Version 2 Certificate Templates

Duplicate an existing template to create new templates. To duplicate a template, right-click it, then select All Tasks, Duplicate Template from the context menu. This ability provides an interesting workaround when you want to modify the properties of a Version 1 template: Simply duplicate the Version 1 template, save the duplicate as a Version 2 template, then modify the template.

Modify certificate-template properties. Unlike the Win2K PKI, the .NET Server PKI lets you customize certificate properties (e.g., certificate lifetime, renewal period) and extensions. You can use Version 2 certificate templates to set certificate-enrollment requirements, to control the certificate-signing process, to configure private key archiving, and to designate a specific Cryptographic Service Provider (CSP).

Define which accounts can enroll and autoenroll for a particular certificate template. To define the accounts that can enroll or autoenroll, right-click a Version 2 template, open its Properties dialog box, go to the Security tab, then modify the account's Enroll or AutoEnroll access control entry (ACE) in the template's ACL.

Enable a template so that user and machine accounts can use it for autoenrollment. To enable a template for use in autoenrollment, right-click the template and select Allow AutoEnrollment from the context menu. You can see a template's autoenrollment status in the snap-in's Autoenrollment column, as Figure A shows. You also can force autoenrollment for a particular certificate template. To do so, right-click the template and select Re-enroll all certificate holders from the context menu.

Automatically replace certificates with a newer version that contains new certificate properties. To enable this feature, Microsoft provides each template with a Superseded Templates tab, which Figure B shows. This feature can be very powerful when combined with autoenrollment. An excellent example is the Directory Email Replication template, which supersedes the older Domain Controller template. Because autoenrollment is permitted for the Directory Email Replication template, all domain controllers (DCs) will automatically (i.e., without any user or administrator intervention) receive a new Directory Email Replication certificate.