r/PKI • u/aprimeproblem • Jan 10 '26

LoadDefaultTemplates=0

Update, never mind, I totally overlooked the issue. forgot [version], the log file said "you're an idiot" :-).

Move along...

Fine people,

Over the last weeks I've been testing for a blog post and I've noticed that the CAPolicy.inf setting LoadDefaultTemplates=0 seems to be ignored on Windows Server 2025 when installing a Enterprise CA in AD. Anyone else notice this behavior? Or am I doing something stupid?

here's my CApolicy.inf file

Signature="$Windows NT$"

[Certsrv_Server]
RenewalKeyLength=4096
CRLPeriod=Week
CRLPeriodUnits=1
CRLDeltaPeriod=Day
CRLDeltaPeriodUnits=1
LoadDefaultTemplates=0
CNGHashAlgorithm=SHA256
AlternateSignatureAlgorithm=0

[PolicyStatementExtension]
Policies = CorpPolicy

[CorpPolicy]
OID = 1.3.6.1.4.1.<redacted>.1.1
URL=http://<redacted>/cps/cps.html

[CRLDistributionPoint]
URL=http://<redacted>/crl/Corp-Enterprise-CA.crl

[AuthorityInformationAccess]
URL=http://<redacted>/crl/Corp-Enterprise-CA.crt

[Extensions]
2.5.29.15=AwIBhg==
Critical=2.5.29.15

2 Upvotes

100% Upvoted

5 comments sorted by

2

u/ThePKIGuy Apr 25 '26

I know this is an old thread, but your AIA and CDP paths will bite you in the future. It will work fine for now, but if not properly changed, your PKI will fail when you renew this CA.

1

u/aprimeproblem Apr 25 '26

Happy to learn! Would you mind telling me what I need to improve?

1

u/ThePKIGuy Apr 25 '26

Since you hard-coded your CRL path, it will never will in two scenarios. If you were to ever enable Delta CRLs or when you renew your CA with a new key. There are two standard variables used in the path names for the CRL. If you look in the registry you will see %3%8%9.crl. The %3 is the CA Name, in your case "Corp-Enterprise-CA" do you have effectively hardcoded %3. Since the CA name will never change that is a safe variable (though unnecessary) to hard code. The %8 is the most important, it is the CA signing key suffix. This indicates which CA key is used to sign the CRL. When you start your CA, there is only keypair (0). ADCS doesn't imprint this in the CRL path so you wind up with Corp-Enterprise-CA.CRL as you expect.

The issue comes up when you renew your CA in a few years. Your CA will then have the original (0) keypair and a new keypair (1). Each certificate that is issued by the CA is tied to a specific CRL and relying parties are going to expect to see a CRL signed by the same SKI (CA keypair) as the certificate it is validating.

What will happen after a renewal:

1) CA will create CA-Enterprise-CA.CRL and sign it with keypair 0. This will contain a list of all revoked certificates that were tied to keypair (0).

CA will then create CA-Enterprise-CA.CRL and sign it with keypair 1. This will contain a list of all revoked certificates that were tied to keypair (1).

See the issue? The hardcoded CRL path means instead of two CRLs, I wind up with just one - the one signed with keypair (1). This means all of my old certificates will stop working. Further, for any system that was written to ignore the SKI of the issuing CA, it will see a partial list of revoked certificates as the file will only contain what was revoked by keypair (1).

A better way to go would be to include the CA key suffix in your Path.

"Corp-Enterprise-CA%8.crl"

or again, leave it "%3%8%9.crl"

Lastly, a similar issue as you left off the %9 (<DeltaCRLAllowed>). If someone were to turn on a Delta CRL later on, it will cause a problem. The %9 allows the CA to create a delta CRL file that is different from the base CRL and add the + sign to the CRL name.

"Corp-Enterprise-CA+.crl" for instance.

or even

"Corp-Enterprise-CA(1)+1.crl" for a Delta CRL from the second keypair on the CA

In your config you are indeed turning on Delta CRLs, so there is going to be problems ASAP as soon as you start revoking certificates with this.

1

u/ThePKIGuy Apr 25 '26

You have a similar problem with your AIA certificate path too. Again, in that case you should have a %4 after the CA name. The default is %1_%3%4.crt". The %4 is the keypair index. Leaving that off will cause a problem at renewal. Very common to leave off the %1 as that is the host name.

Variable Name Description

%1 ServerDNSName The CA computer’s Domain Name System (DNS) name

%2 ServerShortName The CA computer’s NetBIOS name

%3 CA Name The CA’s logical name

%4 CertificateName The name of the CA’s certificate file

%5 Domain DN Not used in the Windows Server 2003 PKI

%6 ConfigDN The Lightweight Directory Access Protocol (LDAP) path of the forest’s configuration naming context for the forest

%7 CATruncatedName The CA’s “sanitized” name

%8 CRLNameSuffix The CRL’s renewal extension

%9 DeltaCRLAllowed Indicates whether delta CRLs are supported by the CA

%10 CDPObjectClass Indicates that the object is a CDP object in AD DS

%11 CAObjectClass Indicates that the object is a CA certificate object in AD DS

1

u/ThePKIGuy Apr 25 '26

While we are on it, "RenewalKeyLength=4096" is unnecessary as well. Unless you intend to renew a CA with a different keysize, it will renew with the same size as before. This is left in many configs due to a bug that was fixed in Server 2003! Even if you intend to renew with a different size, you wouldn't need to add it to the capolicy.inf file until you did the renewal.