Control ID: CA-TEMPLATE-001
Control Name: CA Template Restriction Validation
Severity: Critical
Status: Failure
Certificate Authority: Securetron-Lab-ROOT-CA
Execution Time: 2025-10-15 22:43:13
Duration: 00:00:00.0433754

Expected Result:
Non-CA Templates should not be on the ROOT or Intermediate CA

Evidence:
CA Template Restriction Analysis for Securetron-Lab-ROOT-CA:
  Total Templates Found: 3
  Templates with CT_FLAG_IS_CA (128): 2
  Templates without CT_FLAG_IS_CA: 1

Templates WITH CT_FLAG_IS_CA (CA Templates - should remain):
  ✓ Copy of Subordinate Certification Authority
  ✓ SubCA

Templates WITHOUT CT_FLAG_IS_CA (Non-CA Templates - should be removed):
  ✗ Securetron-TLS

Validation Results:
  CT_FLAG_IS_CA Templates Found: 2
  Total Templates: 3
  Validation Status: FAIL: Mixed template flags detected
  Compliant: NO

Rule: If CT_FLAG_IS_CA (128) is found, the CA should only have CA templates published.


Recommendation:
Remove CT_FLAG_IS_CA from templates or ensure all templates have the same flag configuration.
