> For the complete documentation index, see [llms.txt](https://docs.forestall.io/forestall/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.forestall.io/forestall/search-and-reports/active-directory-entities/certificatetemplate.md). # CertificateTemplate | Field | Type | Possible Operators | Description | | ----------------------------------- | ----------- | -------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Guid | TEXT | LIKE, NOT\_LIKE, EQUAL, NOT\_EQUAL, IS\_EMPTY | A unique identifier that is a combination of GUID of selected `Scan` and Active Directory `ObjectGUID` of the object. | | FSName | TEXT | LIKE, NOT\_LIKE, EQUAL, NOT\_EQUAL, IS\_EMPTY | A special unique identifier that is a combination of the `Name of the object` and the `FSName of the Forest`. | | Name | TEXT | LIKE, NOT\_LIKE, EQUAL, NOT\_EQUAL, IS\_EMPTY | Name of the specified object. (**Ldap Display Name**: name) | | DistinguishedName | TEXT | LIKE, NOT\_LIKE, EQUAL, NOT\_EQUAL, IS\_EMPTY | Active Directory distinguished name of the object. (**Ldap Display Name**: distinguishedName) | | ValidityPeriod | NUMBER | EQUAL, BETWEEN, SMALLER, LARGER, SMALLER\_EQUAL, LARGER\_EQUAL | The period of time during which a certificate is intended to be valid. | | IsEnrolleeSuppliesSubject | BOOLEAN | N/A (toggle) | Whether specifying a Subject Alternative Name (SAN) during certificate enrollment to this certificate template has been allowed. | | MSPKICertificateApplicationPolicies | TEXT | LIKE, NOT\_LIKE, EQUAL, NOT\_EQUAL, IS\_EMPTY | Specifies certificate application policy extension. In GUI, this attribute can be controlled by setting "Application Policies" in "Extensions" tab. ([Field Reference](https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-crtd/44012f2d-5ef3-440d-a61b-b30d3d978130)) | | RenewalPeriod | NUMBER | EQUAL, BETWEEN, SMALLER, LARGER, SMALLER\_EQUAL, LARGER\_EQUAL | The period of time during which a certificate is intended to be renew. | | WhenChanged | DATE | SMALLER, LARGER, BETWEEN, EQUAL, IS\_EMPTY | The date when this object was last changed. (**Ldap Display Name**: whenChanged) | | IsManagerApprovalEnabled | BOOLEAN | N/A (toggle) | Whether the certificate requests based on the template require manager approval to be issued. | | WhenCreated | DATE | SMALLER, LARGER, BETWEEN, EQUAL, IS\_EMPTY | The date when this object was created. (**Ldap Display Name**: whenCreated) | | IsPublished | BOOLEAN | N/A (toggle) | Whether the certificate template has been published by any certificate authority. | | risk | NUMBER | EQUAL, BETWEEN, SMALLER, LARGER, SMALLER\_EQUAL, LARGER\_EQUAL | The risk score of the object that calculated based on vulnerability counts and severities. | | MSPKIRAPolicies | TEXT | LIKE, NOT\_LIKE, EQUAL, NOT\_EQUAL, IS\_EMPTY | Contains the list of required policy OIDs from registration authorities who sign the enrollment request. ([Field Reference](https://learn.microsoft.com/en-us/windows/win32/adschema/a-mspki-ra-policies)) | | MSPKIRAApplicationPolicies | TEXT | LIKE, NOT\_LIKE, EQUAL, NOT\_EQUAL, IS\_EMPTY | Encapsulates embedded properties for multipurpose use. In GUI, this attribute can be controlled by checking `This number of authorized signatures` check box in `Issuance Requirements` tab and choosing `Application Policy` menu. ([Field Reference](https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-crtd/3fe798de-6252-4350-aace-f418603ddeda)) | | ExtendedKeyUsage | TEXT | LIKE, NOT\_LIKE, EQUAL, NOT\_EQUAL, IS\_EMPTY | Key usage extensions define the purpose of the public key contained in a certificate. You can use them to restrict the public key to as few or as many operations as needed. | | HasDomainAuthenticationEKU | BOOLEAN | N/A (toggle) | Whether certificate template contains any Extended Key Usage(EKU) that allows to auhenticate in the domain. | | SchemaVersion | NUMBER | EQUAL, BETWEEN, SMALLER, LARGER, SMALLER\_EQUAL, LARGER\_EQUAL | The certificate template schema version. | | DisplayName | TEXT | LIKE, NOT\_LIKE, EQUAL, NOT\_EQUAL, IS\_EMPTY | The display name for an object. (**LDAP Display Name**: displayName) | | EnrollmentFlags | TEXT | LIKE, NOT\_LIKE, EQUAL, NOT\_EQUAL, IS\_EMPTY | Specifies the enrollment flags. ([Field Reference](https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-crtd/ec71fd43-61c2-407b-83c9-b52272dec8a1)) | | CertificateNameFlags | TEXT | LIKE, NOT\_LIKE, EQUAL, NOT\_EQUAL, IS\_EMPTY | Specifies the subject name flags. ([Field Reference](https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-crtd/1192823c-d839-4bc3-9b6b-fa8c53507ae1)) | | NumberOfAuthorizedSignatures | NUMBER | EQUAL, BETWEEN, SMALLER, LARGER, SMALLER\_EQUAL, LARGER\_EQUAL | The number of Authorized Signatures to issue a certificate. | | ExposurePoint | NUMBER | EQUAL, BETWEEN, SMALLER, LARGER, SMALLER\_EQUAL, LARGER\_EQUAL | **ExposurePoint**: A numerical value indicating the level of risk or exposure. | | AceAuditState | MULTI\_LIST | IN | SACL audit coverage of the object's permissions (ACEs): `Full` when every ACE is covered by a success audit rule, `Partial` when some are, `None` when none are. Set only when the scan runs the permission (over-privilege) analysis. Values: None, Partial, Full. | | HasServerAuthenticationEKU | BOOLEAN | N/A (toggle) | Indicates whether the template's Extended Key Usage includes Server Authentication. | | Tier | NUMBER | EQUAL, BETWEEN, SMALLER, LARGER, SMALLER\_EQUAL, LARGER\_EQUAL | Tier level Forestall assigned to the object: `0` (Tier 0), `1` (Tier 1) or `2` (Tier 2). Lower is more privileged. |