PUT Templates

Documentation Suite v10.5

PUT Templates

The PUT /Templates method is used to update selected information about a certificate template A certificate template defines the policies and rules that a CA uses when a request for a certificate is received.. This method returns HTTP 200 OK on a success with details about the specified template.

Tip: The following permissions (see Security Overview) are required to use this feature:

PkiManagement: Modify

Important: Any previously populated fields that are not submitted with their full existing data using this method will be cleared of their existing data. When using this method, you should first do a GET to retrieve all the values for the record you want to update, enter corrected data into the field(s) you want to update, and then submit all the fields using PUT, including the fields that contain values but which you are not changing.

Table 619: PUT Templates Input Parameters

Name

Description

Body

Required. An integer indicating the ID of the template in Keyfactor Command.

KeySize

Body

A string indicating the minimum supported key size of the template as defined by the CA. The field is not configurable.

KeyType

Body

A string indicating the key type of the template as defined by the CA. The field is not configurable.

FriendlyName

Body

A string indicating the Keyfactor Command friendly name of the template. Template friendly names, if configured, appear in the dropdowns for PFX enrollment, CSR enrollment, and CSR generation in place of the template names. This can be useful in environments where the template names are long or not very human readable.

KeyRetention

Body

A string indicating the type of key retention certificates enrolled with this template will use to store their private key in Keyfactor Command. Show key retention details.

Value	Description
None	The private key will not be retained.
Indefinite	The private key will be retained until it is explicitly deleted.
AfterExpiration	The private key will be retained until the specified number of days after the certificate expires (KeyRetentionDays), at which point it will be scheduled for deletion.
FromIssuance	The private key will be retained until the specified number of days after the date on which the certificate was issued (KeyRetentionDays), at which point it will be scheduled for deletion.

KeyRetentionDays

Body

An integer indicating the number of days a certificate’s private key will be retained in Keyfactor Command before being scheduled for deletion, if private key retention is enabled.

KeyArchival

Body

A Boolean indicating whether the template has been configured with the key archival setting in Active Directory (true) or not (false). This is a reference field and is not configurable.

EnrollmentFields

Body

An object containing custom enrollment fields. These are configured on a per-template basis to allow you to submit custom fields with CSR enrollments and PFX enrollments to supply custom request attributes to the CA during the enrollment process. This functionality offers such benefits as:

Preventing users from requesting invalid certificates, based on your specific certificate requirements per template.
Providing additional information to the CA with the CSR.

Once created on the template, these values are shown in Keyfactor Command on the PFX and CSR enrollment pages in the Additional Enrollment Fields section. The fields are mandatory during enrollment. The data will appear on the CA / Issued Certificates attribute tab for certificates enrolled with a template configured with Keyfactor Command enrollment fields.

Note: These are not metadata fields, so they are not stored in the Keyfactor Command database, but simply passed through to the CA. The CA in turn could, via a gateway or policy module, use this data to perform required actions.

Show enrollment field details.

Name

Description

An integer indicating the ID of the custom enrollment field.

Name

A string indicating the name of the custom enrollment field. This name will appear on the enrollment pages.

Options

For multiple choice values, an array of strings containing the value choices.

DataType

An integer indicating the parameter type. The options are:

Value	Description
1	String: A free-form data entry field.
2	Multiple Choice: Provides a list of acceptable values for the field. The multiple choice values are provided in the Options parameter.

For example:

"EnrollmentFields": [
   {
      "Id": 3,
      "Name": "MyCustomField",
      "Options": ["Green","Red","Yellow","Blue"],
      "DataType": 2
   }
]

MetadataFields

Body

An object containing template-level metadata field settings. Template-level metadata field configurations can override global metadata field configurations in these possible ways:

Configuration on the metadata field of required, optional or hidden.
The default value for the metadata field.
A regular expression defined for the field (string fields only) against which entered data will be validated along with its associated message.
For fields of data type multiple choice, the list of values that appear in multiple choice dropdowns.

Metadata field settings defined on a template apply to enrollments made with that template only. Template-level metadata field settings, if defined, take precedence over global-level metadata field settings.

Show metadata field details.

Name

Description

The Keyfactor Command reference ID of the template-specific metadata setting.

DefaultValue

A string containing the default value defined for the metadata field for the specific template.

MetadataId

An integer indicating the global metadata field associated with the template-specific settings.

Validation

A string containing the template-specific regular expression against which data entered in a string field will be validated. When a user enters information in a metadata field that does not match the specified regular expression, he or she will see the warning message specified in the Message field. For example:

^[a-zA-Z0-9'_\.\-]*@(keyexample\.org|keyexample\.com)$

This regular expression specifies that the data entered in the field must consist of some number of characters prior to the “@” made up only of lowercase letters, uppercase letters, numbers, apostrophes, underscores, periods, and/or hyphens followed by exactly either “@keyexample.org” or “keyexample.com”.

This field is only supported for metadata fields with data type string.

Enrollment

An integer that indicates how metadata fields should be handled on the PFX and CSR Enrollment pages. Possible values are:

Value	Description
0	Optional Users have the option to either enter a value or not enter a value in the field.
1	Required Users are required to enter data in the field when populating metadata fields on the PFX and CSR Enrollment pages. The field is not required on the certificate details or Add Certificate page.
2	Hidden The field is hidden and does not appear on the PFX and CSR Enrollment pages. This field still appears on the certificate details and the Add Certificate page.

Message

A string containing a message to present when a user enters information in a metadata field that does not match the template-specific regular expression (Validation field).

Options

An array containing a comma separated list of values that should appear in the field dropdown for multiple choice fields.

This field is only supported for metadata fields with data type multiple choice.

For example:

"MetadataFields": [
   {
      "Id": 4,
      "DefaultValue": "reggie.wallace@keyexample.com",
      "MetadataId": 4,
      "Validation": "^[a-zA-Z0-9'_\\.\\-]*@(keyexample\\.org|keyexample\\.com)$",
      "Enrollment": 1,
      "Message": "Your email address must be of the form user@keyexample.com or fname.lname@keyexample.com."
   },
   {
      "Id": 13,
      "DefaultValue": "E-Business",
      "MetadataId": 5,
      "Validation": "",
      "Enrollment": 0,
      "Message": "",
      "Options": "Accounting,E-Business,Executive,HR,IT,Marketing,R&D,Sales"
   }
]

AllowedEnrollmentTypes

Body

An integer indicating the type of enrollment allowed for the certificate template. Setting these options causes the template to appear in dropdowns in the corresponding section of the Management Portal. In the case of CSR Enrollment and PFX Enrollment, the templates only appear in dropdowns on the enrollment pages if they are available for enrollment from a CA also configured for enrollment within Keyfactor Command. See Adding or Modifying a CA Record in the Keyfactor Command Reference Guide for more information. Show allowed enrollment type details.

Value	Description
0	None
1	PFX Enrollment
2	CSR Enrollment
3	CSR Enrollment & PFX Enrollment
4	CSR Generation
5	CSR Generation & PFX Enrollment
6	CSR Generation & CSR Enrollment
7	CSR Enrollment, PFX Enrollment & CSR Generation

TemplateRegexes

Body

An object containing individual template-level regular expressions against which to validate the subject data. Regular expressions defined on a template apply to enrollments made with that template only. Template-level regular expressions, if defined, take precedence over system-wide regular expressions. For more information about system-wide regular expressions, see GET Templates Settings. Show regular expression details.

Name

Description

TemplateId

The Keyfactor Command reference ID of the certificate template the regular expression is associated with.

SubjectPart

A string indicating the portion of the subject the regular expression applies to (e.g. CN).

RegEx

A string specifying the regular expression against which data entered in the indicated subject part field (e.g. CN) in the enrollment pages of the Keyfactor Command Management Portal or using an API enrollment method will be validated.

Use the GET /Templates/SubjectParts method (see GET Templates Subject Parts) to retrieve a list of all the supported subject parts.

Show regular expression examples.

Subject Part	Example
CN (Common Name)	This regular expression specifies that the data entered in the field must consist of some number of characters in the first portion of the field made up only of lowercase letters, uppercase letters, numbers, apostrophes, underscores, periods, and/or hyphens followed by exactly .keyexample.com: ^[a-zA-Z0-9'_\.\-]*\.keyexample\.com$ The default value for the Common Name regular expression is: .+ This requires entry of at least one character in the Common Name field in the enrollment pages.
O (Organization)	This regular expression requires that the organization name entered in the field be one of “Key Example Inc”, “Key Example” or “Key Example Inc.”: ^(?:Key Example Inc\|Key Example\|Key Example, Inc\.)$ The period in the final company name (Key Example, Inc.) needs to be escaped in the regular expression with a slash ("\") but the comma does not.
OU (Organization Unit)	This regular expression requires that the organizational unit entered in the field be one of these four departments: ^(?:IT\|HR\|Accounting\|E-Commerce)$
L (City/Locality)	This regular expression requires that the city entered in the field be one of these five cities: ^(?:Boston\|Chicago\|New York\|London\|Dallas)$
ST (State/Province)	This regular expression requires that the state entered in the field be one of these eight states: ^(?:Massachusetts\|Illinois\|New York\|Ontario\|Texas)$
C (Country)	This regular expression requires that the country entered in the field be either US or CA: ^(?:US\|CA)$
E (Email)	This regular expression specifies that the data entered in the field must consist of some number of characters prior to the “@” made up only of lowercase letters, uppercase letters, numbers, apostrophes, underscores, periods, and/or hyphens followed by exactly “@keyexample.com”: ^[a-zA-Z0-9'_\.\-]*@keyexample\.com$
DNS (Subject Alternative Name: DNS Name)	This regular expression specifies that the data entered in the field must consist of some number of characters in the first portion of the field made up only of lowercase letters, uppercase letters, numbers, apostrophes, underscores, periods, and/or hyphens followed by exactly either “.keyexample1.com” or “.keyexample2.com”: ^[a-zA-Z0-9'_\.\-]*\.(?:keyexample1\.com\|keyexample2\.com)$
IPv4 (Subject Alternative Name: IPv4 Address)	This regular expression specifies that the data entered in the field must be exactly “130.101.” followed by anywhere between 1 and 3 numbers followed by exactly “.” followed by anywhere between 1 and 3 numbers: ^130\.101\.(?:[0-9]{1,3})\.(?:[0-9]{1,3})$ This regular expression specifies only that the IPv4 address is made up of 4 sets of between 1 and 3 numbers separated by periods: ^(?:[0-9]{1,3}\.){3}[0-9]{1,3}$
IPv6 (Subject Alternative Name: IPv6 Address)	This regular expression specifies that the data entered in the field must be made up of eight sets of between one and four numbers and/or uppercase letters separated by colons: ^(?:[A-F0-9]{1,4}:){7}[A-F0-9]{1,4}$
MAIL (Subject Alternative Name: Email)	This regular expression specifies that the data entered in the field must consist of some number of characters prior to the “@” made up only of lowercase letters, uppercase letters, numbers, apostrophes, underscores, periods, and/or hyphens followed by exactly “@keyexample.com”: ^[a-zA-Z0-9'_\.\-]*@keyexample\.com$
UPN (Subject Alternative Name: User Principal Name)	This regular expression specifies that the data entered in the field must consist of some number of characters prior to the “@” made up only of lowercase letters, uppercase letters, numbers, apostrophes, underscores, periods, and/or hyphens followed by exactly “@keyexample.com”: ^[a-zA-Z0-9'_\.\-]*@keyexample\.com$

Error

A string specifying the error message displayed to the user when the subject part referenced in the CSR or entered for a PFX enrollment does not match the given regular expression. Note that the error message already includes a leading string with the subject part (e.g. “Common Name:” or “Invalid CN provided:” depending on the interface used). Your custom message follows this.

For example:

"TemplateRegexes": [
   {
      "TemplateId": 57,
      "SubjectPart": "O",
      "Regex": "^(?:Key Example Company|Key Example\, Inc\.)$",
      "Error": "Organization must be Key Example, Inc or Key Example Company."
   }
]

TemplateDefaults

Body

An object containing individual template-level template default settings. Template defaults defined on a template apply to enrollments made with that template only. Template-level defaults, if defined, take precedence over system-wide template defaults. For more information about system-wide template defaults, see GET Templates Settings. Show template default details.

Value

Description

SubjectPart

A string indicating the portion of the subject the default applies to (e.g. L for City/Locality).

Use the GET /Templates/SubjectParts method (see GET Templates Subject Parts) to retrieve a list of all the supported subject parts.

Value

A string containing the value to assign as the default for that subject part (e.g. Chicago).

For example:

"TemplateDefaults": [
   {
      "SubjectPart": "L",
      "Value": "Denver"
   },
   {
      "SubjectPart": "ST",
      "Value": "Colorado"
   }
]

TemplatePolicy

Body

An object containing the individual template-level template policy settings. Template policies defined on a template apply to enrollments made with that template only. Template-level policies, if defined, take precedence over system-wide template policies. For more information about system-wide template policies, see GET Templates Settings. Show template policy details.

Value	Description
TempalteId	The Keyfactor Command reference ID of the certificate template the policy is associated with.
RSAValidKeySizes	An object containing a comma-delimited list of integers defining the valid RSA key sizes supported for all templates used for enrollment. The supported values are: 2048 4096
ECCValidCurves	An object containing a list of strings defining the valid elliptic curve algorithms for ECC templates. These may be specified using the well-known OIDs for ECC algorithms or by friendly name. Well-known OIDs include: 1.2.840.10045.3.1.7 = P-256/prime256v1/secp256r1 1.3.132.0.34 = P-384/secp384r1 1.3.132.0.35 = P-521/secp521r1 When specifying by friendly name, do not include a slash (use “P-256”, not “P-256/prime256v1/secp256r1”).
AllowKeyReuse	A Boolean that indicates whether private key reuse is allowed (true) or not (false). This option applies to certificate renewals. By default, this is set to true at a system-wide level.
AllowWildcards	A Boolean that indicates whether wildcards are allowed (true) or not (false). By default, this is set to true at a system-wide level.
RFCEnforcement	A Boolean that indicates whether RFC 2818 compliance enforcement is enabled (true) or not (false). When this option is set to true, certificate enrollments made through Keyfactor Command for this template must include at least one DNS SAN. In the Keyfactor Command Management Portal, this causes the CN entered in PFX enrollment to automatically be replicated as a SAN, which the user can either change or accept. For CSR enrollment, if the CSR does not have a SAN that matches the CN, one will automatically be added to the certificate if this is set. By default, this is set to false at a system-wide level.
AllowEd448	A Boolean that indicates whether Ed448 key type is allowed (true) or not (false).
AllowEd25519	A Boolean that indicates whether Ed25519 key type is allowed (true) or not (false).

For example:

"TemplatePolicy": {
   "TemplateId": 17,
   "RSAValidKeySizes": [
      2048,
      4096
   ],
   "ECCValidCurves": [
      "1.2.840.10045.3.1.7",
      "1.3.132.0.34"
      "1.3.132.0.35"
   ],
   "AllowKeyReuse": false,
   "AllowWildcards": true,
   "RFCEnforcement": true,
   "AllowEd448": false,
   "AllowEd25519": false
}

UseAllowedRequesters

Body

A Boolean that indicates whether the Restrict Allowed Requesters option should be enabled (true) or not (false). The Restrict Allowed Requesters option is used to select Keyfactor Command security roles that a user must belong to in order to successfully enroll for certificates in Keyfactor Command using this template. This is typically used for EJBCA templates and Microsoft templates that are not in the local Active Directory forest, since in these cases, Keyfactor Command cannot make use of the access control model of the CA itself to determine which users can enroll for certificates; this setting replaces that functionality. This setting is similar to setting request certificates for the selected security roles at the template level on a Microsoft CA. In addition to granting permissions at the template level, you need enable the Restrict Allowed Requesters option to grant permissions at the CA level. See Adding or Modifying a CA Record in the Keyfactor Command Reference Guide for more information.

AllowedRequesters

Body

An object containing the list of Keyfactor Command security roles—as strings—that have been granted enroll permission on the template.

For example:

"AllowedRequesters": [
   "Administrator",
   "Power Users",
   "Revokers"
]

RequiresApproval

Body

A Boolean indicating whether the template has been configured with the Microsoft CA certificate manager approval option enabled (true) or not (false).

Important: Any templates that are configured on the Microsoft CA Issuance Requirements tab for CA certificate manager approval cannot be used for enrollment and associated alerting in Keyfactor Command without configuring private key retention. Any of the enabled private key retention settings (settings other than none as described for KeyRetention) will allow a template requiring manager approval to work with Keyfactor Command PFX and CSR enrollment.

Figure 435: Microsoft Issuance Requirements on a Template for Manager Approval

KeyUsage

Body

An integer indicating the total key usage of the certificate. Key usage is stored in Active Directory as a single value made of a combination of values. Show value details.

Value	Function	Description
0	None	No key usage parameters.
1	Encipherment Only	The key can be used for encryption only.
2	CRL Signing	The key can be used to sign a certificate revocation list (CRL).
4	Key Certificate Signing	The key can be used to sign certificates.
8	Key Agreement	The key can be used to determine key agreement, such as a key created using the Diffie-Hellman key agreement algorithm.
16	Data Encipherment	The key can be used for data encryption.
32	Key Encipherment	The key can be used for key encryption.
64	Nonrepudiation	The key can be used for authentication.
128	Digital Signature	The key can be used as a digital signature.
32768	Decipherment Only	The key can be used for decryption only.

For example, a value of 160 would represent a key usage of digital signature with key encipherment. A value of 224 would add nonrepudiation to those.

Curve

Body

A string indicating the OID of the elliptic curve algorithm configured for the template, for ECC templates. Well-known OIDs include:

1.2.840.10045.3.1.7 = P-256/prime256v1/secp256r1
1.3.132.0.34 = P-384/secp384r1
1.3.132.0.35 = P-521/secp521r1

Table 620: PUT Templates Response Body

Name

Description

An integer indicating the ID of the template in Keyfactor Command.

CommonName

A string containing the common name (short name) of the template. This name typically does not contain spaces. For a template created using a Microsoft management tool, this will be the Microsoft template name. For a template generated for an EJBCA CA, this will be built using a naming scheme of <end entity profile name>_<certificate profile name>.This field is populated based on information retrieved from the CA and is not configurable.

TemplateName

A string containing the name of the template. For a template created using a Microsoft management tool, this will be the Microsoft template display name. For a template generated for an EJBCA CA, this will be built using a naming scheme of <end entity profile name> (<certificate profile name>). This field is populated based on information retrieved from the CA and is not configurable.

Oid

A string containing the object ID of the template in Active Directory. For Microsoft templates, this field is populated from Active Directory. For EJBCA templates, this field is generated within Keyfactor Command as an object identifier, but does not follow official OID conventions. The field is not configurable.

KeySize

A string indicating the minimum supported key size of the template as defined by the CA. The field is not configurable.

KeyType

A string indicating the key type of the template as defined by the CA. The field is not configurable.

ForestRoot

A string indicating the forest root of the template. For Microsoft templates, this field is populated from Active Directory and is not configurable.

Note: The ForestRoot has been replaced by the ConfigurationTenant from release 10, but is retained for backwards compatibility.

ConfigurationTenant

A string indicating the configuration tenant of the template. For Microsoft templates, this field is populated from Active Directory. For EJBCA templates, this field is populated from the Keyfactor Command CA record. The field is not configurable.

FriendlyName

KeyRetention

A string indicating the type of key retention certificates enrolled with this template will use to store their private key in Keyfactor Command. Show key retention details.

Value	Description
None	The private key will not be retained.
Indefinite	The private key will be retained until it is explicitly deleted.
AfterExpiration	The private key will be retained until the specified number of days after the certificate expires (KeyRetentionDays), at which point it will be scheduled for deletion.
FromIssuance	The private key will be retained until the specified number of days after the date on which the certificate was issued (KeyRetentionDays), at which point it will be scheduled for deletion.

KeyRetentionDays

An integer indicating the number of days a certificate’s private key will be retained in Keyfactor Command before being scheduled for deletion, if private key retention is enabled.

KeyArchival

A Boolean indicating whether the template has been configured with the key archival setting in Active Directory (true) or not (false). This is a reference field and is not configurable.

EnrollmentFields

Preventing users from requesting invalid certificates, based on your specific certificate requirements per template.
Providing additional information to the CA with the CSR.

Show enrollment field details.

Name

Description

An integer indicating the ID of the custom enrollment field.

Name

A string indicating the name of the custom enrollment field. This name will appear on the enrollment pages.

Options

For multiple choice values, an array of strings containing the value choices.

DataType

An integer indicating the parameter type. The options are:

Value	Description
1	String: A free-form data entry field.
2	Multiple Choice: Provides a list of acceptable values for the field. The multiple choice values are provided in the Options parameter.

MetadataFields

An object containing template-level metadata field settings. Template-level metadata field configurations can override global metadata field configurations in these possible ways:

Configuration on the metadata field of required, optional or hidden.
The default value for the metadata field.
A regular expression defined for the field (string fields only) against which entered data will be validated along with its associated message.
For fields of data type multiple choice, the list of values that appear in multiple choice dropdowns.

Show metadata field details.

Name

Description

The Keyfactor Command reference ID of the template-specific metadata setting.

DefaultValue

A string containing the default value defined for the metadata field for the specific template.

MetadataId

An integer indicating the global metadata field associated with the template-specific settings.

Validation

^[a-zA-Z0-9'_\.\-]*@(keyexample\.org|keyexample\.com)$

This field is only supported for metadata fields with data type string.

Enrollment

An integer that indicates how metadata fields should be handled on the PFX and CSR Enrollment pages. Possible values are:

Value	Description
0	Optional Users have the option to either enter a value or not enter a value in the field.
1	Required Users are required to enter data in the field when populating metadata fields on the PFX and CSR Enrollment pages. The field is not required on the certificate details or Add Certificate page.
2	Hidden The field is hidden and does not appear on the PFX and CSR Enrollment pages. This field still appears on the certificate details and the Add Certificate page.

Message

A string containing a message to present when a user enters information in a metadata field that does not match the template-specific regular expression (Validation field).

Options

An array containing a comma separated list of values that should appear in the field dropdown for multiple choice fields.

This field is only supported for metadata fields with data type multiple choice.

AllowedEnrollmentTypes

Value	Description
0	None
1	PFX Enrollment
2	CSR Enrollment
3	CSR Enrollment & PFX Enrollment
4	CSR Generation
5	CSR Generation & PFX Enrollment
6	CSR Generation & CSR Enrollment
7	CSR Enrollment, PFX Enrollment & CSR Generation

TemplateRegexes

Name

Description

TemplateId

The Keyfactor Command reference ID of the certificate template the regular expression is associated with.

SubjectPart

A string indicating the portion of the subject the regular expression applies to (e.g. CN).

RegEx

Use the GET /Templates/SubjectParts method (see GET Templates Subject Parts) to retrieve a list of all the supported subject parts.

Show regular expression examples.

Subject Part	Example
CN (Common Name)	This regular expression specifies that the data entered in the field must consist of some number of characters in the first portion of the field made up only of lowercase letters, uppercase letters, numbers, apostrophes, underscores, periods, and/or hyphens followed by exactly .keyexample.com: ^[a-zA-Z0-9'_\.\-]*\.keyexample\.com$ The default value for the Common Name regular expression is: .+ This requires entry of at least one character in the Common Name field in the enrollment pages.
O (Organization)	This regular expression requires that the organization name entered in the field be one of “Key Example Inc”, “Key Example” or “Key Example Inc.”: ^(?:Key Example Inc\|Key Example\|Key Example, Inc\.)$ The period in the final company name (Key Example, Inc.) needs to be escaped in the regular expression with a slash ("\") but the comma does not.
OU (Organization Unit)	This regular expression requires that the organizational unit entered in the field be one of these four departments: ^(?:IT\|HR\|Accounting\|E-Commerce)$
L (City/Locality)	This regular expression requires that the city entered in the field be one of these five cities: ^(?:Boston\|Chicago\|New York\|London\|Dallas)$
ST (State/Province)	This regular expression requires that the state entered in the field be one of these eight states: ^(?:Massachusetts\|Illinois\|New York\|Ontario\|Texas)$
C (Country)	This regular expression requires that the country entered in the field be either US or CA: ^(?:US\|CA)$
E (Email)	This regular expression specifies that the data entered in the field must consist of some number of characters prior to the “@” made up only of lowercase letters, uppercase letters, numbers, apostrophes, underscores, periods, and/or hyphens followed by exactly “@keyexample.com”: ^[a-zA-Z0-9'_\.\-]*@keyexample\.com$
DNS (Subject Alternative Name: DNS Name)	This regular expression specifies that the data entered in the field must consist of some number of characters in the first portion of the field made up only of lowercase letters, uppercase letters, numbers, apostrophes, underscores, periods, and/or hyphens followed by exactly either “.keyexample1.com” or “.keyexample2.com”: ^[a-zA-Z0-9'_\.\-]*\.(?:keyexample1\.com\|keyexample2\.com)$
IPv4 (Subject Alternative Name: IPv4 Address)	This regular expression specifies that the data entered in the field must be exactly “130.101.” followed by anywhere between 1 and 3 numbers followed by exactly “.” followed by anywhere between 1 and 3 numbers: ^130\.101\.(?:[0-9]{1,3})\.(?:[0-9]{1,3})$ This regular expression specifies only that the IPv4 address is made up of 4 sets of between 1 and 3 numbers separated by periods: ^(?:[0-9]{1,3}\.){3}[0-9]{1,3}$
IPv6 (Subject Alternative Name: IPv6 Address)	This regular expression specifies that the data entered in the field must be made up of eight sets of between one and four numbers and/or uppercase letters separated by colons: ^(?:[A-F0-9]{1,4}:){7}[A-F0-9]{1,4}$
MAIL (Subject Alternative Name: Email)	This regular expression specifies that the data entered in the field must consist of some number of characters prior to the “@” made up only of lowercase letters, uppercase letters, numbers, apostrophes, underscores, periods, and/or hyphens followed by exactly “@keyexample.com”: ^[a-zA-Z0-9'_\.\-]*@keyexample\.com$
UPN (Subject Alternative Name: User Principal Name)	This regular expression specifies that the data entered in the field must consist of some number of characters prior to the “@” made up only of lowercase letters, uppercase letters, numbers, apostrophes, underscores, periods, and/or hyphens followed by exactly “@keyexample.com”: ^[a-zA-Z0-9'_\.\-]*@keyexample\.com$

Error

TemplateDefaults

Value

Description

SubjectPart

A string indicating the portion of the subject the default applies to (e.g. L for City/Locality).

Use the GET /Templates/SubjectParts method (see GET Templates Subject Parts) to retrieve a list of all the supported subject parts.

Value

A string containing the value to assign as the default for that subject part (e.g. Chicago).

TemplatePolicy

Value	Description
TempalteId	The Keyfactor Command reference ID of the certificate template the policy is associated with.
RSAValidKeySizes	An object containing a comma-delimited list of integers defining the valid RSA key sizes supported for all templates used for enrollment. The supported values are: 2048 4096
ECCValidCurves	An object containing a list of strings defining the valid elliptic curve algorithms for ECC templates. These may be specified using the well-known OIDs for ECC algorithms or by friendly name. Well-known OIDs include: 1.2.840.10045.3.1.7 = P-256/prime256v1/secp256r1 1.3.132.0.34 = P-384/secp384r1 1.3.132.0.35 = P-521/secp521r1 When specifying by friendly name, do not include a slash (use “P-256”, not “P-256/prime256v1/secp256r1”).
AllowKeyReuse	A Boolean that indicates whether private key reuse is allowed (true) or not (false). This option applies to certificate renewals. By default, this is set to true at a system-wide level.
AllowWildcards	A Boolean that indicates whether wildcards are allowed (true) or not (false). By default, this is set to true at a system-wide level.
RFCEnforcement	A Boolean that indicates whether RFC 2818 compliance enforcement is enabled (true) or not (false). When this option is set to true, certificate enrollments made through Keyfactor Command for this template must include at least one DNS SAN. In the Keyfactor Command Management Portal, this causes the CN entered in PFX enrollment to automatically be replicated as a SAN, which the user can either change or accept. For CSR enrollment, if the CSR does not have a SAN that matches the CN, one will automatically be added to the certificate if this is set. By default, this is set to false at a system-wide level.
AllowEd448	A Boolean that indicates whether Ed448 key type is allowed (true) or not (false).
AllowEd25519	A Boolean that indicates whether Ed25519 key type is allowed (true) or not (false).

UseAllowedRequesters

AllowedRequesters

An object containing the list of Keyfactor Command security roles—as strings—that have been granted enroll permission on the template.

DisplayName

A string indicating the Keyfactor Command display name of the template. If a template friendly name is configured, this is used as the display name. If not, the template name is used. The display name appears in the dropdowns for PFX enrollment, CSR enrollment, and CSR generation. The display name is a generated field and is not directly configurable.

RequiresApproval

A Boolean indicating whether the template has been configured with the Microsoft CA certificate manager approval option enabled (true) or not (false).

Figure 436: Microsoft Issuance Requirements on a Template for Manager Approval

KeyUsage

An integer indicating the total key usage of the certificate. Key usage is stored in Active Directory as a single value made of a combination of values. Show value details.

Value	Function	Description
0	None	No key usage parameters.
1	Encipherment Only	The key can be used for encryption only.
2	CRL Signing	The key can be used to sign a certificate revocation list (CRL).
4	Key Certificate Signing	The key can be used to sign certificates.
8	Key Agreement	The key can be used to determine key agreement, such as a key created using the Diffie-Hellman key agreement algorithm.
16	Data Encipherment	The key can be used for data encryption.
32	Key Encipherment	The key can be used for key encryption.
64	Nonrepudiation	The key can be used for authentication.
128	Digital Signature	The key can be used as a digital signature.
32768	Decipherment Only	The key can be used for decryption only.

For example, a value of 160 would represent a key usage of digital signature with key encipherment. A value of 224 would add nonrepudiation to those.

ExtendedKeyUsages

An object containing the extended key usage information for the template. This field is populated from the CA and is not configurable. Show extended key usage details.

Name	Description
Id	An integer indicating the ID of the extended key usage in Active Directory.
Oid	A string containing the object ID of the extended key usage.
DisplayName	A string specifying the display name of the extended key usage (e.g. Server Authentication).

Curve

A string indicating the OID of the elliptic curve algorithm configured for the template, for ECC templates. Well-known OIDs include:

1.2.840.10045.3.1.7 = P-256/prime256v1/secp256r1
1.3.132.0.34 = P-384/secp384r1
1.3.132.0.35 = P-521/secp521r1

Tip: For code examples, see the Keyfactor API Endpoint Utility. To find the embedded web copy of this utility, click the help icon (

) at the top of the Keyfactor Command Management Portal page next to the Log Out button.

PUT Templates

Products

Resources

Company