Control ID: CA-TEMPLATE-004
Control Name: Template CSP (Cryptographic Service Provider) Validation
Severity: Critical
Status: Failure
Certificate Authority: securetron-lab-ISSUINGCA
Execution Time: 2025-10-15 22:43:13
Duration: 00:00:00.0439469

Expected Result:
Certificate templates should use approved CSPs and avoid weak prohibited CSPs

Evidence:
Template CSP Analysis for securetron-lab-ISSUINGCA:
  Templates Found: 11
  Approved CSPs:  (from parameters.json)
  Prohibited CSPs: Microsoft Enhanced Cryptographic Provider v1.0, Microsoft Enhanced Cryptographic Provider (from parameters.json)
  Non-Compliant Templates: 1

Template CSP Usage:
  ✓ DirectoryEmailReplication: Microsoft RSA SChannel Cryptographic Provider (COMPLIANT)
  ✓ DomainControllerAuthentication: Microsoft RSA SChannel Cryptographic Provider (COMPLIANT)
  ✓ KerberosAuthentication: Microsoft RSA SChannel Cryptographic Provider (COMPLIANT)
  ○ EFSRecovery:  (NO RESTRICTION)
  ○ EFS:  (NO RESTRICTION)
  ✓ DomainController: Microsoft RSA SChannel Cryptographic Provider (COMPLIANT)
  ○ WebServer:  (NO RESTRICTION)
  ✓ Machine: Microsoft RSA SChannel Cryptographic Provider (COMPLIANT)
  ○ User:  (NO RESTRICTION)
  ✗ SubCA: Microsoft Enhanced Cryptographic Provider v1.0 (NON-COMPLIANT)
  ○ Administrator:  (NO RESTRICTION)

Validation Results:
  Compliant Templates: 10
  Non-Compliant Templates: 1
  Overall: NON-COMPLIANT


Recommendation:
Update the following templates to use approved CSPs and avoid prohibited CSPs: SubCA
