Creating a certificate Issuing Template¶

Issuing Templates combine the selection of a CA account with rules that enforce certificate policy, all in a single location. Issuing templates can be edited (individually or in bulk), copied, or deleted.

Once the issuing templates are created, Resource Owner can add them to their applications, and then submit certificate requests using the issuing templates.

To create an issuing template¶

To create a certificate issuing template¶

1. Sign in to Venafi Control Plane.
2. Click Policies > Issuing Templates.
3. Click New.
4. Enter an Issuing Template Name.
5. (Optional) Enter a Description to help users requesting certificates understand when to choose this issuing template.
6. From the Certificate Authority drop-down, select the CA you will use for this template.

7. (Conditional) If you selected a DigiCert, Entrust, AD CS, or Zero Touch PKI CA in the previous step, you will see the Certificate Authority Product Option field.

   The products available depend on which products you have available to the DigiCert API key used on the CA Account. Select a product option.

   Why can't I use the DV certificate products from my DigiCert account?

   The DigiCert connector for TLS Protect Cloud is designed to only support OV and EV certificate products. Because DV certificate products require Domain Control Validation (DCV), which involve additional steps to prove ownership of the DNS names, you need to use the ACME CA connector, which has the ability to automate the DCV process using DNS-01 challenge mechanisms.

   Additional fields may appear as required by your CA. Verify the values in those fields and change them as necessary.

   Working with EJBCA?

   If you are working with an EJBCA custom certificate authority connector, please review the following information.

   You will be required to enter data into these three fields that are unique to EJBCA. The values are important and must match the source locations as described in this list:

   • Certificate Authority Name. EJBCA's administrator webpage lists the CA's in a table on it's status page. Copy the CA name from the first column and paste it into this field. Ensure the text (including case) matches exactly what is in the table.

     Make sure that this certificate authority has the certificate profile name (that you'll use next) assigned to it.

   • Certificate Profile Name. Found in the EJBCA admin console under the menu item CA Functions > Certificate Profiles. Copy the profile name from this list and paste it into TLS Protect Cloud.

     Make sure that this certificate profile name has the end entity profile name (that you'll use next) added to the profile.

   • End Entity Profile Name. Found in the EJBCA admin console under the menu item RA Functions > End Entity Profiles. Enter the profile name exactly as it appears in this list.

   For more information about EJBCA and custom CA connectors, see Custom CA Configuration overview

8. Select an option for Key Generation.

   Info

   To use Automated Secure Keypair, select one of the TLS Protect Cloud generated options.

9. (Optional) Customize the template's default Validity Period.

   The recommended value is 90 days. The minimum setting is 1 hour.

   Info

   Be aware that when the CSR is submitted and the validity period requested exceeds that allowed by the CA, an error message will be returned.

10. Complete the Common Name, Subject Alternative Names, and CSR Parameters fields.

    • These fields accept regular expressions.
    • Additional SAN types are available by clicking the Show Advanced SAN options drop-down.
    • The Common Name and Subject Alternate Name fields also include a Test button, which allows you to test your regular expressions.

    Tips for completing these fields

    • Leaving .* will require a value for that field when filling out the certificate request form, though any value will match.
    • Leaving the field blank disables the field on the certificate request form.
    • Entering a single value will require the certificate request form to match that value.
    • Entering multiple values will require certificate requests match one of the specified values.

    • Adding ^$ as one of the permitted values will allow that field to be left blank on a the certificate request form.

      This is the default behavior when submitting requests using the API.

    • You can disable or remove required validation for any field. See the tip below instructions.

    Enabling, disabling, and validating fields

    The common name, SAN, and CSR Parameter fields can be enabled or disabled. Disabling a field prevents that field from being set on certificate requests that use this template.

    Also, for enabled fields, you can specify whether that field requires validation when Resource Owners submit certificate requests using this template.

    To change these settings for any field, click the menu button next to the field.

11. Select the Key Algorithm types you want to allow.

12. Select an Extended Key Usage type. The valid values are Client Authentication, Server Authentication, and Any. If you want to allow all uses, select Any.

    What is Extended Key Usage?

    Extended key usage (EKU) allows you to select the purpose of the public key contained in the certificate and restrict usage of the public key to only those purposes defined by the EKU settings.

13. In the Resource Consumers section, specify who should be able to assign this template to applications.

    • To allow all users to use this template, enable Allow everyone to consume.
    • Otherwise, select specific users in the Resource Consumers field, and then click Add.

    Info

    Selecting neither option means that this template won't be available for Resource Owners to assign to any applications.

14. Click Save.

What's next¶

To use a certificate issuing template, you must associate it with an application. The template you just created should now be ready to assign to applications.