Create an Enrollment Agent template
To create the Enrollment Agent template:
- From the Certificate Authority server, launch the Certificate Authority management console (MMC) from Administrative Tools.
- Expand the CA, right -click on the "Certificate Templates" folder and select Manage .
-
Right-click the Enrollment Agent template and choose
Duplicate Template
. The new template properties window opens. On the
General
tab, configure the following properties:
- Template display name: PrlsEnrollmentAgent
- Template name: PrlsEnrollmentAgent
- Validity period: 2 years
- Renewal period: 6 weeks
- Publish certificate in Active Directory : ON
- Do not automatically re-enroll if a duplicate certificate exists in Active Directory: OFF
-
Select the
Cryptography
tab and set the following values:
- Provider category: Legacy Cryptographic Service Provider (read-only).
- Algorithm name: Determined by CSP
- Minimum key size: 2048
In the section Choose which cryptographic providers can be used for requests , choose Requests must use one of the following providers . In the following list of providers, clear all options except Microsoft Strong Cryptographic Provider and set priority as the preferred provider:
[X] Microsoft Strong Cryptographic Provider
[ ] Microsoft Enhanced Cryptographic Provider v 1.0
[ ] Microsoft Base Cryptographic Provider v 1.0
[ ] Microsoft Enhanced RSA and AES Cryptographic Provider
-
Select the
Security
tab and do the following:
- Click Add.
- Add the enrollment agent user account.
- Allow (select) the "Read" and "Enroll" permission. Click Apply and OK .
Issue the certificate template
To issue the certificate template that you've created:
- Run Certificate Authority again and right click on Certificate Templates, select new and click on Certificate Template to Issue .
- Select the certificate template you've created in the previous steps (i.e. Prls Enrollment Agent) and click OK .
- The certificate template should appear in the Certificate Templates list.