Certificate Template Operations

Details

The information in the Details section is for reference and cannot be edited. This includes:

• Template Short Name: The common name A common name (CN) is the component of a distinguished name (DN) that represents the primary name of the object. The value varies depending on the type of object. For a user object, this would be the user's name (e.g. CN=John Smith). For SSL certificates, the CN is typically the fully qualified domain name (FQDN) of the host where the SSL certificate will reside (e.g. servername.keyexample.com or www.keyexample.com). of the template. This name typically does not contain spaces.

• Template Display Name: The display name of the template.

• OID: For a Microsoft certificate template, the object ID of the template retrieved from Active Directory. For an EJBCA certificate template, this field is generated within Keyfactor Command as an object identifier Object identifiers or OIDs are a standardized system for identifying any object, concept, or "thing" with a globally unambiguous persistent name., but does not follow official OID Object identifiers or OIDs are a standardized system for identifying any object, concept, or "thing" with a globally unambiguous persistent name. conventions.

Key Types and Sizes

The information in the Key Types and Sizes section reflects the key sizes and types supported by the template at the CA level. It is for reference and cannot be edited. This includes:

• RSA Key Sizes: The supported key size(s) for the template.

• ECC Curves: For ECC Elliptical curve cryptography (ECC) is a public key encryption technique based on elliptic curve theory that can be used to create faster, smaller, and more efficient cryptographic keys. ECC generates keys through the properties of the elliptic curve equation instead of the traditional method of generation as the product of very large prime numbers. templates, the elliptic curve algorithm(s) defined for the certificate template.

• Supports Ed448: Whether the template supports the Ed448 algorithm (Yes/No).

• Supports Ed25519: Whether the template supports the Ed25519 algorithm (Yes/No).

Friendly Name

In the Friendly Name section, enter a Friendly Name, if desired. Template friendly names, if configured, appear in template selection dropdowns in place of the template short names. This can be useful in environments where the template short names are long or not very human readable. This setting is not required.

Enrollment

Enable the Allow One-Click Renewals option, if desired. To use One-Click Renewal for certificates, the Allow One-Click Renewals option must be enabled in both the certificate templates and CAs to which you want One-Click Renewal to apply (see HTTPS CAs - Advanced Tab or DCOM CAs - Advanced Tab ). For more information about one-click renewals, see Renew.

Private Key Retention

In the Private Key Retention section, enable Private Key Retention, if desired, and select the retention type in the dropdown. Enter the number of days, weeks, months, or years to keep the encrypted private key Private keys are used in cryptography (symmetric and asymmetric) to encrypt or sign content. In asymmetric cryptography, they are used together in a key pair with a public key. The private or secret key is retained by the key's creator, making it highly secure. stored in the Keyfactor Command database based on the type selected, then select the desired time frame (Day(s), Week(s), Month(s), or Year(s)). You will not have the option to choose a retention timeframe if you choose Indefinite.

Certificate Cleanup

The certificate cleanup task periodically removes expired certificates from the database. Once removed, these certificates will not be re-imported during a standard CA synchronization unless certificate cleanup is later disabled. CA synchronization tasks use the certificate cleanup settings to determine whether a certificate is eligible for cleanup and exclude such certificates from import.

Certificate cleanup settings can be configured at three levels:

• Certificate Template Record: If configured, overrides the system-wide settings when processing certificate cleanup tasks for certificates associated with this template. These cleanup tasks are processed first.

• Certificate Authority (CA) Record: If configured, overrides the system-wide settings when processing certificate cleanup tasks for certificates associated with this CA but not associated with any template. These cleanup tasks are processed second.

• System-Wide: Applies to all certificate authorities and templates in the system. These values are used when processing certificate cleanup tasks for certificates associated with neither a CA nor a template and when no overrides are set at the CA or template level. These cleanup tasks are processed last.

  Note:  For manually imported certificates without an associated template (e.g., from a standalone CA), system-wide cleanup settings will be applied even if the CA exists in Keyfactor Command. This occurs because Keyfactor Command cannot reliably associate such certificates with the correct CA.

In the certificate cleanup section, configure the following options, if desired:

• Certificate Cleanup Enabled for Template : Enable the periodic cleanup job to remove expired certificates from the database. The default is disabled.

• Time After Expiration: The amount of time after expiration to wait until the certificate is eligible for removal. The default is 24.

• Time After Expiration Units: The time unit to apply to the expiration time. Options are days, weeks, or months. The default is months.

• Delete Certificates with Archived Keys for Template : Determines whether certificates with a private key stored in the system are eligible for removal. The default is disabled.

Select metadata Metadata provides information about a piece of data. It is used to summarize basic information about data, which can make working with the data easier. In Keyfactor Command, the certificate metadata feature allows you to create custom metadata fields that allow you to tag certificates with tracking information about certificates. fields can be configured at three levels:

• System-wide

• Template level

• Enrollment pattern level

The multi-level configurable fields are:

• Enrollment Handling: Specifies whether the field is Optional, Required, or Hidden during enrollment.

  Tip:  Administrators can control which metadata fields appear at the global, template, or enrollment pattern level. For example, setting fields A and B as Required or Optional and field C as Hidden on the Primary WebServer enrollment pattern ensures only fields A and B appear during enrollment for that pattern. Meanwhile, field C can be set as Required for a different enrollment pattern, allowing it to appear only when that pattern is used.

• Default Value: A predefined value that populates during enrollment, which users can override.

• RegEx Message: An error message displayed when the value entered in a string metadata field does not match the configured regular expression A regular expression--RegEx--is a pattern used to validate data by ensuring it meets specific criteria. Several fields on the CSR enrollment, CSR generation, and PFX enrollment pages support RegEx validation, including certificate subject and metadata fields..

• RegEx Validation: An optional regular expression that validates input for string metadata fields during enrollment.

• Case-Sensitive Validation: A toggle that enforces case-sensitive validation for regular expression checks, overriding any case-sensitivity defined in the regular expression itself.

Once the system-wide metadata has been defined, settings at the template level can be configured.

To configure metadata fields for a template:

1. On the Metadata tab, select one of the following methods to edit an entry:

   • Double-click the row in the Metadata grid.
   • Highlight the row in the grid and click Edit at the top of the grid.
2. In the Metadata dialog in the System-Wide Settings section, review the existing system-wide settings for the metadata field.
3. In the Template Settings section, click to toggle the Override System-Wide Settings button. Configure the settings for the metadata field. The available fields will vary depending on the type of the metadata field and may include:

   • Choose the enrollment handling for this template by selecting the appropriate radio button:

     • Optional: The metadata field will appear during enrollment with this template, but it will not be required to complete enrollment.

     • Required: This field will be required in order to complete enrollment with this template.

     • Hidden: This field will not be displayed during enrollment with this template.

   • Set the Default Value if desired. If no default value is desired, the field may be left blank. For Multiple Choice type metadata fields, this field will appear as a dropdown where you can select from the existing values configured for the metadata field.
   • If desired, set a RegEx Message and RegEx Validation string specific to the template used to validate the value upon enrollment, and any error message to display if the entry does not match the regex A regular expression--RegEx--is a pattern used to validate data by ensuring it meets specific criteria. Several fields on the CSR enrollment, CSR generation, and PFX enrollment pages support RegEx validation, including certificate subject and metadata fields. definition. For more information, see Adding or Modifying a Metadata Field. This option appears for string type metadata fields.
   • If desired, toggle the Case-Sensitive Validation option to a different value than is set at the system or enrollment pattern level for this metadata field. This toggle only becomes active once the RegEx fields are populated. This option appears for string type metadata fields.
4. Click Save on the Metadata dialog to save changes for each metadata field.