key archival and recovery on a certification authority, three complimentary configuration settings must be made.

  • The certificate template must be configured to allow key archival. For more information, see To configure a certificate template for key archival and recovery.
  • One or more key recovery agents must be identified on the certification authority and key recovery agent certificates must be issued to those agents. For more information, see Example implementation: Key archival and recovery and To identify a key recovery agent.
  • Key archival must be configured on the certification authority. For more information, see To enable key archival.

Cryptographic service provider

When a cryptographic service provider (CSP) is selected for a certificate template, the selected CSP must be installed on the client computer (or device, if not a computer) as well as the computer configuring the certificate template. If the CSP is not installed, it will not be available for subject requests. This will render the certificate template useless until the configuration is corrected. The CSP must also be installed on the computer where the certificate template is edited.

When selecting CSPs for a certificate template, the intended use of the certificate must also be considered. The intended functionality of the certificate must be provided by the CSP for the template to be useful. For example, if a template was created for clients to use with Encrypting File System (EFS) and the CSP selected is Microsoft Base DSS and Diffie-Hellman Cryptographic Provider, which does not provide encryption functionality, the issued certificates will not be able to perform that function.


Using Certificate Templates

This section covers:

  • Version 1 certificate templates
  • Version 2 certificate templates
  • Default certificate templates
  • Controlling enrollment access to certificate templates
  • Certificate templates and Active Directory
  • Configuring a certificate template


Version 1 certificate templates

Microsoft certification authorities (CAs) support two types of certificate templates: version 1 and version 2. Version 1 templates are provided for backwards compatibility and support many general needs for subject certification. They are created by default when a certification authority is installed and cannot be modified or removed. They can be duplicated, creating a version 2 template that can be modified.

XOX, supports only version 1 templates. XOX, and XOX, support both version 1 and version 2 templates. For more information on version 2 templates, see Version 2 certificate templates.


Version 2 certificate templates

XOX, and XOX, certification authorities support two types of certificate templates: version 1 and version 2. Version 2 templates are new to the Windows Server 2003 family. They allow customization of most settings in the template. Several preconfigured version 2 templates are supplied in the default configuration, and more can be added as necessary. This allows complete configuration flexibility for administrators.

Version 2 templates are only available as part of a certification authority that is installed as an enterprise certification authority. For that reason, they require Active Directory. Although Version 2 templates can be created and duplicated in the Windows Server 2003 family, certificates that are based on Version 2 templates can only be issued by a certification authority that is running XOX, or XOX.


Default certificate templates

Windows Server 2003 family certification authorities come with a number of preconfigured certificate templates that are designed to meet the needs of most organizations. These templates are:

Name | Description | Key Usage | Subject Type | Published to Active Directory? | Template Version
Administrator | Allows trust list signing and user authentication | Signature and encryption | User | Yes | 1
Authenticated Session | Allows subject to authenticate to a Web server | Signature | User | No | 1
Basic EFS | Used by Encrypting File System (EFS) to encrypt data | Encryption | User | Yes | 1
CA Exchange | Used to store keys that are configured for private key archival | Encryption | Computer | No | 2
CEP Encryption | Allows the holder to act as a registration authority (RA) for simple certificate enrollment protocol (SCEP) requests | Encryption | Computer | No | 1
Code Signing | Used to digitally sign software | Signature | User | No | 1
Computer | Allows a computer to authenticate itself on the network | Signature and encryption | Computer | No | 1
Cross-Certification Authority | Used for cross-certification and qualified subordination. For more information, see Qualified subordination overview. | Signature | CrossCA | Yes | 2
Directory E-mail Replication | Used to replicate e-mail within Active Directory | Signature and encryption | DirEmailRep | Yes | 2
Domain Controller | All-purpose certificates used by domain controllers | Signature and encryption | DirEmailRep | Yes | 1
Domain Controller Authentication | Used to authenticate Active Directory computers and users | Signature and encryption | Computer | No | 2
EFS Recovery Agent | Allows the subject to decrypt files previously encrypted with EFS | Encryption | User | No | 1
Enrollment Agent | Used to request certificates on behalf of another subject | Signature | User | No | 1
Enrollment Agent (Computer) | Used to request certificates on behalf of another computer subject | Signature | Computer | No | 1
Exchange Enrollment Agent (Offline request) | Used to request certificates on behalf of another subject and supply the subject name in the request | Signature | User | No | 1
Exchange Signature Only | Used by Microsoft Exchange Key Management Service to issue certificates to Exchange users for digitally signing e-mail | Signature | User | No | 1
Exchange User | Used by Microsoft Exchange Key Management Service to issue certificates to Exchange users for encrypting email | Encryption | User | Yes | 1
IPSEC | Used by IP Security (IPSec) to digitally sign, encrypt, and decrypt network communication | Signature and encryption | Computer | No | 1
IPSEC (Offline request) | Used by IP Security (IPSec) to digitally sign, encrypt and decrypt network communication when the subject name is supplied in the request | Signature and encryption | Computer | No | 1
Key Recovery Agent | Recovers private keys that are archived on the certification authority. For more information, see Key archival and recovery. | Encryption | KRA | No | 2
RAS and IAS Server | Enables RAS and IAS servers to authenticate their identity to other computers | Signature and Encryption | Computer | No | 2
Root Certification Authority | Used to prove the identity of the root certification authority | Signature | CA | No | 1
Router (Offline request) | Used by a router when requested through Simple Certificate Enrollment Protocol (SCEP) from a certification authority that holds a CEP Encryption certificate | Signature and encryption | Computer | No | 1
Smartcard Logon | Allows the holder to authenticate using a smart card | Signature and encryption | User | No | 1
Smartcard User | Allows the holder to authenticate and protect e-mail using a smart card | Signature and encryption | User | Yes | 1
Subordinate Certification Authority | Used to prove the identity of the root certification authority. It is issued by the parent or root certification authority | Signature | CA | No | 1
Trust List Signing | Allows the holder to digitally sign a trust list | Signature | User | No | 1
User | Used by users for e-mail, EFS and client authentication | Signature and encryption | User | Yes | 1
User Signature Only | Allows users to digitally sign data | Signature | User | No | 1
Web Server | Proves the identity of a Web server | Signature and encryption | Computer | No | 1
Workstation Authentication | Enables client computers to authenticate their identity to servers | Signature and encryption | Computer | No | 2

For more information on certificate templates, see Certificate Templates. For more information on key usage, see Key Usage. For more information on template versions and publishing to Active Directory, see Using Certificate Templates.


Controlling enrollment access to certificate templates

Certificate templates are published on a server. Each contains an access control list (ACL) which defines what specific operations a subject can do with the certificate.

Setting | Description
Full Control | The selected group or user can perform any action on this template.
Read | The selected group or user can read this template.
Write | The selected group or user can modify this template.
Enroll | The selected group or user can submit a certificate issuance or renewal request based on this template.
Autoenroll | The selected group or user can submit a certificate request based on this template by way of autoenrollment. This option will not work unless the Enroll option is also selected.

The most common use of certificates is for subject enrollment with autoenrollment permitted. In this case, the subject must be granted Read, Enroll and Autoenroll permissions. If autoenrollment is not wanted but manual or Web-based enrollment is, granting the Read and Enroll permissions is appropriate. When subjects already hold a certificate, they only need Read and Enroll permissions to renew that certificate, whether they use autoenrollment or not.

Write and Full Control permissions should be restricted to CA managers to ensure the templates are not improperly configured.


Certificate templates and Active Directory

A Windows Server 2003 family certification authority can be installed as an enterprise server or a stand-alone server. When installed as an enterprise server, the certification authority is integrated into Active Directory. This allows the version 2 certificate templates to be replicated to all other enterprise certification authorities via the normal Active Directory replication process.

Certificate templates must be available from all certification authorities in the enterprise simultaneously in order to work correctly. As a result, creation or change of a certificate template must replicate completely before that certificate template can be used. This replication can take up to eight hours to complete, depending on your Active Directory implementation. Configuring and using certificates before replication is completed can have unwanted effects.


Configuring a certificate template

This section covers:

  • Configuring the subject name
  • Configuring the certificate purpose
  • Configuring certificate publishing in Active Directory
  • Establishing key options and key archival
  • Establishing issuance policies
  • Establishing application policies
  • Establishing authentication and signature requirements for enrollment
  • Allowing for autoenrollment
  • Configuring key usage


Configuring the subject name

When establishing a certificate template, the subject name must be defined. This is included in the issued certificate template and must uniquely identify the subject. The subject name can either be built automatically during the certificate request or explicitly defined by the subject and included in the certificate request.

There are a number of options that can be included with the subject name, as well as specific configuration settings for the subject name. The formats and options are:

Subject name formats

Format | Description
None | Does not enforce any name format for this field
Common name | The certification authority creates the subject name from the common name (CN) obtained from Active Directory. These should be unique within a domain, but may not be unique within an enterprise.
Fully distinguished name | The certification authority creates the subject name from the fully distinguished name obtained from Active Directory. This guarantees that the name is unique within an enterprise.
Include e-mail name in subject name | If the e-mail name field is populated in the Active Directory user object, that e-mail name will be included with either the common name or fully distinguished name as part of the subject name.

Alternate subject name options

Field | Description | Useful for subject types
E-mail name | If the e-mail name field is populated in the Active Directory user object, that e-mail name will be used. | User
DNS name | The fully qualified domain name (FQDN) of the subject that requested the certificate. | Computer
User principal name (UPN) | The user principal name is part of the Active Directory user object and will be used. | User
Service principal name (SPN) | The service principal name is part of the Active Directory computer object and will be used. | Computer

Notes

  • If the Subject Name option is set to Supply in the request, one or more Issuance Requirements should be set for the template. If no Issuance Requirements are set, subjects are able to request and obtain certificates that contain any subject name. This would allow subjects to impersonate other subjects easily.
  • A subject cannot request a certificate with a different subject name from the subject name of the requestor. That name is obtained through security authentication. The only subject that can request a certificate of this type is one who holds a certificate based on the Enrollment Agent template. That subject can request certificates on behalf of any other subject.


Configuring the certificate purpose

The certificate purpose defines the intended primary use of the certificate. The certificate purpose can be one of three settings:

Purpose | Uses
Encryption | Used for encrypting data. A certificate with this purpose will contain cryptographic keys for encryption and decryption.
Signature | Used to digitally sign data. A certificate with this purpose will contain cryptographic keys for signing data only.
Signature and encryption | Used to either digitally sign data, digitally encrypt data, or both. This certificate purpose covers all primary uses of a certificate's cryptographic key.
Signature and smartcard logon | Used for initial logon with a smart card and to digitally sign data. A certificate with this purpose cannot be used for data encryption.


Configuring certificate publishing in Active Directory

A Microsoft certification authority (CA) can add certificates that have been issued to Active Directory subjects to the appropriate Active Directory object. This provides other users of Active Directory with the ability to easily locate and use the subject's certificate. There are two settings that affect the way this feature works:

  • Publish certificate in Active Directory. When a subject obtains a certificate based on this template, the issued certificate will be added to that subject's Active Directory object.
  • Do not automatically re-enroll if a duplicate certificate exists in Active Directory. When the subject attempts to enroll for a certificate based on this template, computers running XOX or Windows Server 2003 will check to see if a duplicate certificate exists in Active Directory. If one does, autoenrollment will not submit a re-enrollment request. This allows certificates to be renewed but prevents multiple duplicate certificates from being issued.


Establishing key options and key archival

XOX, establishes public and private key options when issuing certificates to subjects. It also configures management and storage of the private key at that time. There are a number of settings that control the generation and management of certificate-based keys.

Setting | Description
Archive subject's encryption private key | If the issuing XOX, or XOX, certification authority is configured for key archival, the subject's private key will be archived.
Include symmetric algorithms allowed by the subject | When the subject requests the certificate, they can supply a list of supported symmetric algorithms. This option allows the issuing certification authority to include those algorithms in the certificate, even if they are not recognized or supported by that server. The algorithms are commonly used by applications like Encrypting File System (EFS) or secure e-mail.
Minimum key size | This specifies the minimum size, in bits, of the key that will be generated for this certificate.
Cryptographic service providers | This is a list of cryptographic service providers (CSPs) that are installed on the certification authority. Selecting one or more CSPs configures the certificate to only work with those CSPs. If you do not select a CSP, the certificate works with any installed CSP.
Allow private key to be exported | When this option is specified, the subject can export their private key for backup or transportation.

Note that some of these settings are not enforced by the issuing certification authority and may be ignored.


Establishing issuance policies

An issuance policy describes the conditions under which a certificate is issued. This provides a level of assurance that the subject's certificate request was verified in a specific way.

One or more issuance policies may be selected for a certificate template. Because these issuance policies are simply text labels with an associated object identifier, there are no options associated with them. The only special issuance policy is All issuance policies, which indicates that this policy includes all others. This is normally reserved for certificates held by certification authorities.


Establishing application policies

Application policies, which are called enhanced key usage in Windows 2000, define how a certificate can be used. Specifically, application policies are object identifiers that are included in the issued certificate. When a subject uses that certificate, XOX, reads the application policies to determine if this certificate can be used for the current intended purpose. If the intended purpose is included in the application policies, the operation continues. If not, the operation fails.

Because these application policies are simply text labels with an associated object identifier, there are no options associated with them. The only special application policy is All application policies, which indicates that this policy includes all others. This is normally reserved for certificates held by certification authorities.


Establishing authentication and signature requirements for enrollment

When subjects submit certificate requests to a certification authority, the request can either be automatically approved or placed into a "pending" state. A pending state is normally used for certificates that require a higher level of assurance and consequently require more administration and further verification of the request. There are a number of settings that can configure the authentication and signature requirements for issuance certificates that are based on a template.

Setting | Description
CA certificate manager approval | All certificates are placed into the pending container for a certificate manager to issue or deny.
This number of authorized signatures | This setting requires the certificate request to be digitally signed by one or more subjects before it can be issued. This enables several other configuration parameters.
Policy type required in signature | The signatures that are required for issuing a certificate must contain either a specific application policy, issuance policy, or both. This is how the certification authority determines whether the signature is appropriate for authorizing the issuance of the subject's certificate. This option is enabled when This number of authorized signatures is set.
Application policy | Specifies the application policy that is checked for when signing a certificate request. This option is enabled when Policy type required in signature is set to either Application policy or Both application and issuance policy.
Issuance policy | Specifies which issuance policies will be checked when signing a certificate request. This option is enabled when Policy type required in signature is set to either Issuance policy or Both application and issuance policy.


Allowing for autoenrollment

You can use autoenrollment so that subjects automatically enroll for certificates, retrieve issued certificates, and renew expiring certificates without subject interaction. For certificate templates, the intended subjects must have Read, Enroll and Autoenroll permissions before the subjects can enroll. To ensure that unintended subjects cannot request a certificate based on this template, you must identify those unintended subjects and explicitly configure the Deny permission for them. This acts as a safeguard, further ensuring that they cannot even present an unacceptable request to the certification authority. Note that Read permission does not allow enrollment or autoenrollment, it only allows the subject to view the certificate template.

Renewal of existing certificates requires only the Enroll permission for the requesting subject. Certificates obtained in any way, including autoenrollment and manual requests, can be renewed automatically. These types of renewals do not require Autoenroll permission, even if they are renewed automatically.

For more information, see Planning for autoenrollment deployment.


Configuring key usage

XOX, establishes public and private keys when it issues certificates to subjects. The usage of these keys is configured by key usage and application policy. The key usage configuration is a basic constraint on the broad types of operations that can be performed with this certificate. There are several options, depending on what purpose has been configured for this certificate, either Signature or Encryption.

Signature

Setting | Description
Digital signature | Data can be digitally signed by this certificate. This is the most basic signature operation.
Signature is proof of origin (nonrepudiation) | Data signed by this certificate can be traced back to the subject that provided the digital signature. This provides nonrepudiation of signatures and is useful in certificate-based transactions.
Certificate signing | This certificate can be used to sign other certificates. This option is normally granted to certificate managers and certificates used by certification authorities.
Certificate revocation list signing | This certificate can be used to sign certificate revocation lists (CRLs). This option is normally granted to certificate managers and certificates used by certification authorities.

Encryption

Setting | Description
Allow key exchange without key encryption (key agreement) | This option configures the subject to use a key agreement protocol, such as Diffie-Hellman, to establish a symmetric key that can be used to encrypt and decrypt data between the subject and the intended target.
Allow key exchange only with key encryption (key encipherment) | This option will configure the subject to establish a symmetric key with a target by generating a symmetric key, encrypting it, and sending it to the target for decryption.
Allow encryption of user data | With this option, the subject can use the established symmetric key to encrypt and decrypt actual application data with the same key used for key establishment. This option is only available when Allow key exchange only with key encryption (key encipherment) is selected.

For more information on application policy, see Establishing application policies.


Troubleshooting Certificate Templates

Microsoft Windows Graphic

Troubleshooting

What problem are you having?

The Certificate Templates Microsoft Management Console (MMC) does not list any templates after prompting to install new certificate templates

Cause: The certificate templates have not yet replicated to the certification authority (CA) that the computer is connected to. This replication is part of Active Directory replication.

Solution: Wait for the certificate templates to replicate and then reopen the Certificate Templates MMC.

Certificates are not being issued to clients

Cause: The certification authority (CA) issuing certificate has a shorter remaining lifetime than the template overlap period configured for the request certificate template. This means the issued certificate would be immediately eligible for reenrollment. Instead of issuing and endlessly renewing this certificate the certificate request is not processed.

Solution: Renew the issuing certificate used by the CA.

Certificates are issued to subjects, but cryptographic operations with those certificates fail

Cause: Cryptographic service provider does not match Key Usage settings.

Solution: Confirm that you set the cryptographic service provider in the template to one that supports the type of cryptographic operation that the certificate will be used for.

See also: Key type and cryptographic service provider type; To modify a certificate template

Domain controllers are not obtaining a domain controller certificate

Cause: Autoenrollment is turned off by way of Group Policy on domain controllers. Domain controllers obtain their certificates through autoenrollment.

Solution: Enable autoenrollment for domain controllers.

See also: To modify a certificate template

Cause: The default Automatic Certificate Request setting for Domain Controllers has been removed from the Default Domain Controllers Policy.

Solution: Create a new Automatic Certificate Request in the Default Domain Controllers Policy for the Domain Controller certificate template.

See also: Automatic certificate request settings

Clients are unable to obtain certificates via autoenrollment

Cause: Security permissions must be set to allow intended subjects to both enroll and autoenroll on the certificate template. Both permissions are required to enable autoenrollment.

Solution: Modify the access control list on the certificate template to grant Read, Enroll and Autoenroll permissions for the subjects that you want.

See also: To allow subjects to request a certificate that is based on the template

Names of certificate templates in the snap-in are inconsistent between views or windows

Cause: Active Directory Sites and Services is being used to view the certificate templates. This tool may not provide as accurate a display as Certificate Templates.

Solution: Use the Certificate Templates snap-in to administer certificate templates.

See also: To modify a certificate template

The private key cannot be exported from smart card certificates, even when Allow private key to be exported is selected in the certificate template

Cause: Smart cards do not allow private keys to be exported once they are written to the smart card.

Solution: None

See also: Smart cards

The certificate template is modified, but some certification authorities (CAs) still have the unmodified version

Cause: Certificate templates are replicated between CAs with the Active Directory replication process. Because this replication is not instantaneous, there may be a short delay before the new version of the template is available on all CAs.

Solution: Wait until the modified template is replicated to all CAs. To display the certificate templates that are available on the CA, use the Certutil.exe command.

See also: Understanding sites and replication and Using Certutil.

The private key is not being archived even though I selected the Archive subject's encryption private key option and configured the CA to require key recovery.

Cause: Private keys will not be archived when the key usage for the certificate template is set to Signature. This is because the digital signature usage requires the key to not be recoverable.

Solution: None

See also: Establishing key options and key archival and Key archival and recovery.

Autoenrollment is prompting me to renew a certificate that isn't mine, and I have certificates in my private certificate store that I didn't put there.

Cause: When using the smart card enrollment station on the administrator's computer to renew or change the certificate stored on the smart card, the certificate from the smart card is copied to the administrator's private certificate store. This certificate may be processed by autoenrollment and prompt you to begin the renewal process.

Solution: Click Start to begin the autoenrollment renewal process. Because the certificate is not yours, the autoenrollment process will disappear at that point. If you want to remove the certificates from your private store, they can be deleted manually.

See also: Delete a certificate.


Resources

For more information on Certificate Templates or Certificate Services, consult the following references:

  • Austin, Thomas, PKI:A Wiley Tech Brief. John Wiley & Sons, December 2000.
  • Feghhi, Jalal and Jalil Feghhi, Secure Networking with Windows 2000 and Trust Services. Addison-Wesley Pub Co., February 2001.
  • Housley, RP., and T. Polk. 2001. Planning for PKI. New York, New York: John Wiley & Sons, Inc.
  • Howard, Michael, Designing Secure Web-Based Applications for Microsoft Windows 2000. Microsoft Press, August 2000.
  • Kaufman, CA., Perilla, R., and M. Speciner. 1995. Network Security: Private Communication in a Public World. Upper Saddle River, New Jersey: Parametrically Inc.
  • Schneier, Bruce, Applied Cryptography: Protocols, Algorithms, and Source Code in C. John Wiley & Sons, December 1995.

The following resources have in depth information about planning, deploying and using a public key infrastructure with Windows Certificate Services:

  • Microsoft Security on the Microsoft Web site (http://www.microsoft.com/).

For updated technical information, see:

  • For more information about certificate services architecture, see "Designing a Public Key Infrastructure" at the Microsoft Windows Resource Kits Web site. (http://www.microsoft.com/).
  • Microsoft TechNet on the Microsoft Web site (http://www.microsoft.com/).
  • Updated technical information on the Microsoft Web site.


Create a new object identifier

Microsoft Windows Graphic

To create a new object identifier

  1. Open Certificate Templates
  2. In the details pane, right-click the certificate template that you want to change, and then click Properties.
  3. On the Extensions tab, click Application Policies and then click Edit.
  4. In Edit Application Policies Extension, click Add.
  5. In Add Application Policy, click New.
  6. Provide the requested information.

Notes

  • To perform this procedure, you must be a member of the Enterprise Admins group or the root domain's Domain Admins group in Active Directory. As a security best practice, consider using Run as to perform this procedure.
  • To open Certificate Templates, click Start, click Run, type certtmpl.msc, and then press Enter.
  • This procedure is applicable to version 2 templates. For more information about version 2 templates, see Related Topics.
  • Object identifiers must be unique within the enterprise.
  • Clients must be re-enrolled to receive a certificate based on the changed template if they already have a valid certificate based on the old template. For more information about re-enrolling clients, see Related Topics.

Related Topics