Certificate Services: Custom template settings not applying to certificate.

jetmicll2020 21 Reputation points

The CA is running Server 2012R2. I've duplicated the Web Server template, changed the expiration to 5 years and enabled "Allow private key to be exported". Subject name is set to "Supply in the request".

46308-general.png 46391-exp.png 46326-subname.png

If I generate a CSR and sign it using this template, the expiration is in 2 years and I am unable to export the private key. Here you can see the template was used:

But if I open the cert, you can see the expiration is not correct and I'm unable to export private key.
46411-cert.png 46299-end.png

Windows Server Security
Windows Server Security
Windows Server: A family of Microsoft server operating systems that support enterprise-level management, data storage, applications, and communications.Security: The precautions taken to guard against crime, attack, sabotage, espionage, or another threat.
1,550 questions
{count} votes

Accepted answer
  1. Daisy Zhou 14,966 Reputation points Microsoft Vendor

    Hello @jetmicll2020 ,

    Thank you for posting here.

    Based on the description, we have two questions.

    For the first question, we can see the expiration is not correct.

    Based on my knowledge, the issued certificate validity period depends upon least value of below.
    (1)The remaining lifetime of the root CA server
    (2)The value specified in the certificate template
    (3)The value specified in the CA server registry (default is 2 years)

    Maybe the validity period of your cert takes the value of ValidityPeriodUnits in registry, so we can check the three values.

    For the second question, the private key can not be expoted.
    We need to check the the option "Allow private key to be exported" in the certificate template and check the option "Make the private key exportable" during generating CSR file as below.

    At last, we can follow the steps in the similar case to enroll a certificate.
    Unable to sign CSR with Microsoft Windows CA

    Hope the information above is helpful. If anything is unclear, please feel free to let us know.

    Best Regards,
    Daisy Zhou

0 additional answers

Sort by: Most helpful