How to configure AD enterprise CA template to generate cert that have both key agreement and key encipherment enabled?

Question

How to configure AD enterprise CA template to generate cert that have both key agreement and key encipherment enabled?

Key agreement and key encipherment is mutually exclusive in all the templates currently.

Using a window server 2022 server with version 10.0 of Certification Authority

Answer 1

Hi ahkenho,

Thank you for posting in the Microsoft Community Forums.

1. Open the Certificate Templates Console

First, you need to log in as an administrator to the server where AD CS (Active Directory Certificate Services) is installed and open the Certificate Templates Console. This can be done by running the certtmpl.msc command.

2. Selecting or creating a template

In the Certificate Templates console, you can select an existing template to modify, or create a completely new template. If you want to maintain the integrity of an existing template, it is recommended that you copy an existing template and modify it.

3. Editing Template Properties

After selecting a template, right-click on it and select “Properties” to edit the properties of the template. In the Properties dialog box, you need to focus on the following key settings:

Application Policy

Key Usage: Ensure that both “Key Encryption” and “Key Protocol” are checked. This allows certificates to be used for encrypting and decrypting data, as well as protocols such as TLS/SSL.

Extensions

Enhanced Key Usage (EKU): Add or confirm relevant EKUs such as “Client Authentication”, “Server Authentication”, etc. as needed.

Security

Publish to CA: Ensure that the template is set to publish to CA so that CA can issue certificates based on the template.

4. Configure other related settings

In addition to the above key settings, you also need to configure other related settings according to the actual needs, such as the certificate validity period, renewal period, certificate issuance requirements, and so on.

5. Save and apply the template

After finishing editing the template, save the changes and apply the template. This may take some time as the changes need to be recognized and applied by the AD CS service.

6. Verify the template configuration

Finally, verify that the template configuration is correct. You can try requesting a certificate based on this template and check that the certificate's attributes and uses are as expected.

Caution.

Before modifying a template, it is recommended that you back up the original template just in case.

The simultaneous enabling of key agreement and key encryption may be limited by specific application scenarios and security policies. Make sure that your configuration complies with your organization's security standards and best practices.

If you are not familiar with the configuration of certificate templates, it is recommended that you consult an IT professional with relevant experience or refer to Microsoft's official documentation and guidelines.

Best regards

Neuvi

Answer 2

The issue I have is that I need both the "Key agreement" and "Key encipherment" enabled. But the checkboxes for them is mutually exclusive. Please advise.