In this demonstration, we're going to customize a certificate template.
We begin by duplicating a template, and then we make changes to that
duplicate of the template. We rename the template to something that
we can recognize, and then we make the template available through
the certification authority.
Let's go in to CA2. We're in CA2, and we should talk
about why would you customize a template?
Well,
you want to make your particular network and enterprise and
environment compatible with this certificate. By doing so, you
don't have to customize this every single time.
You can just issue that one customized certificate every time
somebody needs one according to your specific needs.
So let's take one that's going to be pretty common here, and
go down to User. Notice it is a Schema Version 1, so we're
going to have to duplicate it.
I'm going to right‑click and say Duplicate Template. And one thing you'll
notice is the duplicate has a lot more parameters than the original. Here we
have the Compatibility, and I think it's safe to say, these days you can
probably take it up to a higher level, and in this case, we'll do Windows
server 2016. It gives us a list of the changes that are going to happen if we
take that compatibility up.
So I'm going to accept that and click on OK. The Certificate
recipient, we're going to take that up as well, and then we can see
there's quite a few changes that are going to be added to this
template once we do that, including attestation and a couple of
different extensions down here.
We're okay with that.
We're going to click on OK.
The General tab.
This is where we can make changes to the actual name and the validity
period, and we can say publish this in Active Directory,
which makes it available to all the users that are inside of our Active
Directory. And this down here, Do not automatically enroll if duplicate
certificate exists in Active Directory.
We're not too concerned about that because this is
the only certificate for this.
One thing we're going to do is we're going to change this to something
that we can kind of recognize, to CarvedRockUser.
The Request Handling. The purpose of this is for signatures and encryption.
If we want the key to be exported, we can check this. And when it renews,
do we want to keep the same key or generate a new key?
Usually, it's much more secure to generate a new key and not check this box.
And then the Enrollment.
We're going to enroll the subject without requiring any user input.
That's because this is a user certificate, and we want it to pretty much
act behind the scenes instead of having any user input.
If this was a more secure certificate,
then we want to prompt the user or even prompt the
user when it's actually being used.
Now, if we want to archive this private key,
we can do that by clicking this box.
What that allows us to do is actually archive these templates. And notice what
happens, we get a message that says There are no certification authorities
currently issuing certificates based on this template.
We're going to change that.
So let's click on OK.
The cryptography, if we wanted to change the cryptography,
and this was added because we made the compatibility a
little bit more modern for this.
We have the Superseded Templates.
What this is going to do is say if they have this template
and they have another template that conflicts with it, this
one supersedes the other one.
And what we're actually going to do here is we're going to say
this supersedes the default user template.
So we'll just come down here, we'll say User, click on OK,
click on Apply to make sure it has it, and we got that. The Extensions. If we
wanted to have the default user certificate to other things,
maybe you include Smart Card Logon or a lot of different things inside
of here besides the basic template that you see.
Well, you can come down here and click on Edit,
click on Add,
scroll down, and say Smart Card Logon, and click on Add. Right there.
So then that expands the capability of this particular template.
Now, the template should be confined just to what you need it for; however,
in this case, maybe we need Smart Card, so we'll click on OK.
And then finally, Security. This is the actual security or permissions
that you're granting to this particular certificate.
Lastly, we're going to go to the Subject Name, and this is how you build
the name. In this case, what we're going to do is we're going to take off
email and take off email in the subject name.
That's because we really don't have email in this course.
I don't have it set up; however,
most environments that you're going to be dealing with, the users,
of course, have an email and you probably want to leave that in. But
for demonstration purposes, we'll leave it out. Go to the Server and
this will tell you well,
where do you want to store the requests and the revocation?
And then finally, Issuance Requirements.
Do you want approval for these certificates?
If you had a small network, then maybe you can go there user by user and say,
oh, Betty wants a certificate and then click OK.
This will prompt you for that.
If you have a certificate that has a large security profile,
then you might include several people that have to approve this certificate.
We're okay with that.
We're going to click on OK.
And just like that, we have it right here.
We could go to the Properties of this and see that all of
the things that we put in here are put in.
If we wanted to make further changes, we would need to duplicate this template.
So let's click on Cancel and come up here to Certificate Templates.
And the one thing to notice here is the template is not here.
So what we'll need to do is come here to Certificate Templates.
Go down to New, Certificate Template to Issue,
click on it, and we have CarvedRock User, click on OK. And now it is available.
So that is how you customize a template inside of Windows Server 2022 Certificate Services to your own specifications.