Certificate Templates Overview

Applies To: Windows Server 2008

Enterprise certification authorities (CAs) use certificate templates to define the format and content of certificates, to specify which users and computers can enroll for which types of certificates, and to define the enrollment process, such as autoenrollment, enrollment only with authorized signatures, and manual enrollment. Associated with each certificate template is a discretionary access control list (DACL) that defines which security principals have permissions to read and configure the template, as well as to enroll or autoenroll for certificates based on the template. The certificate templates and their permissions are defined in Active Directory® Domain Services (AD DS) and are valid within the forest. If more than one enterprise CA is running in the Active Directory forest, permission changes will affect all enterprise CAs.

Note

When a certificate template is defined, the definition of the certificate template must be available to all CAs in the forest. This is accomplished by storing the certificate template information in the Configuration naming context (CN=Configuration,DC=ForestRootName). The replication of this information depends on the Active Directory replication schedule, and the certificate template may not be available to all CAs until replication is completed. The storage and replication are accomplished automatically.

CA Terminology

The following terms and acronyms are used throughout this document.

Authority information access. A certificate extension that contains URLs where the issuing CA certificate can be retrieved. The authority information access extension can contain Hypertext Transfer Protocol (HTTP), File Transfer Protocol (FTP), Lightweight Directory Access Protocol (LDAP), or FILE URLs.

Certificate revocation list (CRL). A digitally signed list issued by a CA that contains certificates that have been revoked. The list includes the serial number of the certificate, the date that the certificate was revoked, and the revocation reason. Applications can perform CRL checking to determine a presented certificate's revocation status. CRLs can also be referred to as base CRLs to differentiate them from delta CRLs.

Certificate template. A preconfigured list of certificate settings that allows users and computers to enroll for certificates without having to create complex certificate requests.

• Version 2 certificate templates are customizable certificate templates that are supported with Windows Server® 2008 Enterprise–based CAs or Windows Server 2003 Enterprise Edition–based CAs. Version 2 certificate templates enable advanced CA features such as key archival and recovery and certificate autoenrollment.

  • In order to use version 2 templates, Active Directory must be upgraded to support Windows Server 2008 or Windows Server 2003 schema changes.

  • Standard editions of Windows Server 2008 and Windows Server 2003 support only version 1 certificate templates, which are not customizable and do not support key archival or autoenrollment.

• Version 3 certificate templates are new in Windows Server 2008. Version 3 certificate templates function similarly to version 2 templates, and they support new Active Directory Certificate Services (AD CS) features available in Windows Server 2008. These features include Cryptography Next Generation (CNG), which introduces support for Suite B cryptographic algorithms such as elliptic curve cryptography (ECC).

CRL distribution point. A certificate extension that indicates where the CRL for a CA can be retrieved. This extension can contain multiple HTTP, FTP, FILE, or LDAP URLs for the retrieval of the CRL.

Delta CRL. A type of CRL that contains the list of certificates revoked since the last base CRL was published. Delta CRLs are often used in environments where numerous certificates are revoked to optimize bandwidth use.

Enterprise CA. Enterprise CAs are integrated with AD DS. They publish certificates and CRLs to AD DS, use information stored in AD DS such as user accounts and security groups to approve or deny certificate requests, and use certificate templates stored in AD DS to generate a certificate with the appropriate attributes.

Online Certificate Status Protocol (OCSP). A protocol that allows high-performance validation of certificate status. Windows Server 2008 introduces an online revocation provider (Online Responder) as an optional role service within AD CS.

Public key infrastructure (PKI). A PKI consists of CAs that issue digital certificates, directories that store certificates and policies (including AD DS), resources that provide revocation and validation information for certificates, and the X.509 certificates that are issued to security entities on the network.

Security principal. A user, security group, or computer account that can be assigned permissions in a DACL.

Stand-alone CA. Stand-alone CAs do not require AD DS and do not use certificate templates.

Templates in Versions of Windows Earlier than Windows Server 2008

A number of predefined certificate templates were first introduced in Microsoft Windows® 2000, but attributes of those version 1 certificate templates could not be modified, except the permissions specified in the DACL. This was done through the advanced view of the Active Directory Sites and Services snap-in and allowed administrators to specify which users and groups could read, update, and enroll for certificates that use the templates.

With Windows Server 2003, the introduction of version 2 certificate templates meant that more customization was possible, and management was done through the Certificate Templates snap-in rather than through the Active Directory Sites and Services snap-in.

With Windows Server 2003–based CAs, the Certificate Templates snap-in allowed you to define specific attributes for certificates that meet your organization's business needs. For example, you could:

• Define whether the private key associated with a certificate can be exported.

• Define whether the certificate request must be approved by a certificate manager, and define how many managers must approve a request before the certificate is issued.

• Define which cryptographic service providers (CSPs) are supported by a certificate template.

• Define issuance and application policy for issued certificates.

Windows Server 2008–Based Templates

Windows Server 2008 introduced version 3 certificate templates. These certificate templates have been updated to support new features available in the Windows Server 2008–based CA, including CNG, which introduces support for Suite B cryptographic algorithms such as ECC. For more information about CNG in Windows Server 2008, see Active Directory Certificate Services (https://go.microsoft.com/fwlink/?LinkID=85613).

CNG encryption and hash algorithms can be specified for:

• Certificate requests

• Issued certificates

• Protection of private keys for key exchange and key archival scenarios

Administrators can configure support for these new certificate template features using the template properties options in the Certificate Templates snap-in in Windows Server 2008.

AD CS includes two new certificate templates: Kerberos Authentication (delivered as a version 2 template) and OCSP Response Signing (delivered as a version 3 template). These templates are installed in AD DS when the first Windows Server 2008–based CA is installed, or the first time the Certificate Templates snap-in is opened from Windows Server 2008, after an upgrade to a Windows Server 2008–based CA.

Kerberos Authentication Template

The purpose of the Kerberos Authentication template is to issue certificates to domain controllers, which present the certificates to client computers during user and computer network authentication. Certificates issued via this new template contain two specific attributes. Rather than relying on the DNS name of the computer, applications can verify the following:

• The enhanced key usage extension of the certificate contains Key Distribution Center (KDC) authentication.

• The domain name is in the subject alternative name extension of the certificate.

By the authority of the issuing CA, these attributes prove that the computer presenting the certificate is a domain controller for the domain contained in the subject alternative name. This new template is recommended for domain controllers running Windows Server 2008. For domain controllers running Windows Server 2003, the Domain Controller Authentication template or the Kerberos Authentication template can be used.

Note

If a domain controller running Windows Server 2003 with Service Pack 1 (SP1) or Windows Server 2003 R2 obtains a certificate based on the Kerberos Authentication template, the following error might appear on the domain controller.
Automatic certificate enrollment for local system detected the DNS name in the Kerberos Authentication certificate does not match the DNS name of the local computer. A new enrollment for one Kerberos Authentication certificate will be performed in 24 hours.
This is a known issue. It occurs because the autoenrollment client computer running Windows Server 2003 compares the local computer's DNS name to the contents of the certificate subject alternative name.

Client computers running Windows Vista or Windows Server 2008 can be configured to check for the new enhanced key usage entry by enabling strong KDC validation on the following registry entry:

HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Kerberos\Parameters\kdcvalidation

The default value of 0 disables strong KDC validation. To enable strong KDC validation, set this DWORD value to 2.

The following table shows which certificate template can be used for CAs running different versions of Windows, based on which version of Windows the domain controller is running.

Domain controller	Windows 2000 Server–based CA (version 1 only)	Windows Server 2003–based CA	Windows Server 2008–based CA
Windows 2000 Server (enroll for version 1 templates only)	Domain Controller	Domain Controller	Domain Controller
Windows Server 2003	Domain Controller	Domain Controller or Domain Controller Authentication Directory E-mail Replication	Kerberos Authentication or Domain Controller Authentication Directory E-mail Replication
Windows Server 2008	Domain Controller	Domain Controller or Domain Controller Authentication Directory E-mail Replication	Kerberos Authentication Directory E-mail Replication

Note

If the CA administrator has not manually assigned the Domain Controller Authentication and Directory E-mail Replication certificate templates to a Windows Server 2003–based CA or a Windows Server 2008–based CA, domain controllers running Windows Server 2003 still use the default Domain Controller certificate template. If a Windows Server 2008–based CA is available and configured to issue the Kerberos Authentication template, a domain controller running Windows Server 2003 or Windows Server 2008 will enroll for a Kerberos Authentication certificate, even if it already has a Domain Controller Authentication certificate.

The Kerberos Authentication certificate template is fully backward-compatible with the previous domain controller templates; for example, when the domain controller has a Kerberos Authentication certificate, smart card logon can be performed even with a client computer running Windows 2000 Professional.

OCSP Response Signing Template

The second new template introduced in Windows Server 2008 is the OCSP Response Signing template. An Online Responder based on the OCSP standard is an optional component in Windows Server 2008. This template issues certificates for computers running an Online Responder, enabling the Online Responder to provide signed responses to client computers requesting revocation information on certificates issued by the same CA that signed the OCSP signing certificate. The characteristics of OCSP signing certificates are:

• The "OCSP Signing" entry exists in the enhanced key usage extension.

• Revocation is not selected (no authority information access or CRL distribution point extensions).

• By default, the validity period is two weeks.

• The Network Service account on the computer to which the OCSP signing certificate is issued will be granted Read permission on the private key by default. This allows the OCSP service to use the private key.

For more information about the Online Responder and OCSP in Windows Server 2008, see Installing, Configuring, and Troubleshooting the Online Responder (Microsoft's OCSP Responder) (https://go.microsoft.com/fwlink/?LinkId=101269).

Default Templates

When a Windows Server 2008–based CA is installed, a set of default certificate templates is assigned to the CA so that the CA is immediately able to issue certificates for those templates.

Note

This behavior can be changed by setting the LoadDefaultTemplates=0 parameter in the CAPolicy.inf file prior to CA installation.

The list of which default templates are assigned has been updated in Windows Server 2008. The following table shows the default templates in Windows Server 2008 and Windows Server 2003.

Template name	Windows Server 2003	Windows Server 2008
Administrator	X	X
Basic EFS	X	X
Computer	X	X
Directory E-mail Replication		X
Domain Controller	X	X
Domain Controller Authentication	X
EFS Recovery Agent	X	X
Kerberos Authentication		X
Subordinate Certification Authority	X	X
User	X	X
Web Server	X	X

In AD CS, the following preconfigured certificate templates are listed in the Certificate Templates snap-in.

Note

The Kerberos Authentication and OCSP Response Signing templates are new in Windows Server 2008 and were not installed by default with Windows Server 2003 enterprise CAs.

Default templates in Windows Server 2008

Name	Description	Key usage	Subject type	Applications used for enhanced key usage	Application policies or enhanced key usage
Administrator	Allows trust list signing and user authentication	Signature and encryption	User	Microsoft trust list signing Encrypting File System (EFS) Secure e-mail Client authentication	4.1
Authenticated Session	Allows subjects to authenticate to a Web server	Signature	User	Client authentication	3.1
Basic EFS	Used by EFS to encrypt data	Encryption	User	EFS	3.1
CA Exchange	Used to protect private keys as they are sent to the CA for private key archival	Encryption	Computer	Private key archival	106.0
CEP Encryption	Allows the holder to act as a registration authority for Simple Certificate Enrollment Protocol (SCEP) requests; used by the Network Device Enrollment Service for its key exchange certificate	Encryption	Computer	Certificate request agent	4.1
Code Signing	Used to digitally sign software	Signature	User	Code signing	3.1
Computer	Allows a computer to authenticate itself on the network	Signature and encryption	Computer	Client authentication Server authentication	5.1
Cross-Certification Authority	Used for cross-certification and qualified subordination	Signature Certificate signing CRL signing	Cross-certified CA		105.0
Directory E-mail Replication	Used to replicate e-mail within AD DS	Signature and encryption	Directory e-mail replication	Directory service e-mail replication	115.0
Domain Controller	Used by domain controllers as all-purpose certificates and is superseded by two separate templates: Domain Controller Authentication and Directory E-mail Replication	Signature and encryption	Directory e-mail replication	Client authentication Server authentication	4.1
Domain Controller Authentication	Used to authenticate Active Directory computers and users	Signature and encryption	Computer	Client authentication Server authentication Smart card logon	110.0
EFS Recovery Agent	Allows the subject to decrypt files that are encrypted with EFS	Encryption	User	File recovery	6.1
Enrollment Agent	Used to request certificates on behalf of another user	Signature	User	Certificate request agent	4.1
Enrollment Agent (Computer)	Used to request certificates on behalf of another computer	Signature	Computer	Certificate request agent	5.1
Exchange Enrollment Agent (Offline request)	Used to request certificates on behalf of another user and supply the user name in the request; used by the Network Device Enrollment Service for its enrollment agent certificate	Signature	User	Certificate request agent	4.1
Exchange Signature Only	Used by the Microsoft Exchange Key Management service to issue certificates to Exchange users for digitally signing e-mail	Signature	User	Secure e-mail	6.1
Exchange User	Used by the Microsoft Exchange Key Management service to issue certificates to Exchange users for encrypting e-mail	Encryption	User	Secure e-mail	7.1
IPSec	Used by IP security (IPsec) to digitally sign, encrypt, and decrypt network communication	Signature and encryption	Computer	IPsec Internet Key Exchange (IKE) intermediate	8.1
IPSec (Offline request)	Used by IPsec to digitally sign, encrypt, and decrypt network communication when the subject name is supplied in the request The Network Device Enrollment Service in Windows Server 2008 uses this template by default for device certificates	Signature and encryption	Computer	IPSec IKE intermediate	7.1
Kerberos Authentication	New in Windows Server 2008, this template is similar to the Domain Controller Authentication template and offers enhanced security capabilities for Windows Server 2008 domain controllers authenticating Active Directory users and computers	Signature and encryption	Computer	Client authentication Server authentication Smart card logon KDC authentication	110.0
Key Recovery Agent (KRA)	Recovers private keys that are archived on the CA; for more information, see Key archival and recovery (https://go.microsoft.com/fwlink/?LinkID=89551).	Encryption	Key recovery agent	Key recovery agent	105.0
OCSP Response Signing	New in Windows Server 2008, this template issues certificates used by the OCSP service provider to sign OCSP responses; by default, these certificates contain a special OCSP no revocation checking extension and no authority information access or CRL distribution point extensions	Signature	Computer	OCSP signing	101.0
Remote Access Service (RAS) and Internet Authentication Service (IAS) Server	Enables RAS and IAS servers to authenticate their identity to other computers	Signature and encryption	Computer	Client authentication Server authentication	101.0
Root CA	Used to prove the identity of the root CA	Signature Certificate signing CRL signing	CA		5.1
Router (Offline request)	Used by a router when requested through SCEP from a CA that holds a CEP Encryption certificate	Signature and encryption	Computer	Client authentication	4.1
Smart Card Logon	Allows the holder to authenticate its identity by using a smart card	Signature and encryption	User	Client authentication Smart card logon	6.1
Smart Card User	Allows the holder to authenticate its identity and protect e-mail by using a smart card	Signature and encryption	User	Secure e-mail Client authentication Smart card logon	11.1
Subordinate CA	Used to prove the identity of the subordinate CA; it is issued by the parent or root CA	Signature Certificate signing CRL signing	CA		5.1
Trust List Signing	Allows the holder to digitally sign a trust list	Signature	User	Microsoft trust list signing	3.1
User	Used by users for e-mail, EFS, and client authentication	Signature and encryption	User	EFS Secure e-mail Key usage	3.1
User Signature Only	Allows users to digitally sign data	Signature	User	Secure e-mail Client authentication	4.1
Web Server	Proves the identity of a Web server	Signature and encryption	Computer	Server authentication	4.1
Workstation Authentication	Enables client computers to authenticate their identity to servers	Signature and encryption	Computer	Client authentication	101.0