Partager via

Best Practice for Configuring Certificate Template Cryptography

  • Article

Starting with Windows Vista and Windows Server 2008, the option to utilize Key Storage Providers (KSPs) in addition to Cryptographic Service Providers (CSPs) was added. These options are available when you create a Certificate Template and configure the settings in the Cryptography tab. Depending on the template duplicated, you may see that the default option is Request can use any provider available on the subject’s computer. However, the best practice is to select Requests must use one of the following providers. Then, ensure you configure only the providers that you want to be used. Another best practice is to use a key size of 1024 bits or higher.

More about this topic is on the TechNet Wiki https://social.technet.microsoft.com/wiki/contents/articles/10192.a-certificate-could-not-be-created-a-private-key-could-not-be-created.aspx

Comments

  • Anonymous
    June 13, 2012
    What is the effect for XP/2003 machines or users on those machines that are using Auto-Enrollment when a template is configured for Microsoft Software Key Storage Provider?

  • Anonymous
    August 14, 2012
    @Paul KSPs aren't installed on Windows XP or 2003 (they are part of CNG, which is only available to Vista/2008+) As such, I expect the effect would be that auto-enrolment would not be possible (as the computer does not have the provider required to generate keys). Somebody who has tested this wish to confirm?

  • Anonymous
    September 07, 2014
    HELLO GOOD MORNING

  • Anonymous
    September 30, 2015
    Hello
    when I look at the above settings on my 2012 R2 CA, under Algorithm name is states 'Determined by the CPS' and I cannot select any other option. I assume this is because we are using an HSM device?

    Thanks
    Ernie