Control ID: CA-TEMPLATE-005
Control Name: Template Enrollee Supplies Subject Validation
Severity: High
Status: Failure
Certificate Authority: securetron-lab-ISSUINGCA
Execution Time: 2025-10-15 22:43:13
Duration: 00:00:00.0198099

Expected Result:
Templates with CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT = 1 must be in the exclusion list

Evidence:
Template Enrollee Supplies Subject Analysis for securetron-lab-ISSUINGCA:
  Templates Found: 11
  Control Enabled: Yes
  Exclusion List: [Securetron-TLS, Template-NAME] (from parameters.json)
  Non-Compliant Templates: 2

Template Enrollee Supplies Subject Usage:
  ✓ DirectoryEmailReplication: CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT = 0 (COMPLIANT)
  ✓ DomainControllerAuthentication: CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT = 0 (COMPLIANT)
  ✓ KerberosAuthentication: CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT = 0 (COMPLIANT)
  ✓ EFSRecovery: CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT = 0 (COMPLIANT)
  ✓ EFS: CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT = 0 (COMPLIANT)
  ✓ DomainController: CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT = 0 (COMPLIANT)
  ✗ WebServer: CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT = 1 (NON-COMPLIANT)
  ✓ Machine: CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT = 0 (COMPLIANT)
  ✓ User: CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT = 0 (COMPLIANT)
  ✗ SubCA: CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT = 1 (NON-COMPLIANT)
  ✓ Administrator: CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT = 0 (COMPLIANT)

Validation Results:
  Compliant Templates: 9
  Non-Compliant Templates: 2
  Overall: NON-COMPLIANT


Recommendation:
Update the following templates to remove CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT or add them to the exclusion list: WebServer, SubCA
