In this demonstration, we'll find out how to use a certificate template.
I want you to know what each version does, and then we're going to go
inside and see the available certificate templates.
The versions, there are four of them.
The Version 1, this is the default.
These cannot be duplicated or changed in any way.
They're there, they're hard coded.
If you want to make any changes in to them, you have to duplicate them.
And then Version 2, this allows auto enrollment. Version 3,
you can add different and more advanced cryptography algorithms to it.
And then finally, Version 4, this is for Windows server 2012 and
later. You have a different mechanism for storing the keys, and also
you can offload a lot of the cryptography to a separate device or
separate card or separate server in order to get that cryptography
off of the CA itself.
Let's go in to CA2 and have a look at those certificate
templates that are available to us.
This is our console inside of CA2.
And what I'm going to do is come up here and say Add/Remove
Snap‑in, and we're going to add certificates. We'll do this for
the Computer account and then click on Next and Finish. And
then Certificate Templates.
We're going to add the certificate templates and then click on OK.
Here we are with Certificate Templates.
I'm going to click on this, and you'll be able to see the
certificate templates that are available to us just by default with
the installation of the Certification Authority. And here we are.
We have Directory Email Replication, Domain Controller Authentication,
Kerberos, EFS Recovery Agent,
ESF, Domain Controller, and we've already seen that one.
A Web Server, a Computer,
a User Subordinate Certification Authority, and then finally, an Administrator.
Those are available by default.
Now, we'll come down here to Certificate Templates.
We're going to click on it, and there's are available templates.
We have the Schema Version, and that's going to be 1 through 4.
And if we needed a 4, we have to duplicate one of these.
Let's go in just to this one called Computer.
I'm going to double‑click it, and we get the properties of
this particular certificate. And notice, we really can't make
any kind of changes inside of here.
We have General, and that's the name of the certificate and also the
Template name that this template actually came from.
And then options to publish it in Active Directory, etc. The Request
Handling. If somebody requests this certificate,
then we can control that through here.
We have the Subject Name, and the default goes to Built from
information inside of Active Directory.
And then down here we have what type of subject, is this a user
or is this a device? And that is kind of the splitting ground
for different types of certificates.
Is it a user certificate or is it what we used to call server certificate,
or more accurately these days, a device certificate? Any Extensions that
we have can be seen here and then finally,
Security.
These are the actual permissions for this particular
certificate. I'm going to click on OK.
And then very quickly, something that is used quite a bit these days
that wasn't before, that is Smartcard Logon. The Request Handling, the
Subject Name. The Extensions are going to be basically the same. In
order to actually use these templates, we need to customize them, and we'll do that next.