Configuring user certificate template with DSA-3072 key from AD Certificate Services

Question

Hi, I have been trying to create a custom user cert template with the DSA-3072 key.
I have tried using mmc - > Personal > Advanced Operations > Create custom request but there is only 2048 bits available for DSA. Even so, i couldn't create a DSA at the end as the request failed.
The error is this:
A certificate request could not be created.
The request is not supported. 0x0070032 (WIN32: ERROR_NOT_SUPPORTED)

Can somebody please help? Thanks in advance!

Answer 1

Hello @PKInoob88 ,

Thank you for posting here.

Based on the description, I understand you can not select DSA signature scheme during mmc - > Personal > Advanced Operations > Create custom request.

For example,

1.I duplicate a user certificate template named user8.

2.I select user8 template during mmc - > Personal > Advanced Operations > Create custom request.

3.I can select other key size below.

I can not check DSA,either. It displayed it is not suppoerted by checking "show all CSPs".

It seems DSA is not supported.

For more information above DSA signature scheme, we can refer to the link below.
Securing PKI: Planning Certificate Algorithms and Usages
https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/dn786428(v=ws.11)

Hope the information above is helpful.

Should you have any question or concern, please feel free to let us know.

Best Regards,
Daisy Zhou