Infrastructure & Operations

What Is Certificate Template (ADCS)?

A certificate template is the blueprint an Active Directory Certificate Services (ADCS) CA uses when issuing a certificate: it defines the subject format, key algorithm and size, validity period, extended key usages, and — critically — which users or computers are allowed to enroll. Templates are stored in Active Directory and shared by all enterprise CAs in the forest.

What a template controls

Each template fixes the security-relevant parameters of the certificates it produces: cryptography (RSA/ECC, minimum key size, hash algorithm), validity and renewal period, how the subject is built (from AD or supplied in the request), extended key usages such as Server Authentication or Client Authentication, whether the private key is exportable, and the enrollment permissions granted to security groups.

Templates are the #1 ADCS attack surface

The ESC1–ESC16 attack family (from the "Certified Pre-Owned" research) is almost entirely template misconfiguration: templates that let the requester supply an arbitrary subject (ESC1), templates with Any Purpose EKU (ESC2), overly broad enrollment agents (ESC3), or write access to the template object itself (ESC4). Any of these can hand an attacker a certificate that impersonates a domain admin.

A template audit answers three questions for every enabled template: who can enroll, what identity can the certificate claim, and what can it be used for. Templates that fail the combination — broad enrollment plus requester-supplied subject plus authentication EKU — are domain-takeover paths, not paperwork.

Template hygiene

Keep the enabled template list short and owned: disable the legacy defaults you never use, require manager approval or restricted groups where the subject is requester-supplied, enforce modern crypto (RSA 2048+/ECC, SHA-256), and review permissions after every migration — templates survive from Windows 2003 installs more often than anyone expects.

Try it yourself — free tools

Certificate Checker — inspect what your templates actually issue — key sizes, EKUs and validity
CSR Decoder & Analyzer — decode enrollment requests to see the subject and key being requested

How MI Support IT can help

MI Support IT performs ADCS template security audits covering the full ESC1–ESC16 catalogue, with concrete remediation for each finding. Read about our PKI services or get in touch.