How to Create a Web Server Certificate Template in AD CS Print

Applies to: Windows Server 2019, Windows Server 2022, and Windows Server 2025.

A dedicated template standardizes key size, subject handling, intended usage, validity, and enrollment permissions for IIS servers.

Prerequisites

• Administrative access to the affected servers.
• A verified backup and approved maintenance window.
• A pilot system for testing before production rollout.

Step-by-step procedure

1. Duplicate the current Web Server template.
2. Assign a unique versioned display name.
3. Configure cryptography, subject source, validity, and Server Authentication EKU.
4. Grant enrollment to a dedicated server group and publish the template.

Commands

certutil -CATemplates
Get-CATemplate | Select Name,DisplayName
certutil -template

Verification

An authorized pilot server can request the template and the resulting certificate contains the intended SAN, key length, and EKU.

Rollback

Unpublish the template and remove enrollment permissions; revoke test certificates if policy requires it.

Security and operations

• Use least privilege and document all production changes.
• Replace example addresses and names with approved values.
• Review relevant Windows event logs after implementation.

Related resources

Canadian Windows VPS and RDS hosting is available from networkmanager.info. Also review the official Microsoft Windows Server documentation.