Before You Begin

• Configure the certificate authority that you plan to use in the issuing template.
• If you are creating a template for a AWS, DigiCert, DigiCert One, Entrust, AD CS, GoDaddy, HID PKIaaS, Sectigo Certificate Manager, Zero Touch PKI, or OpenSSL certificate authority (CA), you will be asked to select a Product Option. Available options are pre-populated in Next-Gen Trust Security based on data provided by the CA.

1. Sign in to Next-Gen Trust Security.
2. Click Configuration > Issuing Templates.
3. Click New.
4. Enter an Issuing Template Name.
5. (Optional) Enter a Description to help users understand when to select this issuing template.
6. From the Certificate Authority list, select the CA to use for this template.
7. (Conditional) If you selected an AWS Public CA in the previous step, the Domain Validation Method field appears. Select either DNS or Email as your domain validation method.
8. (Conditional) If you selected a AWS, DigiCert, Entrust, AD CS, GoDaddy, Zero Touch PKI, or OpenSSL CA in the previous step, you will see the Certificate Authority Product Option field.
   The products available depend on which products you have available to the CA API key used on the CA Account. Select a product option.
   Why can’t I use DV certificate products from my DigiCert account?
   The DigiCert connector supports only OV and EV certificate products. DV products require additional domain validation steps. To automate domain validation workflows, use an ACME-based CA configuration.
   Working with EJBCA? When using an EJBCA certificate authority, additional fields are required. Enter values exactly as they appear in the EJBCA administration interface:
   • Certificate Authority Name
   • Certificate Profile Name
   • End Entity Profile Name
   Ensure the selected certificate authority and profiles are correctly associated in EJBCA before proceeding.
9. Select a Key Generation option.
   Info: To use Automated Secure Keypair, select one of the Next-Gen Trust Security generated key options.
10. (Optional) Customize the Validity Period.
    The recommended value is 90 days. The minimum supported value is 1 hour.
    Info: If the requested validity period exceeds what the selected CA allows, certificate issuance fails.
11. Complete the Common Name, Subject Alternative Names, and CSR Parameters fields.
    • These fields accept regular expressions.
    • Additional SAN types are available using Show Advanced SAN options.
    • The Test button allows you to validate regular expressions before saving.
    Tips for completing these fields
    • Leaving .* requires a value but allows any input.
    • Leaving a field blank disables it on the certificate request form.
    • Entering a single value enforces an exact match.
    • Entering multiple values allows one matching value.
    • Including ^$ allows the field to be left blank.
    Enabling, disabling, and validating fields Fields can be enabled or disabled. Disabling a field prevents it from being set on certificate requests that use this template. For enabled fields, you can specify whether validation is required. Use the field menu next to each field to change these settings.
12. Select the allowed Key Algorithm types.
13. Select an Extended Key Usage value.
    Valid options are Client Authentication, Server Authentication, or Any.
    What is Extended Key Usage? Extended Key Usage (EKU) defines the intended purpose of the certificate’s public key and restricts how it can be used.
14. Click Save.