Tab defines the templates that are used to issue user certificates.
Make sure that the required templates are added to certification authority before starting to create certificate templates in the Indeed CM system.
Table 2 describes the settings of Microsoft CA certificate templates in the Indeed CM system. To create a certificate template, click Create certificate template, define the template parameters (see Table 2) and click Create.
Table 2 – Settings of Microsoft CA certificate templates in the Indeed CM system.
| Parameter | Description |
|---|---|
| Name | Certificate template name. |
| CA | Certification authority name. |
| Microsoft CA Certificate template | This is loaded from the selected certification authority. |
| Key name prefix | If not defined, then the name of container with key pair is generated randomly. If prefix is defined, it is placed in front of the container name. The prefix value is displayed in third party software to work with private key container. Some smart cards might not support container names with prefix. |
| Backup key | If enabled, then the option of archiving will be used in case of generating a key pair on the smart card. It means that the key pair will be generated on the smart card and its copy (public and private keys) will be sent to the Indeed CM Server and then to the data storage. It is possible to archive the key pair only once. |
| Reuse key | If enabled, the existing encryption key is re-used when updating the certificates written to the smart card. |
| Import key if exists | If enabled, the system would search for existing keys on the card (for the defined user, CA and template) and use found ones. New keys are not generated in this case. |
Revoke certificate at card revoking/disabling | If enabled, the user certificates are revoked upon smart card revoking or disabling in Indeed CM. If disabled, the user certificates are not revoked upon smart card revocation or disabling. |
| Install certificate to local store | If enabled, then when a smart card is issued (upgraded) via Self Service, certificates stored on it will be added to the user's local storage at the workstation. |
| Publish CRL | If enabled, then extra publication of CRL is performed upon device revocation, disabling or enabling. |
Accept certificate request automatically | If enabled, the certificate requests are approved automatically. If disabled, request approval by CA operator is required for issuing a smart card. |
Accept signed certificate renewal request automatically | If enabled, certificate renewal requests are approved automatically. If disabled, request approval by CA operator is required. |
| Tracked user attributes | Specify user attributes when changing which requires a certificate update:
Changing the E-mail leads to the renewal of the certificate if this attribute is included in the properties of the certificate template in Microsoft CA on the Subject Name tab of the Include e-mail name in subject name and E-mail name options. Additional tracked user attributes are specified in the Indeed CM Setup Wizard under Tracked attributes. |
| Certificate request print template | If the parameter: Not set, then the standard certificate request print template is used. If Certificate request print templates have been added to the system, select a template from the drop-down menu. |
| Certificate print template | If the parameter: Not set, then the standard certificate print template is used. If Certificate print templates have been added to the system, select a template from the drop-down menu. |
| Default | If enabled, the certificate is marked as default one to login to Windows XP operating system. |
| Optional certificate | If enabled, then you can select the certificates to be written to a smart card from the ones marked as optional, while issuing a card. If disabled, the certificate issued with this template is considered as mandatory to be written to a smart card. |
To create a certificate template click Create certificate template. Define the template name, certification authority, select the CA template from the list of available templates. Then set the required template parameters (see Table 2) and click Create. The system allows for creation of multiple certificate templates for a single policy (provided that these templates are not identical). You can view the list of the created templates in the Templates section of the selected policy.
To edit a template, select it and click 
button. To remove a template from the policy, click
.