PUT Templates

A string indicating the type of key retention certificates enrolled with this template will use to store their private key in Keyfactor Command. Show key retention details.

A Boolean indicating whether the template has been configured with the key archival setting in Active Directory (true) or not (false). This is a reference field and is not configurable.

An array of objects containing template-level metadata field settings. Template-level metadata field configurations can override global metadata field configurations in these possible ways:

• Configuration on the metadata field of required, optional or hidden.

• The default value for the metadata field.

• A regular expression defined for the field (string fields only) against which entered data will be validated along with its associated message.

• For fields of data type multiple choice, the list of values that appear in multiple choice dropdowns.

Metadata field settings defined on a template apply to enrollments made with that template only. Template-level metadata field settings, if defined, take precedence over global-level metadata field settings.

Show metadata field details.

^[a-zA-Z0-9'_\.\-]*@(keyexample\.org|keyexample\.com)$

For example:

"MetadataFields": [
   {
      "Id": 4,
      "DefaultValue": "reggie.wallace@keyexample.com",
      "MetadataId": 4,
      "Validation": "^[a-zA-Z0-9'_\\.\\-]*@(keyexample\\.org|keyexample\\.com)$",
      "Enrollment": 1,
      "Message": "Your email address must be of the form user@keyexample.com or fname.lname@keyexample.com."
   },
   {
      "Id": 13,
      "DefaultValue": "E-Business",
      "MetadataId": 5,
      "Validation": "",
      "Enrollment": 0,
      "Message": "",
      "Options": "Accounting,E-Business,Executive,HR,IT,Marketing,R&D,Sales"
   }
]

An array of objects containing individual template-level regular expressions against which to validate the subject data. Regular expressions defined on a template apply to enrollments made with that template only. Template-level regular expressions, if defined, take precedence over system-wide regular expressions. For more information about system-wide regular expressions, see GET Templates Settings.

^[a-zA-Z0-9'_\.\-]*\.keyexample\.com$

.+

^(?:Key Example Inc|Key Example|Key Example, Inc\.)$

^(?:IT|HR|Accounting|E-Commerce)$

^(?:Boston|Chicago|New York|London|Dallas)$

^(?:Massachusetts|Illinois|New York|Ontario|Texas)$

^(?:US|CA)$

^[a-zA-Z0-9'_\.\-]*@keyexample\.com$

^[a-zA-Z0-9'_\.\-]*\.(?:keyexample1\.com|keyexample2\.com)$

^130\.101\.(?:[0-9]{1,3})\.(?:[0-9]{1,3})$

^(?:[0-9]{1,3}\.){3}[0-9]{1,3}$

^(?:[A-F0-9]{1,4}:){7}[A-F0-9]{1,4}$

^[a-zA-Z0-9'_\.\-]*@keyexample\.com$

^[a-zA-Z0-9'_\.\-]*@keyexample\.com$

For example:

"TemplateRegexes": [
   {
      "TemplateId": 57,
      "SubjectPart": "O",
      "Regex": "^(?:Key Example Company|Key Example\, Inc\.)$",
      "Error": "Organization must be Key Example, Inc or Key Example Company."
   }
]

An object containing the individual template-level template policy settings. Template policies defined on a template apply to enrollments made with that template only. Template-level policies, if defined, take precedence over system-wide template policies. For more information about system-wide template policies, see GET Templates Settings. Show template policy details.

For example:

"TemplatePolicy": {
   "AllowKeyReuse": false,
   "AllowWildcards": true,
   "RFCEnforcement": true,
   "KeyInfo": {
      "ECDSA": {
         "bit_lengths": [
            256,
            384,
            521
         ],
         "curves": [
            "1.2.840.10045.3.1.7",
            "1.3.132.0.34",
            "1.3.132.0.35"
         ]
      },
      "RSA": null,
      "Ed448": null,
      "Ed25519": null
   }
}

An array of strings containing the list of Keyfactor Command security roles—as strings—that have been granted enroll permission on the template.

For example:

"AllowedRequesters": [
   "Administrator",
   "Power Users",
   "Revokers"
]

An integer indicating the total key usage of the certificate. Key usage is stored in Active Directory as a single value made of a combination of values. Show value details.

For example, a value of 160 would represent a key usage of digital signature with key encipherment. A value of 224 would add nonrepudiation to those.

A string indicating the forest root of the template. For Microsoft templates, this field is populated from Active Directory and is not configurable.

An object containing custom enrollment fields. These are configured on a per-template basis to allow you to submit custom fields with CSR enrollments and PFX enrollments to supply custom request attributes to the CA during the enrollment process. This functionality offers such benefits as:

• Preventing users from requesting invalid certificates, based on your specific certificate requirements per template.
• Providing additional information to the CA with the CSR.

Once created on the template, these values are shown in Keyfactor Command on the PFX and CSR enrollment pages in the Additional Enrollment Fields section. The fields are mandatory during enrollment. The data will appear on the CA / Issued Certificates attribute tab for certificates enrolled with a template configured with Keyfactor Command enrollment fields.

Show enrollment field details.

An integer indicating the type of enrollment allowed for the certificate template. Setting these options causes the template to appear in dropdowns in the corresponding section of the Management Portal. In the case of CSR Enrollment and PFX Enrollment, the templates only appear in dropdowns on the enrollment pages if they are available for enrollment from a CA also configured for enrollment within Keyfactor Command. See Adding or Modifying a CA Record for more information. Show allowed enrollment type details.

An array of objects containing individual template-level template default settings. Template defaults defined on a template apply to enrollments made with that template only. Template-level defaults, if defined, take precedence over system-wide template defaults. For more information about system-wide template defaults, see GET Templates Settings. Show template default details.

An object containing the key algorithms defined for the template as reported by the CA. This information indicates all the algorithms that could possibly be supported when the template is used for enrollment. Template policy within Keyfactor Command might limit this. Show key algorithm details.

An array of strings containing the list of Keyfactor Command security roles—as strings—that have been granted enroll permission on the template.

An integer indicating the total key usage of the certificate. Key usage is stored in Active Directory as a single value made of a combination of values. Show value details.

For example, a value of 160 would represent a key usage of digital signature with key encipherment. A value of 224 would add nonrepudiation to those.

A string indicating the friendly name of the elliptic curve algorithm configured for the template returned from the CA, for ECC templates. Possible values include:

• P-256

  1.2.840.10045.3.1.7 = P-256/ prime256v1/ secp256r1

• P-384

  1.3.132.0.34 = P-384/secp384r1

• P-521

  1.3.132.0.35 = P-521/secp521r1

If the template supports more than one curve, this field contains the minimum curve value.