Control ID: CA-CONFIG-002
Control Name: CA Templates
Severity: High
Status: Success
Certificate Authority: Securetron-Lab-ROOT-CA
Execution Time: 2025-10-15 22:42:35
Duration: 00:00:00.4644576

Expected Result:
Successful retrieval of CA templates using certutil -CATemplates -v -config Securetron-Lab-ROOT-CA

Evidence:
Securetron-TLS: Securetron-TLS -- Auto-Enroll: Access is denied.
  msPKI-Enrollment-Flag = 0
  msPKI-Certificate-Name-Flag = 1
    CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT -- 1
  msPKI-Private-Key-Flag = 6060000 (101056512)
    CTPRIVATEKEY_FLAG_ATTEST_NONE -- 0
    TEMPLATE_SERVER_VER_THRESHOLD<<CTPRIVATEKEY_FLAG_SERVERVERSION_SHIFT -- 60000 (393216)
    TEMPLATE_CLIENT_VER_THRESHOLD<<CTPRIVATEKEY_FLAG_CLIENTVERSION_SHIFT -- 6000000 (100663296)
  flags = 20241 (131649)
    CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT -- 1
    CT_FLAG_MACHINE_TYPE -- 40 (64)
    CT_FLAG_ADD_TEMPLATE_NAME -- 200 (512)
    CT_FLAG_IS_MODIFIED -- 20000 (131072)
  cn = Securetron-TLS
  distinguishedName = Securetron-TLS
  displayName = Securetron-TLS
  templateDescription = Computer
  pKIExtendedKeyUsage = 1.3.6.1.5.5.7.3.1 Server Authentication
  pKIDefaultCSPs = Microsoft Software Key Storage Provider
  pKICriticalExtensions = 2.5.29.15 Key Usage
  revision = 64 (100)
  msPKI-Template-Schema-Version = 4
  msPKI-Template-Minor-Revision = d (13)
  msPKI-RA-Signature = 0
  msPKI-Minimal-Key-Size = 800 (2048)
  msPKI-Cert-Template-OID = 1.3.6.1.4.1.311.21.8.9007408.4333836.16203954.7714117.16001761.181.14880159.4818010 Securetron-TLS
  msPKI-Supersede-Templates =
  msPKI-RA-Policies =
  msPKI-RA-Application-Policies =
  msPKI-Certificate-Policy =
  msPKI-Certificate-Application-Policy = 1.3.6.1.5.5.7.3.1 Server Authentication
  msPKI-Symmetric-Algorithm = 3DES
  msPKI-Symmetric-Key-Length = a8 (168)
  msPKI-Key-Security-Descriptor =
  msPKI-Asymmetric-Algorithm = RSA
  msPKI-Hash-Algorithm = SHA256
  dwKeySpec = AT_KEYEXCHANGE
  pKIExpirationPeriod =  1 Years
  pKIOverlapPeriod =  6 Weeks
"O:LAG:S-1-5-21-1498873929-1015914979-173946537-519D:PAI(OA;;CR;0e10c968-78fb-11d2-90d4-00c04f79dc55;;DC)(OA;;CR;0e10c968-78fb-11d2-90d4-00c04f79dc55;;LA)(OA;;RPWPCR;0e10c968-78fb-11d2-90d4-00c04f79dc55;;DA)(OA;;RPWPCR;0e10c968-78fb-11d2-90d4-00c04f79dc55;;S-1-5-21-1498873929-1015914979-173946537-519)(OA;;CR;0e10c968-78fb-11d2-90d4-00c04f79dc55;;AU)(A;;LCRPRC;;;DC)(A;;CCDCLCSWRPWPDTLOSDRCWDWO;;;DA)(A;;CCDCLCSWRPWPDTLOSDRCWDWO;;;S-1-5-21-1498873929-1015914979-173946537-519)(A;;CCDCLCSWRPWPDTLOSDRCWDWO;;;LA)(A;;LCRPLORC;;;AU)"
        0000	01 00 04 9c c8 01 00 00  e4 01 00 00 00 00 00 00   ................
        0010	14 00 00 00 04 00 b4 01  0a 00 00 00 05 00 38 00   ..............8.
        0020	00 01 00 00 01 00 00 00  68 c9 10 0e fb 78 d2 11   ........h....x..
        0030	90 d4 00 c0 4f 79 dc 55  01 05 00 00 00 00 00 05   ....Oy.U........
        0040	15 00 00 00 49 00 57 59  e3 a1 8d 3c a9 36 5e 0a   ....I.WY...<.6^.
        0050	03 02 00 00 05 00 38 00  00 01 00 00 01 00 00 00   ......8.........
        0060	68 c9 10 0e fb 78 d2 11  90 d4 00 c0 4f 79 dc 55   h....x......Oy.U
        0070	01 05 00 00 00 00 00 05  15 00 00 00 49 00 57 59   ............I.WY
        0080	e3 a1 8d 3c a9 36 5e 0a  f4 01 00 00 05 00 38 00   ...<.6^.......8.
        0090	30 01 00 00 01 00 00 00  68 c9 10 0e fb 78 d2 11   0.......h....x..
        00a0	90 d4 00 c0 4f 79 dc 55  01 05 00 00 00 00 00 05   ....Oy.U........
        00b0	15 00 00 00 49 00 57 59  e3 a1 8d 3c a9 36 5e 0a   ....I.WY...<.6^.
        00c0	00 02 00 00 05 00 38 00  30 01 00 00 01 00 00 00   ......8.0.......
        00d0	68 c9 10 0e fb 78 d2 11  90 d4 00 c0 4f 79 dc 55   h....x......Oy.U
        00e0	01 05 00 00 00 00 00 05  15 00 00 00 49 00 57 59   ............I.WY
        00f0	e3 a1 8d 3c a9 36 5e 0a  07 02 00 00 05 00 28 00   ...<.6^.......(.
        0100	00 01 00 00 01 00 00 00  68 c9 10 0e fb 78 d2 11   ........h....x..
        0110	90 d4 00 c0 4f 79 dc 55  01 01 00 00 00 00 00 05   ....Oy.U........
        0120	0b 00 00 00 00 00 24 00  14 00 02 00 01 05 00 00   ......$.........
        0130	00 00 00 05 15 00 00 00  49 00 57 59 e3 a1 8d 3c   ........I.WY...<
        0140	a9 36 5e 0a 03 02 00 00  00 00 24 00 ff 00 0f 00   .6^.......$.....
        0150	01 05 00 00 00 00 00 05  15 00 00 00 49 00 57 59   ............I.WY
        0160	e3 a1 8d 3c a9 36 5e 0a  00 02 00 00 00 00 24 00   ...<.6^.......$.
        0170	ff 00 0f 00 01 05 00 00  00 00 00 05 15 00 00 00   ................
        0180	49 00 57 59 e3 a1 8d 3c  a9 36 5e 0a 07 02 00 00   I.WY...<.6^.....
        0190	00 00 24 00 ff 00 0f 00  01 05 00 00 00 00 00 05   ..$.............
        01a0	15 00 00 00 49 00 57 59  e3 a1 8d 3c a9 36 5e 0a   ....I.WY...<.6^.
        01b0	f4 01 00 00 00 00 14 00  94 00 02 00 01 01 00 00   ................
        01c0	00 00 00 05 0b 00 00 00  01 05 00 00 00 00 00 05   ................
        01d0	15 00 00 00 49 00 57 59  e3 a1 8d 3c a9 36 5e 0a   ....I.WY...<.6^.
        01e0	f4 01 00 00 01 05 00 00  00 00 00 05 15 00 00 00   ................
        01f0	49 00 57 59 e3 a1 8d 3c  a9 36 5e 0a 07 02 00 00   I.WY...<.6^.....


Template Extensions: 4
    1.3.6.1.4.1.311.21.7: Flags = 0, Length = 31
    Certificate Template Information
        Template=Securetron-TLS(1.3.6.1.4.1.311.21.8.9007408.4333836.16203954.7714117.16001761.181.14880159.4818010)
        Major Version Number=100
        Minor Version Number=13

    2.5.29.37: Flags = 0, Length = c
    Enhanced Key Usage
        Server Authentication (1.3.6.1.5.5.7.3.1)

    2.5.29.15: Flags = 1(Critical), Length = 4
    Key Usage
        Digital Signature, Key Encipherment (a0)

    1.3.6.1.4.1.311.21.10: Flags = 0, Length = e
    Application Policies
        [1]Application Certificate Policy:
             Policy Identifier=Server Authentication

Copy of Subordinate Certification Authority: Copy of Subordinate Certification Authority -- Auto-Enroll: Access is denied.
  msPKI-Enrollment-Flag = 0
  msPKI-Certificate-Name-Flag = 1
    CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT -- 1
  msPKI-Private-Key-Flag = 6060110 (101056784)
    CTPRIVATEKEY_FLAG_EXPORTABLE_KEY -- 10 (16)
    CTPRIVATEKEY_FLAG_USE_LEGACY_PROVIDER -- 100 (256)
    CTPRIVATEKEY_FLAG_ATTEST_NONE -- 0
    TEMPLATE_SERVER_VER_THRESHOLD<<CTPRIVATEKEY_FLAG_SERVERVERSION_SHIFT -- 60000 (393216)
    TEMPLATE_CLIENT_VER_THRESHOLD<<CTPRIVATEKEY_FLAG_CLIENTVERSION_SHIFT -- 6000000 (100663296)
  flags = 202d1 (131793)
    CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT -- 1
    CT_FLAG_EXPORTABLE_KEY -- 10 (16)
    CT_FLAG_MACHINE_TYPE -- 40 (64)
    CT_FLAG_IS_CA -- 80 (128)
    CT_FLAG_ADD_TEMPLATE_NAME -- 200 (512)
    CT_FLAG_IS_MODIFIED -- 20000 (131072)
  cn = Copy of Subordinate Certification Authority
  distinguishedName = Copy of Subordinate Certification Authority
  displayName = Copy of Subordinate Certification Authority
  templateDescription = Certification authority (CA)
  pKIExtendedKeyUsage =
  pKIDefaultCSPs = Microsoft Enhanced Cryptographic Provider v1.0
  pKICriticalExtensions =
    0: 2.5.29.19 Basic Constraints
    1: 2.5.29.15 Key Usage
  revision = 64 (100)
  msPKI-Template-Schema-Version = 4
  msPKI-Template-Minor-Revision = 2
  msPKI-RA-Signature = 0
  msPKI-Minimal-Key-Size = 800 (2048)
  msPKI-Cert-Template-OID = 1.3.6.1.4.1.311.21.8.9007408.4333836.16203954.7714117.16001761.181.4571.13279266 Copy of Subordinate Certification Authority
  msPKI-Supersede-Templates =
  msPKI-RA-Policies =
  msPKI-RA-Application-Policies =
  msPKI-Certificate-Policy =
  msPKI-Certificate-Application-Policy =
  msPKI-Symmetric-Algorithm =
  msPKI-Symmetric-Key-Length = 0
  msPKI-Key-Security-Descriptor =
  msPKI-Asymmetric-Algorithm =
  msPKI-Hash-Algorithm =
  dwKeySpec = AT_SIGNATURE
  pKIExpirationPeriod =  5 Years
  pKIOverlapPeriod =  6 Weeks
"O:LAG:S-1-5-21-1498873929-1015914979-173946537-519D:PAI(OA;;RPWPCR;0e10c968-78fb-11d2-90d4-00c04f79dc55;;DA)(OA;;RPWPCR;0e10c968-78fb-11d2-90d4-00c04f79dc55;;S-1-5-21-1498873929-1015914979-173946537-519)(A;;CCDCLCSWRPWPDTLOSDRCWDWO;;;DA)(A;;CCDCLCSWRPWPDTLOSDRCWDWO;;;S-1-5-21-1498873929-1015914979-173946537-519)(A;;CCDCLCSWRPWPDTLOSDRCWDWO;;;LA)(A;;LCRPLORC;;;AU)"
        0000	01 00 04 9c 0c 01 00 00  28 01 00 00 00 00 00 00   ........(.......
        0010	14 00 00 00 04 00 f8 00  06 00 00 00 05 00 38 00   ..............8.
        0020	30 01 00 00 01 00 00 00  68 c9 10 0e fb 78 d2 11   0.......h....x..
        0030	90 d4 00 c0 4f 79 dc 55  01 05 00 00 00 00 00 05   ....Oy.U........
        0040	15 00 00 00 49 00 57 59  e3 a1 8d 3c a9 36 5e 0a   ....I.WY...<.6^.
        0050	00 02 00 00 05 00 38 00  30 01 00 00 01 00 00 00   ......8.0.......
        0060	68 c9 10 0e fb 78 d2 11  90 d4 00 c0 4f 79 dc 55   h....x......Oy.U
        0070	01 05 00 00 00 00 00 05  15 00 00 00 49 00 57 59   ............I.WY
        0080	e3 a1 8d 3c a9 36 5e 0a  07 02 00 00 00 00 24 00   ...<.6^.......$.
        0090	ff 00 0f 00 01 05 00 00  00 00 00 05 15 00 00 00   ................
        00a0	49 00 57 59 e3 a1 8d 3c  a9 36 5e 0a 00 02 00 00   I.WY...<.6^.....
        00b0	00 00 24 00 ff 00 0f 00  01 05 00 00 00 00 00 05   ..$.............
        00c0	15 00 00 00 49 00 57 59  e3 a1 8d 3c a9 36 5e 0a   ....I.WY...<.6^.
        00d0	07 02 00 00 00 00 24 00  ff 00 0f 00 01 05 00 00   ......$.........
        00e0	00 00 00 05 15 00 00 00  49 00 57 59 e3 a1 8d 3c   ........I.WY...<
        00f0	a9 36 5e 0a f4 01 00 00  00 00 14 00 94 00 02 00   .6^.............
        0100	01 01 00 00 00 00 00 05  0b 00 00 00 01 05 00 00   ................
        0110	00 00 00 05 15 00 00 00  49 00 57 59 e3 a1 8d 3c   ........I.WY...<
        0120	a9 36 5e 0a f4 01 00 00  01 05 00 00 00 00 00 05   .6^.............
        0130	15 00 00 00 49 00 57 59  e3 a1 8d 3c a9 36 5e 0a   ....I.WY...<.6^.
        0140	07 02 00 00                                        ....


Template Extensions: 3
    1.3.6.1.4.1.311.21.7: Flags = 0, Length = 2f
    Certificate Template Information
        Template=Copy of Subordinate Certification Authority(1.3.6.1.4.1.311.21.8.9007408.4333836.16203954.7714117.16001761.181.4571.13279266)
        Major Version Number=100
        Minor Version Number=2

    2.5.29.15: Flags = 1(Critical), Length = 4
    Key Usage
        Digital Signature, Certificate Signing, Off-line CRL Signing, CRL Signing (86)

    2.5.29.19: Flags = 1(Critical), Length = 5
    Basic Constraints
        Subject Type=CA
        Path Length Constraint=None

SubCA: Subordinate Certification Authority -- Auto-Enroll: Access is denied.
  msPKI-Enrollment-Flag = 0
  msPKI-Certificate-Name-Flag = 1
    CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT -- 1
  msPKI-Private-Key-Flag = 10 (16)
    CTPRIVATEKEY_FLAG_EXPORTABLE_KEY -- 10 (16)
    CTPRIVATEKEY_FLAG_ATTEST_NONE -- 0
    TEMPLATE_SERVER_VER_NONE<<CTPRIVATEKEY_FLAG_SERVERVERSION_SHIFT -- 0
    TEMPLATE_CLIENT_VER_NONE<<CTPRIVATEKEY_FLAG_CLIENTVERSION_SHIFT -- 0
  flags = 102d1 (66257)
    CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT -- 1
    CT_FLAG_EXPORTABLE_KEY -- 10 (16)
    CT_FLAG_MACHINE_TYPE -- 40 (64)
    CT_FLAG_IS_CA -- 80 (128)
    CT_FLAG_ADD_TEMPLATE_NAME -- 200 (512)
    CT_FLAG_IS_DEFAULT -- 10000 (65536)
  cn = SubCA
  distinguishedName = SubCA
  displayName = Subordinate Certification Authority
  templateDescription = Certification authority (CA)
  pKIExtendedKeyUsage =
  pKIDefaultCSPs = Microsoft Enhanced Cryptographic Provider v1.0
  pKICriticalExtensions =
    0: 2.5.29.15 Key Usage
    1: 2.5.29.19 Basic Constraints
  revision = 5
  msPKI-Template-Schema-Version = 1
  msPKI-Template-Minor-Revision = 1
  msPKI-RA-Signature = 0
  msPKI-Minimal-Key-Size = 800 (2048)
  msPKI-Cert-Template-OID = 1.3.6.1.4.1.311.21.8.9007408.4333836.16203954.7714117.16001761.181.1.18
  msPKI-Supersede-Templates =
  msPKI-RA-Policies =
  msPKI-RA-Application-Policies =
  msPKI-Certificate-Policy =
  msPKI-Certificate-Application-Policy =
  dwKeySpec = AT_SIGNATURE
  pKIExpirationPeriod =  5 Years
  pKIOverlapPeriod =  6 Weeks
"O:S-1-5-21-1498873929-1015914979-173946537-519G:S-1-5-21-1498873929-1015914979-173946537-519D:PAI(OA;;RPWPCR;0e10c968-78fb-11d2-90d4-00c04f79dc55;;DA)(OA;;RPWPCR;0e10c968-78fb-11d2-90d4-00c04f79dc55;;S-1-5-21-1498873929-1015914979-173946537-519)(A;;CCDCLCSWRPWPDTLOSDRCWDWO;;;DA)(A;;CCDCLCSWRPWPDTLOSDRCWDWO;;;S-1-5-21-1498873929-1015914979-173946537-519)(A;;LCRPLORC;;;AU)"
        0000	01 00 04 9c e8 00 00 00  04 01 00 00 00 00 00 00   ................
        0010	14 00 00 00 04 00 d4 00  05 00 00 00 05 00 38 00   ..............8.
        0020	30 01 00 00 01 00 00 00  68 c9 10 0e fb 78 d2 11   0.......h....x..
        0030	90 d4 00 c0 4f 79 dc 55  01 05 00 00 00 00 00 05   ....Oy.U........
        0040	15 00 00 00 49 00 57 59  e3 a1 8d 3c a9 36 5e 0a   ....I.WY...<.6^.
        0050	00 02 00 00 05 00 38 00  30 01 00 00 01 00 00 00   ......8.0.......
        0060	68 c9 10 0e fb 78 d2 11  90 d4 00 c0 4f 79 dc 55   h....x......Oy.U
        0070	01 05 00 00 00 00 00 05  15 00 00 00 49 00 57 59   ............I.WY
        0080	e3 a1 8d 3c a9 36 5e 0a  07 02 00 00 00 00 24 00   ...<.6^.......$.
        0090	ff 00 0f 00 01 05 00 00  00 00 00 05 15 00 00 00   ................
        00a0	49 00 57 59 e3 a1 8d 3c  a9 36 5e 0a 00 02 00 00   I.WY...<.6^.....
        00b0	00 00 24 00 ff 00 0f 00  01 05 00 00 00 00 00 05   ..$.............
        00c0	15 00 00 00 49 00 57 59  e3 a1 8d 3c a9 36 5e 0a   ....I.WY...<.6^.
        00d0	07 02 00 00 00 00 14 00  94 00 02 00 01 01 00 00   ................
        00e0	00 00 00 05 0b 00 00 00  01 05 00 00 00 00 00 05   ................
        00f0	15 00 00 00 49 00 57 59  e3 a1 8d 3c a9 36 5e 0a   ....I.WY...<.6^.
        0100	07 02 00 00 01 05 00 00  00 00 00 05 15 00 00 00   ................
        0110	49 00 57 59 e3 a1 8d 3c  a9 36 5e 0a 07 02 00 00   I.WY...<.6^.....


Template Extensions: 3
    1.3.6.1.4.1.311.20.2: Flags = 0, Length = c
    Certificate Template Name (Certificate Type)
        SubCA

    2.5.29.15: Flags = 1(Critical), Length = 4
    Key Usage
        Digital Signature, Certificate Signing, Off-line CRL Signing, CRL Signing (86)

    2.5.29.19: Flags = 1(Critical), Length = 5
    Basic Constraints
        Subject Type=CA
        Path Length Constraint=None

CertUtil: -CATemplates command completed successfully.


Recommendation:
CA templates retrieved successfully. Review template configurations for security compliance.
