A template is the issuance policy applied to every certificate request in Skyrsoft CertOps. It decides what a certificate may contain and whether it issues immediately or waits for a human. Five built-in templates cover the common cases — a domain user, a machine, a web server, code signing and smart-card logon — plus a sixth, hidden template used only for agent identity. Clone any of them, or build one from scratch, when a policy needs to differ from the defaults.
How it works
A template is a bundle of independent settings, each enforced at issuance:
| Setting | Controls |
|---|---|
| Validity | Lifetime in days, plus the renewal and expiry-warning thresholds |
| Key policy | Allowed algorithm and minimum key size |
| Usages | Key usage flags and EKU OIDs — server auth, client auth, code signing, and so on |
| Subject & SANs | Subject-mapping mode and source, and which SAN types are allowed |
| Issuance behaviour | Auto-enrol, or requires manual approval |
| Issuing CA | Which CA signs — falls back to the system default |
| Validation | An AD domain and/or request-validation rules to run before issuance |
| Self-service | Whether the template is offered in the portal, and its subject mode there |
Built-in templates
UserAuth, DeviceMachine, WebServer, CodeSigning and SmartCardLogon are seeded
automatically on every install, alongside a hidden internal template used only for agent mTLS
identity. Built-in templates are editable, but narrowly: validity, the renewal threshold,
enrolment behaviour, active state, validation and self-service settings, and the issuing CA, can
all be changed. Key usage, EKUs, SAN types and subject mapping are fixed on a built-in template —
clone it to get a policy you can edit freely.
Managing templates
Create, edit, clone, delete, and toggle a template’s active state from the Templates page. Cloning an existing template, built-in or otherwise, is the fastest way to produce a variant without redefining every field.
Limits
A built-in template’s core policy cannot be edited directly. EKU, key usage, SAN types and subject mapping stay fixed; clone the template first if you need to change any of them.
Two of the built-in templates most agents depend on ship inactive. DeviceMachine and
UserAuth start with isActive = false. An agent group pointed at either before you activate it
enrols nothing, and the reason is logged at a level most consoles do not surface by default.
Changing validity or the renewal threshold is not retroactive. It affects certificates issued after the change; certificates already issued keep the expiry they were given.
A template cannot be deleted while a live certificate still references it. Retire it — set it inactive — instead, or reissue the certificates under a replacement template first.