Control ID: CA-TEMPLATE-001
Control Name: CA Template Restriction Validation
Severity: Critical
Status: Failure
Certificate Authority: securetron-lab-ISSUINGCA
Execution Time: 2025-10-15 22:43:13
Duration: 00:00:00.0348820

Expected Result:
Non-CA Templates should not be on the ROOT or Intermediate CA

Evidence:
CA Template Restriction Analysis for securetron-lab-ISSUINGCA:
  Total Templates Found: 11
  Templates with CT_FLAG_IS_CA (128): 1
  Templates without CT_FLAG_IS_CA: 10

Templates WITH CT_FLAG_IS_CA (CA Templates - should remain):
  ✓ SubCA

Templates WITHOUT CT_FLAG_IS_CA (Non-CA Templates - should be removed):
  ✗ DirectoryEmailReplication
  ✗ DomainControllerAuthentication
  ✗ KerberosAuthentication
  ✗ EFSRecovery
  ✗ EFS
  ✗ DomainController
  ✗ WebServer
  ✗ Machine
  ✗ User
  ✗ Administrator

Validation Results:
  CT_FLAG_IS_CA Templates Found: 1
  Total Templates: 11
  Validation Status: FAIL: Mixed template flags detected
  Compliant: NO

Rule: If CT_FLAG_IS_CA (128) is found, the CA should only have CA templates published.


Recommendation:
Remove CT_FLAG_IS_CA from templates or ensure all templates have the same flag configuration.
