Skip to content
AWS for Query.Farm

aws.pca_connector_ad.get_template

Example SQL Queries

SELECT * FROM
aws.pca_connector_ad.get_template
WHERE
"template_arn" = 'VALUE';

Description

Retrieves a certificate template that the connector uses to issue certificates from a private CA.

Table Definition

Column NameColumn Data Type
template_arn Required Input Column

The Amazon Resource Name (ARN) that was returned when you called CreateTemplate.

VARCHAR
_aws_profile Input Column

The AWS profile defines the AWS identity used. It can be defined via credentials or by assuming a IAM role.

STRUCT(
    "type" VARCHAR,
    "name" VARCHAR,
    "account_id" VARCHAR,
    "via_profile_name" VARCHAR,
    "assumed_role_arn" VARCHAR,
    "organization" STRUCT(
        "account_name" VARCHAR,
        "id" VARCHAR,
        "tags" STRUCT(
            "key" VARCHAR,
            "value" VARCHAR
        )[],
        "master_account" STRUCT(
            "id" VARCHAR,
            "email" VARCHAR
        ),
        "parents" STRUCT(
            "type" VARCHAR,
            "id" VARCHAR,
            "name" VARCHAR,
            "tags" STRUCT(
                "key" VARCHAR,
                "value" VARCHAR
            )[]
        )[]
    )
)
Show child fields
_aws_profile.account_id

The AWS account id

_aws_profile.assumed_role_arn

The ARN of the assumed role

_aws_profile.name

The unique name of the profile.

_aws_profile.organization

Information about this profile's membership in the AWS organization.

Show child fields
_aws_profile.organization.account_name

The name of account speciifed by the organization

_aws_profile.organization.id

The organization id

_aws_profile.organization.master_account
Show child fields
_aws_profile.organization.master_account.email

The organization master account email address

_aws_profile.organization.master_account.id

The organization master account id

_aws_profile.organization.parents[]
Show child fields
_aws_profile.organization.parents[].id

The id of the parent

_aws_profile.organization.parents[].name

The name of the parent

_aws_profile.organization.parents[].tags[]
Show child fields
_aws_profile.organization.parents[].tags[].key
_aws_profile.organization.parents[].tags[].value
_aws_profile.organization.parents[].type

The type of parent can be an organization unit or a root

_aws_profile.organization.tags[]
Show child fields
_aws_profile.organization.tags[].key
_aws_profile.organization.tags[].value
_aws_profile.type

The type of profile, either 'credentials' or 'assumed_role'

_aws_profile.via_profile_name

This IAM role for this profile is assumed by first utilizing another profile with this name to obtain credentials.

template

A certificate template that the connector uses to issue certificates from a private CA.

STRUCT(
    "arn" VARCHAR,
    "connector_arn" VARCHAR,
    "created_at" TIMESTAMP_S,
    "definition" STRUCT(
        "template_v2" STRUCT(
            "certificate_validity" STRUCT(
                "renewal_period" STRUCT(
                    "period" BIGINT,
                    "period_type" VARCHAR
                ),
                "validity_period" STRUCT(
                    "period" BIGINT,
                    "period_type" VARCHAR
                )
            ),
            "enrollment_flags" STRUCT(
                "enable_key_reuse_on_nt_token_keyset_storage_full" BOOLEAN,
                "include_symmetric_algorithms" BOOLEAN,
                "no_security_extension" BOOLEAN,
                "remove_invalid_certificate_from_personal_store" BOOLEAN,
                "user_interaction_required" BOOLEAN
            ),
            "extensions" STRUCT(
                "application_policies" STRUCT(
                    "critical" BOOLEAN,
                    "policies" STRUCT(
                        "policy_object_identifier" VARCHAR,
                        "policy_type" VARCHAR
                    )[]
                ),
                "key_usage" STRUCT(
                    "critical" BOOLEAN,
                    "usage_flags" STRUCT(
                        "data_encipherment" BOOLEAN,
                        "digital_signature" BOOLEAN,
                        "key_agreement" BOOLEAN,
                        "key_encipherment" BOOLEAN,
                        "non_repudiation" BOOLEAN
                    )
                )
            ),
            "general_flags" STRUCT(
                "auto_enrollment" BOOLEAN,
                "machine_type" BOOLEAN
            ),
            "private_key_attributes" STRUCT(
                "crypto_providers" VARCHAR[],
                "key_spec" VARCHAR,
                "minimal_key_length" BIGINT
            ),
            "private_key_flags" STRUCT(
                "client_version" VARCHAR,
                "exportable_key" BOOLEAN,
                "strong_key_protection_required" BOOLEAN
            ),
            "subject_name_flags" STRUCT(
                "require_common_name" BOOLEAN,
                "require_directory_path" BOOLEAN,
                "require_dns_as_cn" BOOLEAN,
                "require_email" BOOLEAN,
                "san_require_directory_guid" BOOLEAN,
                "san_require_dns" BOOLEAN,
                "san_require_domain_dns" BOOLEAN,
                "san_require_email" BOOLEAN,
                "san_require_spn" BOOLEAN,
                "san_require_upn" BOOLEAN
            ),
            "superseded_templates" VARCHAR[]
        ),
        "template_v3" STRUCT(
            "certificate_validity" STRUCT(
                "renewal_period" STRUCT(
                    "period" BIGINT,
                    "period_type" VARCHAR
                ),
                "validity_period" STRUCT(
                    "period" BIGINT,
                    "period_type" VARCHAR
                )
            ),
            "enrollment_flags" STRUCT(
                "enable_key_reuse_on_nt_token_keyset_storage_full" BOOLEAN,
                "include_symmetric_algorithms" BOOLEAN,
                "no_security_extension" BOOLEAN,
                "remove_invalid_certificate_from_personal_store" BOOLEAN,
                "user_interaction_required" BOOLEAN
            ),
            "extensions" STRUCT(
                "application_policies" STRUCT(
                    "critical" BOOLEAN,
                    "policies" STRUCT(
                        "policy_object_identifier" VARCHAR,
                        "policy_type" VARCHAR
                    )[]
                ),
                "key_usage" STRUCT(
                    "critical" BOOLEAN,
                    "usage_flags" STRUCT(
                        "data_encipherment" BOOLEAN,
                        "digital_signature" BOOLEAN,
                        "key_agreement" BOOLEAN,
                        "key_encipherment" BOOLEAN,
                        "non_repudiation" BOOLEAN
                    )
                )
            ),
            "general_flags" STRUCT(
                "auto_enrollment" BOOLEAN,
                "machine_type" BOOLEAN
            ),
            "hash_algorithm" VARCHAR,
            "private_key_attributes" STRUCT(
                "algorithm" VARCHAR,
                "crypto_providers" VARCHAR[],
                "key_spec" VARCHAR,
                "key_usage_property" STRUCT(
                    "property_flags" STRUCT(
                        "decrypt" BOOLEAN,
                        "key_agreement" BOOLEAN,
                        "sign" BOOLEAN
                    ),
                    "property_type" VARCHAR
                ),
                "minimal_key_length" BIGINT
            ),
            "private_key_flags" STRUCT(
                "client_version" VARCHAR,
                "exportable_key" BOOLEAN,
                "require_alternate_signature_algorithm" BOOLEAN,
                "strong_key_protection_required" BOOLEAN
            ),
            "subject_name_flags" STRUCT(
                "require_common_name" BOOLEAN,
                "require_directory_path" BOOLEAN,
                "require_dns_as_cn" BOOLEAN,
                "require_email" BOOLEAN,
                "san_require_directory_guid" BOOLEAN,
                "san_require_dns" BOOLEAN,
                "san_require_domain_dns" BOOLEAN,
                "san_require_email" BOOLEAN,
                "san_require_spn" BOOLEAN,
                "san_require_upn" BOOLEAN
            ),
            "superseded_templates" VARCHAR[]
        ),
        "template_v4" STRUCT(
            "certificate_validity" STRUCT(
                "renewal_period" STRUCT(
                    "period" BIGINT,
                    "period_type" VARCHAR
                ),
                "validity_period" STRUCT(
                    "period" BIGINT,
                    "period_type" VARCHAR
                )
            ),
            "enrollment_flags" STRUCT(
                "enable_key_reuse_on_nt_token_keyset_storage_full" BOOLEAN,
                "include_symmetric_algorithms" BOOLEAN,
                "no_security_extension" BOOLEAN,
                "remove_invalid_certificate_from_personal_store" BOOLEAN,
                "user_interaction_required" BOOLEAN
            ),
            "extensions" STRUCT(
                "application_policies" STRUCT(
                    "critical" BOOLEAN,
                    "policies" STRUCT(
                        "policy_object_identifier" VARCHAR,
                        "policy_type" VARCHAR
                    )[]
                ),
                "key_usage" STRUCT(
                    "critical" BOOLEAN,
                    "usage_flags" STRUCT(
                        "data_encipherment" BOOLEAN,
                        "digital_signature" BOOLEAN,
                        "key_agreement" BOOLEAN,
                        "key_encipherment" BOOLEAN,
                        "non_repudiation" BOOLEAN
                    )
                )
            ),
            "general_flags" STRUCT(
                "auto_enrollment" BOOLEAN,
                "machine_type" BOOLEAN
            ),
            "hash_algorithm" VARCHAR,
            "private_key_attributes" STRUCT(
                "algorithm" VARCHAR,
                "crypto_providers" VARCHAR[],
                "key_spec" VARCHAR,
                "key_usage_property" STRUCT(
                    "property_flags" STRUCT(
                        "decrypt" BOOLEAN,
                        "key_agreement" BOOLEAN,
                        "sign" BOOLEAN
                    ),
                    "property_type" VARCHAR
                ),
                "minimal_key_length" BIGINT
            ),
            "private_key_flags" STRUCT(
                "client_version" VARCHAR,
                "exportable_key" BOOLEAN,
                "require_alternate_signature_algorithm" BOOLEAN,
                "require_same_key_renewal" BOOLEAN,
                "strong_key_protection_required" BOOLEAN,
                "use_legacy_provider" BOOLEAN
            ),
            "subject_name_flags" STRUCT(
                "require_common_name" BOOLEAN,
                "require_directory_path" BOOLEAN,
                "require_dns_as_cn" BOOLEAN,
                "require_email" BOOLEAN,
                "san_require_directory_guid" BOOLEAN,
                "san_require_dns" BOOLEAN,
                "san_require_domain_dns" BOOLEAN,
                "san_require_email" BOOLEAN,
                "san_require_spn" BOOLEAN,
                "san_require_upn" BOOLEAN
            ),
            "superseded_templates" VARCHAR[]
        )
    ),
    "name" VARCHAR,
    "object_identifier" VARCHAR,
    "policy_schema" BIGINT,
    "revision" STRUCT(
        "major_revision" BIGINT,
        "minor_revision" BIGINT
    ),
    "status" VARCHAR,
    "updated_at" TIMESTAMP_S
)
Show child fields
template.arn

The Amazon Resource Name (ARN) that was returned when you called CreateTemplate.

template.connector_arn

The Amazon Resource Name (ARN) that was returned when you called CreateConnector.

template.created_at

The date and time that the template was created.

template.definition

Template configuration to define the information included in certificates. Define certificate validity and renewal periods, certificate request handling and enrollment options, key usage extensions, application policies, and cryptography settings.

Show child fields
template.definition.template_v2

Template configuration to define the information included in certificates. Define certificate validity and renewal periods, certificate request handling and enrollment options, key usage extensions, application policies, and cryptography settings.

Show child fields
template.definition.template_v2.certificate_validity

Certificate validity describes the validity and renewal periods of a certificate.

Show child fields
template.definition.template_v2.certificate_validity.renewal_period

Renewal period is the period of time before certificate expiration when a new certificate will be requested.

Show child fields
template.definition.template_v2.certificate_validity.renewal_period.period

The numeric value for the validity period.

template.definition.template_v2.certificate_validity.renewal_period.period_type

The unit of time. You can select hours, days, weeks, months, and years.

template.definition.template_v2.certificate_validity.validity_period

Information describing the end of the validity period of the certificate. This parameter sets the “Not After” date for the certificate. Certificate validity is the period of time during which a certificate is valid. Validity can be expressed as an explicit date and time when the certificate expires, or as a span of time after issuance, stated in days, months, or years. For more information, see Validity in RFC 5280. This value is unaffected when ValidityNotBefore is also specified. For example, if Validity is set to 20 days in the future, the certificate will expire 20 days from issuance time regardless of the ValidityNotBefore value.

Show child fields
template.definition.template_v2.certificate_validity.validity_period.period

The numeric value for the validity period.

template.definition.template_v2.certificate_validity.validity_period.period_type

The unit of time. You can select hours, days, weeks, months, and years.

template.definition.template_v2.enrollment_flags

Enrollment flags describe the enrollment settings for certificates such as using the existing private key and deleting expired or revoked certificates.

Show child fields
template.definition.template_v2.enrollment_flags.enable_key_reuse_on_nt_token_keyset_storage_full

Allow renewal using the same key.

template.definition.template_v2.enrollment_flags.include_symmetric_algorithms

Include symmetric algorithms allowed by the subject.

template.definition.template_v2.enrollment_flags.no_security_extension

This flag instructs the CA to not include the security extension szOID_NTDS_CA_SECURITY_EXT (OID:1.3.6.1.4.1.311.25.2), as specified in [MS-WCCE] sections 2.2.2.7.7.4 and 3.2.2.6.2.1.4.5.9, in the issued certificate. This addresses a Windows Kerberos elevation-of-privilege vulnerability.

template.definition.template_v2.enrollment_flags.remove_invalid_certificate_from_personal_store

Delete expired or revoked certificates instead of archiving them.

template.definition.template_v2.enrollment_flags.user_interaction_required

Require user interaction when the subject is enrolled and the private key associated with the certificate is used.

template.definition.template_v2.extensions

Extensions describe the key usage extensions and application policies for a template.

Show child fields
template.definition.template_v2.extensions.application_policies

Application policies specify what the certificate is used for and its purpose.

Show child fields
template.definition.template_v2.extensions.application_policies.critical

Marks the application policy extension as critical.

template.definition.template_v2.extensions.application_policies.policies[]
Show child fields
template.definition.template_v2.extensions.application_policies.policies[].policy_object_identifier

The object identifier (OID) of an application policy.

template.definition.template_v2.extensions.application_policies.policies[].policy_type

The type of application policy

template.definition.template_v2.extensions.key_usage

The key usage extension defines the purpose (e.g., encipherment, signature, certificate signing) of the key contained in the certificate.

Show child fields
template.definition.template_v2.extensions.key_usage.critical

Sets the key usage extension to critical.

template.definition.template_v2.extensions.key_usage.usage_flags

The key usage flags represent the purpose (e.g., encipherment, signature) of the key contained in the certificate.

Show child fields
template.definition.template_v2.extensions.key_usage.usage_flags.data_encipherment

DataEncipherment is asserted when the subject public key is used for directly enciphering raw user data without the use of an intermediate symmetric cipher.

template.definition.template_v2.extensions.key_usage.usage_flags.digital_signature

The digitalSignature is asserted when the subject public key is used for verifying digital signatures.

template.definition.template_v2.extensions.key_usage.usage_flags.key_agreement

KeyAgreement is asserted when the subject public key is used for key agreement.

template.definition.template_v2.extensions.key_usage.usage_flags.key_encipherment

KeyEncipherment is asserted when the subject public key is used for enciphering private or secret keys, i.e., for key transport.

template.definition.template_v2.extensions.key_usage.usage_flags.non_repudiation

NonRepudiation is asserted when the subject public key is used to verify digital signatures.

template.definition.template_v2.general_flags

General flags describe whether the template is used for computers or users and if the template can be used with autoenrollment.

Show child fields
template.definition.template_v2.general_flags.auto_enrollment

Allows certificate issuance using autoenrollment. Set to TRUE to allow autoenrollment.

template.definition.template_v2.general_flags.machine_type

Defines if the template is for machines or users. Set to TRUE if the template is for machines. Set to FALSE if the template is for users.

template.definition.template_v2.private_key_attributes

Private key attributes allow you to specify the minimal key length, key spec, and cryptographic providers for the private key of a certificate for v2 templates. V2 templates allow you to use Legacy Cryptographic Service Providers.

Show child fields
template.definition.template_v2.private_key_attributes.crypto_providers[]
template.definition.template_v2.private_key_attributes.key_spec

Defines the purpose of the private key. Set it to "KEY_EXCHANGE" or "SIGNATURE" value.

template.definition.template_v2.private_key_attributes.minimal_key_length

Set the minimum key length of the private key.

template.definition.template_v2.private_key_flags

Private key flags for v2 templates specify the client compatibility, if the private key can be exported, and if user input is required when using a private key.

Show child fields
template.definition.template_v2.private_key_flags.client_version

Defines the minimum client compatibility.

template.definition.template_v2.private_key_flags.exportable_key

Allows the private key to be exported.

template.definition.template_v2.private_key_flags.strong_key_protection_required

Require user input when using the private key for enrollment.

template.definition.template_v2.subject_name_flags

Subject name flags describe the subject name and subject alternate name that is included in a certificate.

Show child fields
template.definition.template_v2.subject_name_flags.require_common_name

Include the common name in the subject name.

template.definition.template_v2.subject_name_flags.require_directory_path

Include the directory path in the subject name.

template.definition.template_v2.subject_name_flags.require_dns_as_cn

Include the DNS as common name in the subject name.

template.definition.template_v2.subject_name_flags.require_email

Include the subject's email in the subject name.

template.definition.template_v2.subject_name_flags.san_require_directory_guid

Include the globally unique identifier (GUID) in the subject alternate name.

template.definition.template_v2.subject_name_flags.san_require_dns

Include the DNS in the subject alternate name.

template.definition.template_v2.subject_name_flags.san_require_domain_dns

Include the domain DNS in the subject alternate name.

template.definition.template_v2.subject_name_flags.san_require_email

Include the subject's email in the subject alternate name.

template.definition.template_v2.subject_name_flags.san_require_spn

Include the service principal name (SPN) in the subject alternate name.

template.definition.template_v2.subject_name_flags.san_require_upn

Include the user principal name (UPN) in the subject alternate name.

template.definition.template_v2.superseded_templates[]
template.definition.template_v3

Template configuration to define the information included in certificates. Define certificate validity and renewal periods, certificate request handling and enrollment options, key usage extensions, application policies, and cryptography settings.

Show child fields
template.definition.template_v3.certificate_validity

Certificate validity describes the validity and renewal periods of a certificate.

Show child fields
template.definition.template_v3.certificate_validity.renewal_period

Renewal period is the period of time before certificate expiration when a new certificate will be requested.

Show child fields
template.definition.template_v3.certificate_validity.renewal_period.period

The numeric value for the validity period.

template.definition.template_v3.certificate_validity.renewal_period.period_type

The unit of time. You can select hours, days, weeks, months, and years.

template.definition.template_v3.certificate_validity.validity_period

Information describing the end of the validity period of the certificate. This parameter sets the “Not After” date for the certificate. Certificate validity is the period of time during which a certificate is valid. Validity can be expressed as an explicit date and time when the certificate expires, or as a span of time after issuance, stated in days, months, or years. For more information, see Validity in RFC 5280. This value is unaffected when ValidityNotBefore is also specified. For example, if Validity is set to 20 days in the future, the certificate will expire 20 days from issuance time regardless of the ValidityNotBefore value.

Show child fields
template.definition.template_v3.certificate_validity.validity_period.period

The numeric value for the validity period.

template.definition.template_v3.certificate_validity.validity_period.period_type

The unit of time. You can select hours, days, weeks, months, and years.

template.definition.template_v3.enrollment_flags

Enrollment flags describe the enrollment settings for certificates such as using the existing private key and deleting expired or revoked certificates.

Show child fields
template.definition.template_v3.enrollment_flags.enable_key_reuse_on_nt_token_keyset_storage_full

Allow renewal using the same key.

template.definition.template_v3.enrollment_flags.include_symmetric_algorithms

Include symmetric algorithms allowed by the subject.

template.definition.template_v3.enrollment_flags.no_security_extension

This flag instructs the CA to not include the security extension szOID_NTDS_CA_SECURITY_EXT (OID:1.3.6.1.4.1.311.25.2), as specified in [MS-WCCE] sections 2.2.2.7.7.4 and 3.2.2.6.2.1.4.5.9, in the issued certificate. This addresses a Windows Kerberos elevation-of-privilege vulnerability.

template.definition.template_v3.enrollment_flags.remove_invalid_certificate_from_personal_store

Delete expired or revoked certificates instead of archiving them.

template.definition.template_v3.enrollment_flags.user_interaction_required

Require user interaction when the subject is enrolled and the private key associated with the certificate is used.

template.definition.template_v3.extensions

Extensions describe the key usage extensions and application policies for a template.

Show child fields
template.definition.template_v3.extensions.application_policies

Application policies specify what the certificate is used for and its purpose.

Show child fields
template.definition.template_v3.extensions.application_policies.critical

Marks the application policy extension as critical.

template.definition.template_v3.extensions.application_policies.policies[]
Show child fields
template.definition.template_v3.extensions.application_policies.policies[].policy_object_identifier

The object identifier (OID) of an application policy.

template.definition.template_v3.extensions.application_policies.policies[].policy_type

The type of application policy

template.definition.template_v3.extensions.key_usage

The key usage extension defines the purpose (e.g., encipherment, signature, certificate signing) of the key contained in the certificate.

Show child fields
template.definition.template_v3.extensions.key_usage.critical

Sets the key usage extension to critical.

template.definition.template_v3.extensions.key_usage.usage_flags

The key usage flags represent the purpose (e.g., encipherment, signature) of the key contained in the certificate.

Show child fields
template.definition.template_v3.extensions.key_usage.usage_flags.data_encipherment

DataEncipherment is asserted when the subject public key is used for directly enciphering raw user data without the use of an intermediate symmetric cipher.

template.definition.template_v3.extensions.key_usage.usage_flags.digital_signature

The digitalSignature is asserted when the subject public key is used for verifying digital signatures.

template.definition.template_v3.extensions.key_usage.usage_flags.key_agreement

KeyAgreement is asserted when the subject public key is used for key agreement.

template.definition.template_v3.extensions.key_usage.usage_flags.key_encipherment

KeyEncipherment is asserted when the subject public key is used for enciphering private or secret keys, i.e., for key transport.

template.definition.template_v3.extensions.key_usage.usage_flags.non_repudiation

NonRepudiation is asserted when the subject public key is used to verify digital signatures.

template.definition.template_v3.general_flags

General flags describe whether the template is used for computers or users and if the template can be used with autoenrollment.

Show child fields
template.definition.template_v3.general_flags.auto_enrollment

Allows certificate issuance using autoenrollment. Set to TRUE to allow autoenrollment.

template.definition.template_v3.general_flags.machine_type

Defines if the template is for machines or users. Set to TRUE if the template is for machines. Set to FALSE if the template is for users

template.definition.template_v3.hash_algorithm

Specifies the hash algorithm used to hash the private key.

template.definition.template_v3.private_key_attributes

Private key attributes allow you to specify the algorithm, minimal key length, key spec, key usage, and cryptographic providers for the private key of a certificate for v3 templates. V3 templates allow you to use Key Storage Providers.

Show child fields
template.definition.template_v3.private_key_attributes.algorithm

Defines the algorithm used to generate the private key.

template.definition.template_v3.private_key_attributes.crypto_providers[]
template.definition.template_v3.private_key_attributes.key_spec

Defines the purpose of the private key. Set it to "KEY_EXCHANGE" or "SIGNATURE" value.

template.definition.template_v3.private_key_attributes.key_usage_property

The key usage property defines the purpose of the private key contained in the certificate. You can specify specific purposes using property flags or all by using property type ALL.

Show child fields
template.definition.template_v3.private_key_attributes.key_usage_property.property_flags

You can specify key usage for encryption, key agreement, and signature. You can use property flags or property type but not both.

Show child fields
template.definition.template_v3.private_key_attributes.key_usage_property.property_flags.decrypt

Allows key for encryption and decryption.

template.definition.template_v3.private_key_attributes.key_usage_property.property_flags.key_agreement

Allows key exchange without encryption.

template.definition.template_v3.private_key_attributes.key_usage_property.property_flags.sign

Allow key use for digital signature.

template.definition.template_v3.private_key_attributes.key_usage_property.property_type

You can specify all key usages using property type ALL. You can use property type or property flags but not both.

template.definition.template_v3.private_key_attributes.minimal_key_length

Set the minimum key length of the private key.

template.definition.template_v3.private_key_flags

Private key flags for v3 templates specify the client compatibility, if the private key can be exported, if user input is required when using a private key, and if an alternate signature algorithm should be used.

Show child fields
template.definition.template_v3.private_key_flags.client_version

Defines the minimum client compatibility.

template.definition.template_v3.private_key_flags.exportable_key

Allows the private key to be exported.

template.definition.template_v3.private_key_flags.require_alternate_signature_algorithm

Reguires the PKCS #1 v2.1 signature format for certificates. You should verify that your CA, objects, and applications can accept this signature format.

template.definition.template_v3.private_key_flags.strong_key_protection_required

Requirer user input when using the private key for enrollment.

template.definition.template_v3.subject_name_flags

Subject name flags describe the subject name and subject alternate name that is included in a certificate.

Show child fields
template.definition.template_v3.subject_name_flags.require_common_name

Include the common name in the subject name.

template.definition.template_v3.subject_name_flags.require_directory_path

Include the directory path in the subject name.

template.definition.template_v3.subject_name_flags.require_dns_as_cn

Include the DNS as common name in the subject name.

template.definition.template_v3.subject_name_flags.require_email

Include the subject's email in the subject name.

template.definition.template_v3.subject_name_flags.san_require_directory_guid

Include the globally unique identifier (GUID) in the subject alternate name.

template.definition.template_v3.subject_name_flags.san_require_dns

Include the DNS in the subject alternate name.

template.definition.template_v3.subject_name_flags.san_require_domain_dns

Include the domain DNS in the subject alternate name.

template.definition.template_v3.subject_name_flags.san_require_email

Include the subject's email in the subject alternate name.

template.definition.template_v3.subject_name_flags.san_require_spn

Include the service principal name (SPN) in the subject alternate name.

template.definition.template_v3.subject_name_flags.san_require_upn

Include the user principal name (UPN) in the subject alternate name.

template.definition.template_v3.superseded_templates[]
template.definition.template_v4

Template configuration to define the information included in certificates. Define certificate validity and renewal periods, certificate request handling and enrollment options, key usage extensions, application policies, and cryptography settings.

Show child fields
template.definition.template_v4.certificate_validity

Certificate validity describes the validity and renewal periods of a certificate.

Show child fields
template.definition.template_v4.certificate_validity.renewal_period

Renewal period is the period of time before certificate expiration when a new certificate will be requested.

Show child fields
template.definition.template_v4.certificate_validity.renewal_period.period

The numeric value for the validity period.

template.definition.template_v4.certificate_validity.renewal_period.period_type

The unit of time. You can select hours, days, weeks, months, and years.

template.definition.template_v4.certificate_validity.validity_period

Information describing the end of the validity period of the certificate. This parameter sets the “Not After” date for the certificate. Certificate validity is the period of time during which a certificate is valid. Validity can be expressed as an explicit date and time when the certificate expires, or as a span of time after issuance, stated in days, months, or years. For more information, see Validity in RFC 5280. This value is unaffected when ValidityNotBefore is also specified. For example, if Validity is set to 20 days in the future, the certificate will expire 20 days from issuance time regardless of the ValidityNotBefore value.

Show child fields
template.definition.template_v4.certificate_validity.validity_period.period

The numeric value for the validity period.

template.definition.template_v4.certificate_validity.validity_period.period_type

The unit of time. You can select hours, days, weeks, months, and years.

template.definition.template_v4.enrollment_flags

Enrollment flags describe the enrollment settings for certificates using the existing private key and deleting expired or revoked certificates.

Show child fields
template.definition.template_v4.enrollment_flags.enable_key_reuse_on_nt_token_keyset_storage_full

Allow renewal using the same key.

template.definition.template_v4.enrollment_flags.include_symmetric_algorithms

Include symmetric algorithms allowed by the subject.

template.definition.template_v4.enrollment_flags.no_security_extension

This flag instructs the CA to not include the security extension szOID_NTDS_CA_SECURITY_EXT (OID:1.3.6.1.4.1.311.25.2), as specified in [MS-WCCE] sections 2.2.2.7.7.4 and 3.2.2.6.2.1.4.5.9, in the issued certificate. This addresses a Windows Kerberos elevation-of-privilege vulnerability.

template.definition.template_v4.enrollment_flags.remove_invalid_certificate_from_personal_store

Delete expired or revoked certificates instead of archiving them.

template.definition.template_v4.enrollment_flags.user_interaction_required

Require user interaction when the subject is enrolled and the private key associated with the certificate is used.

template.definition.template_v4.extensions

Extensions describe the key usage extensions and application policies for a template.

Show child fields
template.definition.template_v4.extensions.application_policies

Application policies specify what the certificate is used for and its purpose.

Show child fields
template.definition.template_v4.extensions.application_policies.critical

Marks the application policy extension as critical.

template.definition.template_v4.extensions.application_policies.policies[]
Show child fields
template.definition.template_v4.extensions.application_policies.policies[].policy_object_identifier

The object identifier (OID) of an application policy.

template.definition.template_v4.extensions.application_policies.policies[].policy_type

The type of application policy

template.definition.template_v4.extensions.key_usage

The key usage extension defines the purpose (e.g., encipherment, signature) of the key contained in the certificate.

Show child fields
template.definition.template_v4.extensions.key_usage.critical

Sets the key usage extension to critical.

template.definition.template_v4.extensions.key_usage.usage_flags

The key usage flags represent the purpose (e.g., encipherment, signature) of the key contained in the certificate.

Show child fields
template.definition.template_v4.extensions.key_usage.usage_flags.data_encipherment

DataEncipherment is asserted when the subject public key is used for directly enciphering raw user data without the use of an intermediate symmetric cipher.

template.definition.template_v4.extensions.key_usage.usage_flags.digital_signature

The digitalSignature is asserted when the subject public key is used for verifying digital signatures.

template.definition.template_v4.extensions.key_usage.usage_flags.key_agreement

KeyAgreement is asserted when the subject public key is used for key agreement.

template.definition.template_v4.extensions.key_usage.usage_flags.key_encipherment

KeyEncipherment is asserted when the subject public key is used for enciphering private or secret keys, i.e., for key transport.

template.definition.template_v4.extensions.key_usage.usage_flags.non_repudiation

NonRepudiation is asserted when the subject public key is used to verify digital signatures.

template.definition.template_v4.general_flags

General flags describe whether the template is used for computers or users and if the template can be used with autoenrollment.

Show child fields
template.definition.template_v4.general_flags.auto_enrollment

Allows certificate issuance using autoenrollment. Set to TRUE to allow autoenrollment.

template.definition.template_v4.general_flags.machine_type

Defines if the template is for machines or users. Set to TRUE if the template is for machines. Set to FALSE if the template is for users

template.definition.template_v4.hash_algorithm

Specifies the hash algorithm used to hash the private key. Hash algorithm can only be specified when using Key Storage Providers.

template.definition.template_v4.private_key_attributes

Private key attributes allow you to specify the minimal key length, key spec, key usage, and cryptographic providers for the private key of a certificate for v4 templates. V4 templates allow you to use either Key Storage Providers or Legacy Cryptographic Service Providers. You specify the cryptography provider category in private key flags.

Show child fields
template.definition.template_v4.private_key_attributes.algorithm

Defines the algorithm used to generate the private key.

template.definition.template_v4.private_key_attributes.crypto_providers[]
template.definition.template_v4.private_key_attributes.key_spec

Defines the purpose of the private key. Set it to "KEY_EXCHANGE" or "SIGNATURE" value.

template.definition.template_v4.private_key_attributes.key_usage_property

The key usage property defines the purpose of the private key contained in the certificate. You can specify specific purposes using property flags or all by using property type ALL.

Show child fields
template.definition.template_v4.private_key_attributes.key_usage_property.property_flags

You can specify key usage for encryption, key agreement, and signature. You can use property flags or property type but not both.

Show child fields
template.definition.template_v4.private_key_attributes.key_usage_property.property_flags.decrypt

Allows key for encryption and decryption.

template.definition.template_v4.private_key_attributes.key_usage_property.property_flags.key_agreement

Allows key exchange without encryption.

template.definition.template_v4.private_key_attributes.key_usage_property.property_flags.sign

Allow key use for digital signature.

template.definition.template_v4.private_key_attributes.key_usage_property.property_type

You can specify all key usages using property type ALL. You can use property type or property flags but not both.

template.definition.template_v4.private_key_attributes.minimal_key_length

Set the minimum key length of the private key.

template.definition.template_v4.private_key_flags

Private key flags for v4 templates specify the client compatibility, if the private key can be exported, if user input is required when using a private key, if an alternate signature algorithm should be used, and if certificates are renewed using the same private key.

Show child fields
template.definition.template_v4.private_key_flags.client_version

Defines the minimum client compatibility.

template.definition.template_v4.private_key_flags.exportable_key

Allows the private key to be exported.

template.definition.template_v4.private_key_flags.require_alternate_signature_algorithm

Requires the PKCS #1 v2.1 signature format for certificates. You should verify that your CA, objects, and applications can accept this signature format.

template.definition.template_v4.private_key_flags.require_same_key_renewal

Renew certificate using the same private key.

template.definition.template_v4.private_key_flags.strong_key_protection_required

Require user input when using the private key for enrollment.

template.definition.template_v4.private_key_flags.use_legacy_provider

Specifies the cryptographic service provider category used to generate private keys. Set to TRUE to use Legacy Cryptographic Service Providers and FALSE to use Key Storage Providers.

template.definition.template_v4.subject_name_flags

Subject name flags describe the subject name and subject alternate name that is included in a certificate.

Show child fields
template.definition.template_v4.subject_name_flags.require_common_name

Include the common name in the subject name.

template.definition.template_v4.subject_name_flags.require_directory_path

Include the directory path in the subject name.

template.definition.template_v4.subject_name_flags.require_dns_as_cn

Include the DNS as common name in the subject name.

template.definition.template_v4.subject_name_flags.require_email

Include the subject's email in the subject name.

template.definition.template_v4.subject_name_flags.san_require_directory_guid

Include the globally unique identifier (GUID) in the subject alternate name.

template.definition.template_v4.subject_name_flags.san_require_dns

Include the DNS in the subject alternate name.

template.definition.template_v4.subject_name_flags.san_require_domain_dns

Include the domain DNS in the subject alternate name.

template.definition.template_v4.subject_name_flags.san_require_email

Include the subject's email in the subject alternate name.

template.definition.template_v4.subject_name_flags.san_require_spn

Include the service principal name (SPN) in the subject alternate name.

template.definition.template_v4.subject_name_flags.san_require_upn

Include the user principal name (UPN) in the subject alternate name.

template.definition.template_v4.superseded_templates[]
template.name

Name of the templates. Template names must be unique.

template.object_identifier

Object identifier of a template.

template.policy_schema

The template schema version. Template schema versions can be v2, v3, or v4. The template configuration options change based on the template schema version.

template.revision

The version of the template. Template updates will increment the minor revision. Re-enrolling all certificate holders will increment the major revision.

Show child fields
template.revision.major_revision

The revision version of the template. Re-enrolling all certificate holders will increment the major revision.

template.revision.minor_revision

The revision version of the template. Re-enrolling all certificate holders will increment the major revision.

template.status

Status of the template. Status can be creating, active, deleting, or failed.

template.updated_at

The date and time that the template was updated.