PUT Templates

An integer indicating the type of enrollment allowed for the certificate template.

These values are populated based on configurations made for the default enrollment policy. Show allowed enrollment type details.

A Boolean indicating whether the certificate cleanup job is turned on for the template (True or False). The default is True.

The certificate cleanup task runs daily at 1:00 UTC and removes expired certificates from the database. Once removed, these certificates are not re-imported during a standard CA synchronization unless certificate cleanup is later turned off. CA synchronization tasks use the certificate cleanup settings to determine whether a certificate is eligible for cleanup and whether to exclude such certificates from import.

For more information, see Certificate Cleanup.

Certificate cleanup settings can be configured at three levels:

• Certificate Template Record: If configured, overrides the system-wide settings when processing certificate cleanup tasks for certificates associated with this template. These cleanup tasks are processed first.

• Certificate Authority (CA) Record: If configured, overrides the system-wide settings when processing certificate cleanup tasks for certificates associated with this CA but not associated with any template. These cleanup tasks are processed second.

• System-Wide: Applies to all certificate authorities and templates in the system. These values are used when processing certificate cleanup tasks for certificates associated with neither a CA nor a template and when no overrides are set at the CA or template level. These cleanup tasks are processed last.

  Note:  For manually imported certificates that do not have an associated template (for example, certificates issued by a standalone CA), system-wide cleanup settings are applied, even if the issuing CA is defined in Keyfactor Command.

  Because these certificates are imported without reliable issuer-to-CA mapping information, Keyfactor Command cannot consistently associate them with a specific configured CA. As a result, CA-level cleanup settings are not evaluated for those certificates.

An array of objects containing custom enrollment fields. This data is configured at the enrollment pattern level (see POST Enrollment Patterns).

A Boolean indicating whether the template has been configured with the key archival setting in Active Directory (True or False). This is a reference field and is not configurable.

An integer indicating the number of days a certificate’s private key will be retained in Keyfactor Command before being scheduled for deletion, if private key retention is turned on.

New enum field in the templates DB table, Manageability, which displays the manageability setting on a template, which are determined algorithmically based on the situation when the template is imported.

• If set to None (0), when Keyfactor Command syncs templates in, it'll ignore that template (not a common situation).

• Read (1) allows for the ability to read information on templates. All the templates imported into Keyfactor Command implicitly have had that level of manageability. With this setting, the View on CA and Copy on CA buttons would be enabled on the certificates template page.

• Read/Write (3) allows for the ability to manage the templates on the EJBCA server through Keyfactor Command. Set If there is a one-to-one match with EndEntity Profile and Template. With this setting, the Edit on CA, and the View on CA and Copy on CA, buttons would be enabled on the certificate template page.

A Boolean indicating whether the template has been configured with the Microsoft CA certificate manager approval option active (True or False).

An object containing the individual template-level template policy settings. This data is configured at the enrollment pattern level (see POST Enrollment Patterns) and will be populated based on the default enrollment pattern.

Metadata fields are returned by this parameter

Show template policy details.

Value	Description
Template Id	The Keyfactor Command reference ID of the certificate template the policy is associated with.
Allow Key Reuse	A Boolean that indicates whether private key reuse is allowed (True or False). This option applies to certificate renewals. By default, this is set to true at a system-wide level.
Allow Wildcards	A Boolean that indicates whether wildcards are allowed (True or False). By default, this is set to True at a system-wide level.
RFC Enforcement	A Boolean that indicates whether RFC 2818 compliance enforcement is turned on (True or False). When this option is set to True, certificate enrollments made through Keyfactor Command for this template must include at least one DNS SAN. In the Keyfactor CommandManagement Portal, this causes the following behavior: PFX Enrollment: The CN entered in PFX enrollment is automatically replicated as a DNS SAN, which the user does not see and cannot change. CSR Enrollment: For CSR enrollment, if the CSR does not have a SAN that matches the CN, one will automatically be added to the certificate. The user enrolling does not see this and cannot change it. CSR Generation: The CN entered in CSR generation will be automatically replicated as a DNS SAN and set to read only.
Certificate Owner Role	An integer indicating the certificate owner role setting. The supported values are: 0: Optional 1: Required 2: Hidden Required is enforced for PFX and CSR enrollment in both the Management Portal and Keyfactor API. Hidden applies to PFX and CSR enrollment in the Management Portal.
Default Certificate Owner Role Id	An integer indicating the Keyfactor Command reference ID of the security role assigned as the default certificate owner for certificates enrolled or imported via synchronization or scanning with this template.
Default Certificate Owner Role Name	A string indicating the name of the security role assigned as the default certificate owner for certificates enrolled or imported via synchronization or scanning with this template.
KeyInfo	An object containing the supported key types for the template along with the bit lengths and/or curves for the key types as appropriate The KeyInfo and PrimaryKeyAlgorithms properties are mutually exclusive in requests. Important:  The KeyInfo parameter has been deprecated. It is retained for backwards compatibility, but all new development should use the PrimaryKeyAlgorithms and AlternativeKeyAlgorithms parameters. Show key info details. Name Description ECDSA An object containing the name of the key type and two arrays: name: A string indicating the name of the key type. bit_lengths: An array of integers indicating the key sizes supported for enrollment through Keyfactor Command. curves: An array of strings indicating the elliptic curve algorithms that are supported for enrollment through Keyfactor Command. ECC curves may be specified using the well-known OIDs for ECC algorithms or by friendly name. Well-known OIDs include: 1.2.840.10045.3.1.7 = P-256/ prime256v1/ secp256r1 1.3.132.0.34 = P-384/secp384r1 1.3.132.0.35 = P-521/secp521r1 When specifying by friendly name, do not include a slash (use “P-256”, not “P-256/prime256v1/secp256r1”). RSA An object containing the name of the key type and two arrays: name: A string indicating the name of the key type. bit_lengths: An array of integers indicating the key sizes supported for enrollment through Keyfactor Command. curves: There are no curves for this type of key. Keyfactor Command supports key sizes 2048, 3072, 4096, 6144, 8192, and 16384. Ed448 An object containing the name of the key type and two arrays: name: A string indicating the name of the key type. bit_lengths: An array of integers indicating the key sizes supported for enrollment through Keyfactor Command. curves: There are no curves for this type of key. Ed25519 An object containing the name of the key type and two arrays: name: A string indicating the name of the key type. bit_lengths: An array of integers indicating the key sizes supported for enrollment through Keyfactor Command. curves: There are no curves for this type of key. MLDSA44 An object containing the name of the key type and two arrays: name: A string indicating the name of the key type. bit_lengths: There are no key size choices for this type of key. curves: There are no curves for this type of key. MLDSA65 An object containing the name of the key type and two arrays: name: A string indicating the name of the key type. bit_lengths: There are no key size choices for this type of key. curves: There are no curves for this type of key. MLDSA87 An object containing the name of the key type and two arrays: name: A string indicating the name of the key type. bit_lengths: There are no key size choices for this type of key. curves: There are no curves for this type of key.
PrimaryKeyAlgorithms	An array of objects containing the supported primary key algorithms for the template including the bit lengths and/or curves as appropriate. The KeyInfo and PrimaryKeyAlgorithms properties are mutually exclusive in requests. Show primary key algorithm details. Name Description name A string indicating the name of the key algorithm. The supported key algorithm names are: ECDSA RSA Ed448 Ed25519 ML-DSA-44 ML-DSA-65 ML-DSA-87 bit_lengths An array of integers indicating the key sizes supported for enrollment through Keyfactor Command. For RSA, Keyfactor Command supports key sizes 2048, 3072, 4096, 6144, 8192, and 16384. curves An array of strings indicating the elliptic curve algorithms that are supported for enrollment through Keyfactor Command, if applicable. ECC curves may be specified using the well-known OIDs for ECC algorithms or by friendly name. Well-known OIDs include: 1.2.840.10045.3.1.7 = P-256/ prime256v1/ secp256r1 1.3.132.0.34 = P-384/secp384r1 1.3.132.0.35 = P-521/secp521r1 When specifying by friendly name, do not include a slash (use “P-256” or “secp256r1”, not “P-256/prime256v1/secp256r1”).
AlternativeKeyAlgorithms	An array of objects containing the supported alternative key algorithms for the template including the bit lengths and/or curves as appropriate. Show alternative key algorithm details. Name Description name A string indicating the name of the key algorithm. The supported key algorithm names are: ECDSA RSA Ed448 Ed25519 ML-DSA-44 ML-DSA-65 ML-DSA-87 bit_lengths An array of integers indicating the key sizes supported for enrollment through Keyfactor Command. For RSA, Keyfactor Command supports key sizes 2048, 3072, 4096, 6144, 8192, and 16384. curves An array of strings indicating the elliptic curve algorithms that are supported for enrollment through Keyfactor Command, if applicable. ECC curves may be specified using the well-known OIDs for ECC algorithms or by friendly name. Well-known OIDs include: 1.2.840.10045.3.1.7 = P-256/ prime256v1/ secp256r1 1.3.132.0.34 = P-384/secp384r1 1.3.132.0.35 = P-521/secp521r1 When specifying by friendly name, do not include a slash (use “P-256” or “secp256r1”, not “P-256/prime256v1/secp256r1”).

An integer indicating the type of enrollment allowed for the certificate template.

These values are populated based on configurations made for the default enrollment policy. Show allowed enrollment type details.

A Boolean indicating whether the certificate cleanup job is turned on for the template (True or False). The default is True.

The certificate cleanup task runs daily at 1:00 UTC and removes expired certificates from the database. Once removed, these certificates are not re-imported during a standard CA synchronization unless certificate cleanup is later turned off. CA synchronization tasks use the certificate cleanup settings to determine whether a certificate is eligible for cleanup and whether to exclude such certificates from import.

For more information, see Certificate Cleanup.

Certificate cleanup settings can be configured at three levels:

• Certificate Template Record: If configured, overrides the system-wide settings when processing certificate cleanup tasks for certificates associated with this template. These cleanup tasks are processed first.

• Certificate Authority (CA) Record: If configured, overrides the system-wide settings when processing certificate cleanup tasks for certificates associated with this CA but not associated with any template. These cleanup tasks are processed second.

• System-Wide: Applies to all certificate authorities and templates in the system. These values are used when processing certificate cleanup tasks for certificates associated with neither a CA nor a template and when no overrides are set at the CA or template level. These cleanup tasks are processed last.

  Note:  For manually imported certificates that do not have an associated template (for example, certificates issued by a standalone CA), system-wide cleanup settings are applied, even if the issuing CA is defined in Keyfactor Command.

  Because these certificates are imported without reliable issuer-to-CA mapping information, Keyfactor Command cannot consistently associate them with a specific configured CA. As a result, CA-level cleanup settings are not evaluated for those certificates.

A string indicating the configuration tenant of the template. For Microsoft templates, this field is populated from Active Directory. For EJBCA templates, this field is populated from the Keyfactor Command CA record. The field is not configurable.

An array of objects containing custom enrollment fields. This data is configured at the enrollment pattern level (see POST Enrollment Patterns).

A string indicating the forest root of the template. For Microsoft templates, this field is populated from Active Directory and is not configurable.

An object containing the primary key algorithms defined for the template as reported by the CA, limited to the key types supported by Keyfactor Command. This information indicates all the algorithms that could possibly be supported when the template is used for enrollment. Enrollment policy within Keyfactor Command might limit this. This is a reference field and is not configurable. Show key algorithm details.

Value	Description
Template Id	An integer indicating the ID of the template in Keyfactor Command.
Key Info	An object containing the supported key types for the template as reported by the CA along with the bit lengths and/or curves for the key types as appropriate. Important:  The KeyInfo parameter has been deprecated. It is retained for backwards compatibility, but all new development should use the PrimaryKeyAlgorithms and AlternativeKeyAlgorithms parameters. Show key info details. Name Description ECDSA An object containing the name of the key type and two arrays: name: A string indicating the name of the key type. bit_lengths: An array of integers indicating the key sizes supported for enrollment through Keyfactor Command. curves: An array of strings indicating the elliptic curve algorithms that are supported for enrollment through Keyfactor Command. RSA An object containing the name of the key type and two arrays: name: A string indicating the name of the key type. bit_lengths: An array of integers indicating the key sizes supported for enrollment through Keyfactor Command. curves: There are no curves for this type of key. Ed448 An object containing the name of the key type and two arrays: name: A string indicating the name of the key type. bit_lengths: An array of integers indicating the key sizes supported for enrollment through Keyfactor Command. curves: There are no curves for this type of key. Ed25519 An object containing the name of the key type and two arrays: name: A string indicating the name of the key type. bit_lengths: An array of integers indicating the key sizes supported for enrollment through Keyfactor Command. curves: There are no curves for this type of key. MLDSA44 An object containing the name of the key type and two arrays: name: A string indicating the name of the key type. bit_lengths: There are no key size choices for this type of key. curves: There are no curves for this type of key. MLDSA65 An object containing the name of the key type and two arrays: name: A string indicating the name of the key type. bit_lengths: There are no key size choices for this type of key. curves: There are no curves for this type of key. MLDSA87 An object containing the name of the key type and two arrays: name: A string indicating the name of the key type. bit_lengths: There are no key size choices for this type of key. curves: There are no curves for this type of key.
PrimaryKeyAlgorithms	An array of objects containing the supported primary key algorithms for the template as reported by the CA including the bit lengths and/or curves as appropriate. Show primary key algorithm details. Name Description name A string indicating the name of the key algorithm. The supported key algorithm names are: ECDSA RSA Ed448 Ed25519 ML-DSA-44 ML-DSA-65 ML-DSA-87 bit_lengths An array of integers indicating the key sizes supported for enrollment through Keyfactor Command. For RSA, Keyfactor Command supports key sizes 2048, 3072, 4096, 6144, 8192, and 16384. curves An array of strings indicating the elliptic curve algorithms that are supported for enrollment through Keyfactor Command, if applicable. ECC curves may be specified using the well-known OIDs for ECC algorithms or by friendly name. Well-known OIDs include: 1.2.840.10045.3.1.7 = P-256/ prime256v1/ secp256r1 1.3.132.0.34 = P-384/secp384r1 1.3.132.0.35 = P-521/secp521r1 When specifying by friendly name, do not include a slash (use “P-256” or “secp256r1”, not “P-256/prime256v1/secp256r1”).
AlternativeKeyAlgorithms	An array of objects containing the supported alternative key algorithms for the template as reported by the CA including the bit lengths and/or curves as appropriate. Show alternative key algorithm details. Name Description name A string indicating the name of the key algorithm. The supported key algorithm names are: ECDSA RSA Ed448 Ed25519 ML-DSA-44 ML-DSA-65 ML-DSA-87 bit_lengths An array of integers indicating the key sizes supported for enrollment through Keyfactor Command. For RSA, Keyfactor Command supports key sizes 2048, 3072, 4096, 6144, 8192, and 16384. curves An array of strings indicating the elliptic curve algorithms that are supported for enrollment through Keyfactor Command, if applicable. ECC curves may be specified using the well-known OIDs for ECC algorithms or by friendly name. Well-known OIDs include: 1.2.840.10045.3.1.7 = P-256/ prime256v1/ secp256r1 1.3.132.0.34 = P-384/secp384r1 1.3.132.0.35 = P-521/secp521r1 When specifying by friendly name, do not include a slash (use “P-256” or “secp256r1”, not “P-256/prime256v1/secp256r1”).

A string indicating the key retention type used to store private keys in Keyfactor Command for certificates enrolled with this template. Show key retention details.

New enum field in the templates DB table, Manageability, which displays the manageability setting on a template, which are determined algorithmically based on the situation when the template is imported.

• If set to None (0), when Keyfactor Command syncs templates in, it'll ignore that template (not a common situation).

• Read (1) allows for the ability to read information on templates. All the templates imported into Keyfactor Command implicitly have had that level of manageability. With this setting, the View on CA and Copy on CA buttons would be enabled on the certificates template page.

• Read/Write (3) allows for the ability to manage the templates on the EJBCA server through Keyfactor Command. Set If there is a one-to-one match with EndEntity Profile and Template. With this setting, the Edit on CA, and the View on CA and Copy on CA, buttons would be enabled on the certificate template page.

A Boolean indicating whether RFC 2818 compliance enforcement is active (True or False). This setting is configured at the enrollment pattern level (see POST Enrollment Patterns) and will be populated based on the default enrollment pattern.

A string containing the name of the template. For a template created using a Microsoft management tool, this will be the Microsoft template display name. For a template generated for an EJBCA CA, this will be built using a naming scheme of end entity profile name (certificate profile name). This field is populated based on information retrieved from the CA and is not configurable.

An array of objects containing individual template-level regular expressions against which to validate the subject data. This data is configured at the enrollment pattern level (see POST Enrollment Patterns) and will be populated based on the default enrollment pattern.

Show template RegEx details.