Standalone CA - Restricting certificate templates

hi,

i know standalone ca ignores certificate templates standard enterprise authority... how go around configuring issue / display webserver , server authentication certs via certsrv? delete them registry??

(http://social.technet.microsoft.com/forums/en-us/winservernis/thread/1c7126de-e212-47c9-a0c1-217f10720d48)

basically want ca few "templates" user can pick from... we don't want link client secure domain hence standalone approach.

i've never used microsoft policy web enrollment - better way of doing it? suppose deploy building "custom" domain, then editing the templates require details , not them ad ...just seems "work around" not solution.

cheers advice (as inane question :) )

q1:

yes, using the enhancedkeyusageextension section in capolicy.inf correct method set policy/extension on ca certificate level.

you can find microsoft specific oids her http://support.microsoft.com/kb/287547 but other oids either need @ specific rfcs or find oid in oid repository the http://www.oid-info.com/cgi-bin/display 

q2:

you can not override restriction if set in ca certificate (using capolicy.inf method..) or if defined certificate template when using enterprise ca. in such case can override other non restricted attributes in certificate request. if example allow an arbitrary subject name , ca allows client authentication extension and malicious user can submit request domain admin etc..

q3:

remember when using the enhancedkeyusageextension section in capolicy.inf, need renew or reissue ca each time add/remove/change allowed oids. there not certutil command allow that.

using enterprise ca , certificate templates gives more flexible control in terms of allowed extensions based on template information rather being set directly on ca certificate.

/hasain

Windows Server  >  Security