What it is
A template is a named set of defaults: subject format, SAN rules, key algorithm, key size, key usage extensions, validity, and auto-renewal preference. Applying a template at issuance time pre-fills the form and prevents operators from accidentally issuing with weak cryptography or incorrect extensions.When to use it
- Standardize on ECDSA P-256 and 90-day validity for all internal TLS services.
- Prevent issuance of TLS certificates without at least one DNS SAN (a common browser requirement).
- Lock code-signing certificates to RSA-3072 so key strength is enforced by construction.
- Give teams pre-approved templates to self-serve certificate issuance within policy boundaries.
Set it up
Open the template catalog
Go to Certificates > Templates. You’ll see workspace templates plus the built-in defaults that ship with every workspace.
Create a template
Click New template and choose the closest base type (Web server, Client auth, Code signing, Email, or Custom).
Configure cryptographic settings
Set the key algorithm, key size, and validity. Lock these fields if you want them to be non-overridable at issuance time.
Set SAN rules
Enable SAN required for web-server templates to prevent issuing TLS certificates without a DNS SAN. Optionally set a maximum SAN count or forbid wildcard patterns.
Set subject format
Use the subject format field to define a consistent subject DN. Placeholders like
{commonName}, {organization}, and {workspaceSlug} are resolved at issuance time.What you’ll see
After saving, the template appears in the Certificates > Templates list with its name, base type, and the count of certificates currently issued from it. The issuance wizard shows the template in the Template dropdown; selecting it pre-fills all fields that the template defines.Built-in defaults
Each base type ships with sensible key-usage presets:| Base type | Key usage | Extended key usage | Typical validity |
|---|---|---|---|
| Web server | digitalSignature, keyEncipherment | serverAuth | 90 days |
| Client auth | digitalSignature | clientAuth | 365 days |
| Code signing | digitalSignature | codeSigning | 365 days |
| digitalSignature, keyEncipherment, dataEncipherment | emailProtection | 365 days | |
| Custom | digitalSignature | (none) | 90 days |
serverAuth and clientAuth).
Templates and renewal
The renewal engine records which template was used at issuance. On renewal it reuses the same template so the renewed certificate inherits the exact same key algorithm, extensions, and validity — no drift across the lifecycle. Changing a template only affects future issuances; existing certificates stay on the template they were minted with unless you explicitly re-issue.Policy alignment
Templates enforce per-use-case settings on top of workspace-wide policy floors. If workspace policy requires RSA minimum 2048 and a template specifies ECDSA P-256, both constraints apply — the template wins because ECDSA P-256 is stricter than RSA-2048 for equivalent security level.Related
Policies
Set the workspace-wide cryptographic floor.
Certificate issuance
Use a template in the issuance flow.
PKI Core
Templates are enforced during internal CA signing.