AD CS certificate template requirements
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/windowsserverdocs · commit ecef043 · +189 −48 lines · also on GitHub
11
---
2
−title: Manage certificate templates in Windows Server
3
−description: This article describes how to manage Active Directory Certificate Services certificate templates in Windows Server.
4
−author: Orin-Thomas
5
−ms.topic: how-to
2
+title: Manage Certificate Templates in Windows Server
3
+description: Create, publish, validate, and retire Active Directory Certificate Services (AD CS) certificate templates on an enterprise CA in Windows Server.
4
+#customer intent: As a PKI administrator, I want to create, publish, validate, and retire AD CS certificate templates so that I can change certificate issuance policy without disrupting applications or over-granting enrollment rights.
5
+author: orin-thomas
66
ms.author: orthomas
7
−ms.date: 02/18/2024
7
+ms.topic: how-to
8
+ms.date: 08/17/2026
9
+ai-usage: ai-assisted
810
---
911
10
−# Manage certificate templates
12
+# Manage AD CS certificate templates on an enterprise CA
1113
12
−Certificate Templates are managed through the Certificate Templates Microsoft Management Console (MMC) snap-in. You can use this snap-in to manage Active Directory Certificate Services (AD CS) both locally and remotely.
14
+A certificate template is a reusable set of rules that defines who can enroll for a certificate and how the certification authority (CA) configures each issued certificate. By managing templates carefully, you control your organization's certificate issuance policy so that you can change it without unexpectedly expanding enrollment rights or disrupting the applications that depend on those certificates.
1315
14
−## How to manage templates
16
+Only enterprise CAs issue certificates based on templates. Active Directory Domain Services (AD DS) stores these templates, and every CA in the forest shares them. Standalone CAs don't use certificate templates.
1517
16
−You must be a member of Domain Admins to access and administer certificate templates for a domain. To add this snap-in, install the AD CS management tools on the management computer. The AD CS management tools are part of the Remote Server Administration Tools (RSAT). You can install the management tools on a Windows Server computer by running the following PowerShell command from an elevated PowerShell session:
18
+This article explains how to create, update, publish, validate, and retire Active Directory Certificate Services (AD CS) certificate templates. You use a pilot workflow to validate each change on a narrow scope before you apply it to production enrollment.
1719
18
−```powershell
19
−Install-WindowsFeature RSAT-ADCS
20
−```
20
+## Prerequisites
2121
22
−To configure an MMC to use the Certificate Templates snap-in:
22
+Before you begin, ensure that you have:
2323
24
−1. Right click Start, click Run, and then type mmc.
25
−1. On the File menu, click Add/Remove Snap-in.
26
−1. On the Add and Remove Snap-ins dialog box, double-click the Certificate Templates snap-in to add it to the list. Click OK.
24
+- An AD DS forest and an enterprise CA.
25
+- An account with the permissions required for the task. Membership in **Domain Admins**, or equivalent delegated permissions, is the documented minimum for administering a domain's certificate templates. Deleting a template requires membership in **Domain Admins** or **Enterprise Admins**, or equivalent.
26
+- The AD CS management tools on the management computer. To install the tools on Windows Server, run the following command from an elevated PowerShell session:
2727
28
−## Create a new certificate template
28
+ ```powershell
29
+ Install-WindowsFeature RSAT-ADCS
30
+ ```
2931
30
−You can create a new certificate template by duplicating an existing template and using the existing template's properties as the default for the new template. Review the list of default certificate templates, and examine their properties to identify the existing certificate template that most closely meets your needs. Membership in Domain Admins, or equivalent, is the minimum required to complete this procedure.
32
+- A documented certificate use case, the intended enrollment identities, the relying applications, and a pilot security group.
33
+- Access to the issuing CA and controlled test identities that represent intended and unintended requesters.
3134
32
−To create a new certificate template:
35
+> [!IMPORTANT]
36
+> Create a template by duplicating a suitable existing template. Test a new, narrowly scoped template before you change production enrollment.
3337
34
−1. Open the Certificate Templates snap-in and connect to the AC CS Enterprise root or subordinate server.
35
−1. Right-click the template to copy from, and then click Duplicate Template.
36
−1. Choose the minimum operating system version of AD CS Certificate Authority (CA) that you want to support. Currently the most recent version of Windows Server that you can select is Windows Server 2016. You can also select the minimum recipient operating system for the certificate template, with the most recent version being Windows 10/Windows Server 2016.
37
−1. Provide a name for the certificate template and configure the template settings.
38
+## Understand the three publication operations
3839
40
+Template management involves three separate operations.
41
+
42
+| Operation | What it changes | What it doesn't do |
43
+|---|---|---|
44
+| Create or modify a certificate template | The template object in AD DS. A new template replicates to domain controllers throughout the forest. | It doesn't configure a CA to issue the template. |
45
+| Publish a template to an issuing CA | The CA's issuance list. | It doesn't publish issued certificates to AD DS. |
46
+| Publish an issued certificate to AD DS | The `userCertificate` attribute on the certificate subject's AD DS object. | It doesn't publish or enable a certificate template on a CA. |
47
+
48
+If you need to publish issued certificates to AD DS, separately review the template's certificate-publication setting, the CA Exit Module's **Allow certificates to be published in the Active Directory** setting, and the CA's permissions to update the subject objects.
49
+
50
+## Open the Certificate Templates snap-in
51
+
52
+Use the Certificate Templates Microsoft Management Console (MMC) snap-in to administer certificate template objects.
53
+
54
+1. Select and hold (or right-click) **Start**, select **Run**, enter `mmc`, and then select **OK**.
55
+1. In MMC, select **File** > **Add/Remove Snap-in**.
56
+1. Select **Certificate Templates**, select **Add**, and then select **OK**.
57
+
58
+Use the Certification Authority snap-in instead when you need to change the templates that a specific CA can issue.
59
+
60
+## Design a secure template
61
+
62
+Start with the relying application's identity and certificate requirements. Before you duplicate a template, review the following template areas.
63
+
64
+| Template area | Decision |
65
+|---|---|
66
+| **Compatibility** | Select the oldest CA and recipient operating systems that must use the template. The most recent available values are **Windows Server 2016** for **Certification Authority** and **Windows 10 / Windows Server 2016** for **Certificate recipient**. Windows Server 2025 isn't an available compatibility value. |
67
+| **General** | Use a unique display name and define the validity and renewal periods. Record the template's short name, which is distinct from its display name. |
68
+| **Subject Name** | Prefer identity information from AD DS. If you enable **Supply in the request**, restrict enrollment and validate every permitted identity value because the requester supplies subject information. |
69
+| **Request Handling** and **Issuance Requirements** | Define the certificate purpose, private-key behavior, approval requirements, and authorized signatures that the enrollment flow requires. |
70
+| **Cryptography** | Select a provider, algorithm, and key size that the CA, requesters, and relying applications support. No single configuration is appropriate for every certificate purpose. |
71
+| **Extensions** | Limit application policies, key usage, basic constraints, certificate policy object identifiers (OIDs), and other extensions to the documented application requirements. Mark an extension critical only after testing every required certificate consumer. |
72
+| **Security** | Grant **Read**, **Enroll**, and, only when intended, **Autoenroll** to narrowly scoped groups. |
73
+| **Superseded Templates** | Identify any predecessor template and plan for certificates that remain valid after the replacement becomes available. |
74
+
75
+Apply extra review to templates used for authentication, code signing, enrollment agents, requester-supplied subject information, or exportable private keys. For a specialized example of how purpose, cryptographic provider, key usage, application policies, and permissions relate, see [Configure certificate templates for ML-DSA](configure-ml-dsa-certificate-templates.md). Don't use its signature-only ML-DSA settings as a general template baseline.
76
+
77
+## <a name="create-a-new-certificate-template"></a>Create and pilot a template
78
+
79
+Create a template by duplicating the existing template that most closely matches the approved use case.
80
+
81
+1. Open the Certificate Templates snap-in.
82
+1. Select and hold (or right-click) the template to use as a starting point, and then select **Duplicate Template**.
83
+1. On the **Compatibility** tab, select the minimum CA and certificate-recipient compatibility levels that your environment requires.
84
+1. On the **General** tab, enter a distinct **Template display name**. Record both the display name and template short name.
85
+1. Configure the subject, request-handling, cryptography, extension, and issuance settings that the use case requires.
86
+1. On the **Security** tab, grant **Read** and **Enroll** to the pilot group. Grant **Autoenroll** only if automatic enrollment is part of the approved pilot.
87
+1. Select **OK**.
88
+1. Allow AD DS replication to complete before you publish and test the template.
89
+
90
+If you remove **Authenticated Users** from the template access control list (ACL), grant every issuing CA's computer account **Read** permission. The default **Authenticated Users** entry includes the CA. Without another applicable **Read** entry, the CA can't read the template in AD DS. For more information, see [Certification Authority can't use a certificate template](/troubleshoot/windows-server/certificates-and-public-key-infrastructure-pki/ca-cant-use-certificate-template).
91
+
92
+## Rename a custom template
93
+
94
+You can't rename default certificate templates. Renaming a custom template updates only the template object in AD DS. If you already published the template to a CA or included it in another template's supersedence list, update those references.
95
+
96
+1. Open the Certificate Templates snap-in.
97
+1. Select the custom template.
98
+1. Select **Action** > **Change Names**.
99
+1. Enter a new value in **Template name**, **Template display name**, or both.
100
+1. Select **OK**.
101
+1. If you published the template, remove it from every issuing CA, restart the Active Directory Certificate Services service (CertSvc) on the affected CAs, and publish the renamed template again.
102
+1. If another template supersedes the renamed template, update the superseding template's **Superseded Templates** list.
103
+
39104
## Delete a certificate template
40105
41
−You can delete a certificate template when you no longer want it to be available for use. When you delete a certificate template, certificates based on the template can no longer be issued. Template deletions affect all CAs in a forest. Certificate templates cannot be recovered once they are deleted. Membership in Domain Admins or Enterprise Admins, or equivalent, is required to delete a certificate template.
106
+Delete a template only after you remove it from all issuing CAs and complete the retirement plan. Deletion is forest-wide and isn't a routine rollback mechanism. Depending on the environment and deletion-retention state, recovery might be possible through Active Directory Recycle Bin or an approved directory-backup recovery process. Deletion doesn't revoke already issued certificates. This procedure applies only to templates that you can delete. Version 1 templates are default templates that you can't delete.
42107
43
−To delete a certificate template, perform the following steps:
108
+1. Open the Certificate Templates snap-in.
109
+1. Select and hold (or right-click) the template, and then select **Delete**.
110
+1. Select **Yes** to confirm.
44111
45
−1. Open an MMC with the Certificate Templates snap-in.
46
−1. Right-click the template you want to delete, and then click Delete.
47
−1. Click Yes to confirm that you want to delete the template.
112
+## Publish a template to a CA
48113
49
−## Rename a certificate template
114
+Publishing adds an existing template to a CA's issuance list. It doesn't create or duplicate the template.
50115
51
−The names of default certificate templates cannot be changed. Administrators can change the names of custom certificate templates. The template name is the common name attribute of the certificate template object in Active Directory Domain Services (AD DS). Only that template object is updated if the template name is changed. If the modified template was previously published to issuing certification authorities (CAs) or added to a superseded templates list, then those actions must be repeated to maintain the consistency of the public key infrastructure (PKI) environment.
116
+To use the Certification Authority console:
52117
53
−To change a certificate template name:
118
+1. Open the Certification Authority snap-in.
119
+1. Expand the issuing CA.
120
+1. Select and hold (or right-click) **Certificate Templates**, and then select **New** > **Certificate Template to Issue**.
121
+1. Select the template, and then select **OK**.
54122
55
−1. Open the Certificate Templates snap-in and connect to the AD CS CA.
56
−1. Select the certificate template you want to modify. On the Action menu, click Change Names.
57
−1. Type a new name in the Template name box or the Template display name box, or both.
58
−1. Click OK to save changes.
123
+Instead, use the ADCSAdministration PowerShell module on the issuing CA. First, inspect the current issuance list:
59124
60
−If the modified template is already published to issuing CAs, remove the template from Certificate Templates on those issuing CAs, then restart these issuing CA computers, and then add the renamed template to the issuing CAs. If another template supersedes the modified template, then update the superseding template by adding the modified template to the list of superseded templates.
125
+```powershell
126
+Get-CATemplate
127
+```
61128
62
−## Deploying certificate templates to a CA
129
+Use the template short name to preview the change:
63130
64
−When you create an enterprise certification authority (CA), certificate templates are stored in Active Directory Domain Services (AD DS) and can be made available to all enterprise CAs in the forest. Any newly created certificate templates will be replicated automatically to all domain controllers in the enterprise.
131
+```powershell
132
+Add-CATemplate -Name "PilotWebServer" -WhatIf
133
+```
65134
66
−To configure a CA to issue certificates based on a certificate template, perform the following steps:
135
+After you review the preview, publish the template:
67136
68
−1. Open the Certification Authority snap-in, and double-click the name of the CA.
69
−1. Right-click Certificate Templates, click New, and then click Certificate Template to Issue.
70
−1. Select the certificate template, and click OK.
137
+```powershell
138
+Add-CATemplate -Name "PilotWebServer"
139
+```
71140
72
−## Remove a certificate template from a CA
141
+For command details, see [Get-CATemplate](/powershell/module/adcsadministration/get-catemplate) and [Add-CATemplate](/powershell/module/adcsadministration/add-catemplate).
73142
74
−It may be necessary to remove a certificate template from a certification authority (CA). For example, if you need to avoid confusion when adding a newer version of the certificate template.
143
+## Validate the pilot certificate template
75144
76
−To remove a certificate template from a CA:
145
+Validate the enrollment policy, issued certificate, and relying application before you expand enrollment rights.
77146
147
+1. Confirm that `Get-CATemplate` lists the pilot template on the intended CA.
148
+1. Sign in with a pilot identity. For a user certificate, open `certmgr.msc`. For a computer certificate, use a pilot computer and open `certlm.msc`.
149
+1. Expand **Personal**, select and hold (or right-click) **Certificates**, and then select **All Tasks** > **Request New Certificate**.
150
+1. Confirm that the pilot template is available, and enroll for a certificate.
151
+1. Open the issued certificate. On the **Details** tab, verify the subject, subject alternative name, public key, key usage, application policies, basic constraints, and policy OIDs that apply to the design.
152
+1. On the **Certification Path** tab, verify the expected chain.
153
+1. Confirm that the certificate is in the intended user or local computer store and has an associated private key when required.
154
+1. Test the relying application with the certificate. Certificate store presence alone doesn't prove that the application accepts or can use the certificate.
155
+1. Test with a separately scoped identity that shouldn't be eligible for enrollment.
156
+1. If you configured issued-certificate publication to AD DS, verify that result separately.
157
+
158
+Also validate approval disposition, private-key export and access behavior where applicable, renewal, and supersedence before you expand the pilot group's membership.
159
+
160
+## Supersede and retire a template
161
+
162
+Use a new template instead of making a disruptive in-place change when a change could affect enrolled identities or an application's certificate selection.
163
+
164
+1. Create, publish, and validate the replacement template with a pilot group.
165
+1. On the replacement template's **Superseded Templates** tab, add the predecessor only if supersedence is part of the approved transition.
166
+1. Test renewal and autoenrollment behavior. Supersedence can trigger enrollment for the replacement, but it doesn't automatically remove older certificates from a user's AD DS certificate store.
167
+1. Expand the replacement template's enrollment scope in controlled stages.
168
+1. Remove the predecessor from each CA's issuance list.
169
+1. Monitor enrollment and application behavior for the defined rollback period.
170
+1. Delete the predecessor template only when you no longer need rollback and the retirement plan permits deletion.
171
+
172
+Plan certificate cleanup separately. Removing or deleting a template doesn't revoke certificates already issued from it. Revoke affected certificates and publish a certificate revocation list (CRL) when the revocation plan requires those actions. For supersedence behavior, see [Superseded certificate templates and impact on user's AD store](/troubleshoot/windows-server/certificates-and-public-key-infrastructure-pki/superseded-certificate-templates-impact-user-ad-store).
173
+
174
+## Remove a template from a CA
175
+
176
+You can remove built-in and default templates from a CA's issuance list. Removing them doesn't delete their template objects from AD DS.
177
+
178
+To use the Certification Authority console:
179
+
78180
1. Open the Certification Authority snap-in.
79
−1. In the console tree, click Certificate Templates.
80
−1. In the details pane, right-click the certificate template that you want to delete, and then click Delete.
181
+1. Expand the issuing CA, and then select **Certificate Templates**.
182
+1. In the details pane, select and hold (or right-click) the template, and then select **Delete**.
81183
82
−You cannot remove the built in certificate templates.
184
+To use PowerShell, preview removal by using the template short name:
185
+
186
+```powershell
187
+Remove-CATemplate -Name "PilotWebServer" -WhatIf
188
+```
189
+
190
+After you review the preview, remove the template:
191
+
192
+```powershell
193
+Remove-CATemplate -Name "PilotWebServer"
194
+```
195
+
196
+Don't use `-AllTemplates` to roll back one template. That parameter removes every removable template from the CA's issuance list. For command details, see [Remove-CATemplate](/powershell/module/adcsadministration/remove-catemplate).
197
+
198
+## Security considerations
199
+
200
+- Separate template administration from enrollment. Don't grant administrators broad enrollment rights only to test a change.
201
+- Use pilot groups instead of broadly scoped groups during validation.
202
+- Review changes to requester-supplied subject information, enrollment-agent capability, application policies, key usage, approval, and private-key behavior with the application owner and security team.
203
+- Confirm that the CA-wide `EDITF_ATTRIBUTESUBJECTALTNAME2` flag is disabled. If enabled, an identity that can submit a request can supply subject alternative name values regardless of the template's **Supply in the request** setting. Investigate the dependency before you change the flag.
204
+- Test Cryptography Next Generation (CNG) and legacy provider selection with every supported requester and relying application.
205
+- Document rollback before publication. The usual first rollback action is to remove the new template from the affected CA's issuance list, not delete its AD DS object.
206
+
207
+## Troubleshoot template management
208
+
209
+| Symptom | Checks |
210
+|---|---|
211
+| The template isn't available in the enrollment wizard. | Confirm that the CA is an enterprise CA, the template is on that CA's issuance list, AD DS replication is complete, and the requester has **Read** and **Enroll** permissions. |
212
+| The CA can't issue the template after you restrict its ACL. | Confirm that the issuing CA's computer account has **Read** permission when **Authenticated Users** isn't present. |
213
+| A required provider isn't available on the **Cryptography** tab. | Review the template compatibility settings and confirm that the provider is installed and that the requester and CA support it. |
214
+| The issued certificate doesn't contain the expected capabilities. | Compare the certificate's details with the approved template design, including its purpose, extensions, subject configuration, and cryptography settings. |
215
+| The CA issues the certificate, but the application can't use it. | Confirm private-key presence and permissions, provider support, certificate selection behavior, application policies, key usage, and chain trust. |
216
+| Issued certificates don't appear on AD DS subject objects. | Troubleshoot issued-certificate publication. Review the template setting, CA Exit Module setting, and CA permissions instead of republishing the template to the CA. |
217
+
218
+## Related content
219
+
220
+- [Certificate template concepts](certificate-template-concepts.md)
221
+- [Configure certificate templates for ML-DSA](configure-ml-dsa-certificate-templates.md)
222
+- [Configure Certificate Enrollment Web Service for certificate key-based renewal](certificate-enrollment-certificate-key-based-renewal.md)
223
+- [Certificates security posture assessment in Microsoft Defender for Identity](/defender-for-identity/security-posture-assessments/certificates)
Microsoft's Markdown source from MicrosoftDocs/windowsserverdocs, © Microsoft Corporation, under CC BY 4.0. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 9 Oct 22:20 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.