Certificate templates

A certificate template profiles certificates based on their intended use. When requesting a certificate from a Windows 2000 enterprise certification authority (CA), the certificate requester will, depending on their access rights, be able to select from a variety of certificate types that are based on certificate templates, such as User and Code Signing. The certificate template saves users from low-level, technical decisions about the type of certificate that they need. Instead, they can rely on the judgement of their administrators and use the template name that indicates the purpose of the certificate.

The following certificate templates are included with Windows 2000 Certificate Services.

Certificate Template Name	Certificate Purposes	Issued To People or Computers
Administrator	Code signing, certificate trust list (CTL) signing, encrypting file system (EFS), Secure E-mail, Client Authentication	People
Authenticated session	Client authentication	People
Basic EFS	Encrypting File System	People
Computer	Client authentication, server authentication	Computers
Code Signing	Code signing	People
Domain Controller	Client authentication, server authentication	Computers
EFS Recovery Agent	File recovery	People
Enrollment Agent	Certificate request agent	People
Enrollment Agent (Offline request)	Certificate request agent	People
IPSec (Offline request)	Internet Protocol security	Computers
IPSec	Internet Protocol security	Computers
Router (Offline request)	Client authentication	Computers/routers
Smart Card Logon	Client authentication	People
Smart Card User	Client authentication, secure e-mail	People
Subordinate certification authority	All	Computers
Trust List Signing	Certificate trust list signing	People
User	Encrypting File System, secure e-mail, client authentication	People
User Signature Only	Secure e-mail, client authentication	People
Web Server	Server authentication	Computers

Every enterprise CA, as part of its policy settings, can issue specific certificate types based on certificate templates selected by the CA administrator. When you install a new enterprise CA, by default, only the following certificate templates can be issued: Administrator, Domain Controller, Computer, Basic EFS, EFS Recovery Agent, User, Web Server. For the procedure to add or remove certificate templates that a CA can issue, see Establish the certificate types that an enterprise certification authority can issue

Certificate templates have the following features:

• Security permission set

  Indicates who is allowed to receive a certificate of this type. This decision is enforced by the CA, and requires that the certificate requester securely authenticate itself to the CA. See Set security permissions and delegate control of certificate templates for procedures to set security permissions on certificate templates.

• Display Name

  The name that is displayed in the user interface when the client or administrator selects a certificate template.

• Extended Key Usages

  Identifies the purpose of the certificate, such as e-mail protection, CTL signing, and so on. It is represented by Object Identifiers (OIDS).

• Key Usages

  Identifies the use of the public key in a certificate at a basic cryptographic level. Typically, it indicates whether the key may be used for a signature, key exchange, encryption, or other uses. Key Usages is stored as a bit field.

• Basic Constraints

  Indicates whether the resulting certificate may be used by a CA to sign lower-level certificates, which allows the construction of CA hierarchies. This value also specifies the maximum depth of the hierarchy beneath the certificate.

• Default CSP List

  Contains the names of the cryptographic service providers (CSPs) that may be used if the enrollment takes place outside of the normal Windows user interface. There are specific constraints on the CSPs used for certain types of certificates, and this list verifies that certificates enrolled by the system will meet those constraints. For example, EFS requires the Microsoft RSA CSP.

• Include E-Mail Name

  Indicates that the e-mail name of the principal should be included in the certificate, if there is one.

• Machine Certificate Template

  Indicates whether the certificate template is appropriate for a computer or a user.

For procedures to manage certificate templates, see Manage Certificate Templates for an Enterprise CA