So in our environment here,
we have just these four certificate templates published.
And as I mentioned before, this is a brand‑new clean lab build.
So, these are the only templates that we've created and published.
But in the real world, you may have, you know,
dozens of templates here that are already published.
Specifically, a certificate that's called Domain Controller or Domain
Controller Authentication may already exist here.
Also, you might even see a Kerberos Authentication certificate that's here.
The Kerberos Authentication is the one we want.
That's the latest certificate, and that's the one we
really want to ensure that's deployed.
And we have to make sure that that certificate is deployed to all
domain controllers in the organization to support client
certificate authentication for VPN access.
At a minimum, we have to have either Domain Controller
or Domain Controller Authentication.
So again, if if somebody's built the PKI and deployed all the default templates,
it's already going to be there because those are published by default.
So in that scenario, you may or may not need to perform these tasks.
So specifically, if we go to our Certificate Templates console,
there are two certificate templates, Domain Controller, Domain Controller
Authentication that sound very similar. Essentially, the Domain Controller
template is one of the earliest or oldest templates.
It's a version 1 template.
The Domain Controller Authentication template superseded that.
It's a version 2 template. And then finally,
Microsoft eventually came out with something called the Kerberos
Authentication template. By default, it is a version 2 template, but
ultimately it includes some additional capabilities to support modern
authentication and things like that.
This is the certificate template that we want to use. In this case, you'll
see that I have no published certificate template there for Domain
Controller, Domain Controller Authentication or Kerberos Authentication, so
I'm going to do that in my lab here, but just be aware that you may or may
not need to do this in your environment.
So to do that,
I'm going to right‑click and choose Duplicate Template on
the Kerberos Authentication template.
And here, I'm going to uncheck Show resulting changes, select
Windows Server 2016, and of course, I'm going to choose Server
2016 for the certificate recipient.
This is really critical that if you do have older
domain controllers in your environment,
you'll need to select kind of the least common denominator.
So if you have, you know, a dozen,
2016, 2019 or 2022 servers and you have one 2008 R2 server out there somewhere,
then you'll need to select Server 2008 R2. So remember, least common
denominator here, and 2016 is the latest. And, by the way,
this is a Windows Server 2022 PKI. This issuing CA is Windows Server 2022.
Server 2016 is still the latest you can choose here.
So I'm going to choose that.
Then I'll go to the General tab, and I'm going to
provide a descriptive name here.
Once again, validity period, one year is fine.
Don't publish in Active Directory. We'll go to the Cryptography tab.
From the Provider Category, I want to select Key Storage Provider.
And since this is an internal server, not a portable device,
I can choose any provider.
I really don't care if this is tied to a TPM because
this is within my physical control.
And then I'm going to bump up the Request hash to SHA256.
We'll go to the Subject Name, and by default, there is no Subject name
format, and honestly this isn't really crucial other than I like to see
the DNS name when I'm looking at this certificate in the certificate
store on the domain controller.
So I'm going to go ahead and select DNS name here and ensure the DNS
name is in the subject alternative name field here,
meaning that the DNS name is also included there as well.
So we'll go to the Extensions tab.
I don't need to do anything here.
All of the extensions that we need are already included.
Then I'll go to the Security tab, and I really honestly don't need to do
anything here either because our enterprise domain controllers are already
set for enroll and autoenroll permissions.
So that's fantastic.
I don't have to do anything other than that.
As I mentioned before, you may already have a Domain Controller or
Domain Controller Authentication certificate published. This certificate
template, the Kerberos Authentication template is recommended and should
supersede any of those templates.
If you want to replace any existing Domain Controller or
Domain Controller Authentication template,
you can certainly do so using supersedence.
Select the Superseded Templates tab, click Add, and we'll add the
Domain Controller, as well as the Domain Controller Authentication
template to the superseded templates.
What that means is that when this certificate template gets published,
if either of these templates are in place,
it will remove them from the certificate store on those domain controllers and
replace them with the most modern version of this template.
So we'll click OK, and now we'll jump back over to the Certification Authority Management Console, and we'll publish this template.