ECDSA Template

Welcome to Microsoft Q&A!

Thank you for reaching out and for providing the details of your requirement.

Yes, it is possible to create a custom certificate template in AD CS on Windows Server 2019 for an ECDSA/ECC certificate. However, there is one important consideration before configuring the template, especially since you plan to use the certificate for both a VPN gateway and an internal HTTPS web application.

Certificate templates are available when AD CS is configured as an Enterprise CA. The templates are stored in Active Directory and define how certificates are issued, including their cryptographic settings, intended purpose, subject information, and enrollment permissions.

For your scenario, a practical starting point is to duplicate the built-in Web Server template and configure the new template to use a CNG/ECC cryptographic provider.

Before creating the template, however, please verify that both the VPN gateway and the internal web application's TLS implementation support ECDSA certificates and the ECC curve you intend to use.

This is important because successfully issuing an ECDSA certificate from AD CS does not necessarily mean that every VPN gateway, VPN client, load balancer, web server, or other TLS implementation can use that certificate.

The reason why you do not see an "ECDSA" certificate template is AD CS does not provide a separate built-in template named ECDSA.

Instead, ECDSA is configured through the Cryptography settings of a certificate template. The template therefore needs to use a CNG Key Storage Provider and an appropriate ECC algorithm rather than a traditional RSA configuration.

For a certificate that will be used for TLS server authentication, you should also confirm that the Server Authentication EKU is present and that the certificate contains the correct DNS name or Subject Alternative Name (SAN) used by clients to access the service.

I would like to recommended you configuration that can help you.

Before creating the template, please confirm the following prerequisites:

• AD CS is configured as an Enterprise CA, rather than a Standalone CA.
• Active Directory Domain Services and the issuing CA are functioning correctly.
• Your administrative account has the required permissions to manage certificate templates.
• The AD CS management tools are installed.
• The VPN gateway and internal web application support ECDSA/ECC certificates.
• You know the DNS/FQDN names that clients will use for the VPN endpoint and web application.
• You have a small security group or limited set of systems available for pilot testing.

Once these prerequisites are confirmed, create the template as follows:

1. On the CA or administrative server, open certtmpl.msc.
2. Locate the Web Server template, right-select it, and select Duplicate Template.
3. On the Compatibility tab, configure the CA and certificate recipient compatibility levels appropriate for the environment.
4. On the General tab, give the template a descriptive name, for example ECDSA TLS Server, and configure the certificate validity and renewal periods according to your organization's PKI policy.
5. On the Request Handling tab, keep the certificate purpose appropriate for TLS server authentication. I recommend leaving private-key export disabled unless the VPN gateway or application specifically requires the certificate and private key to be transferred, for example as a PFX file.
6. On the Cryptography tab, select a Key Storage Provider, rather than a legacy CSP, and configure the ECDSA/ECC algorithm and curve supported by the VPN gateway and web application.
7. On the Extensions tab, confirm that Server Authentication (1.3.6.1.5.5.7.3.1) is included under Application Policies. Avoid adding additional EKUs unless the consuming application specifically requires them.
8. On the Subject Name tab, configure the Subject/SAN according to your enrollment method. If you need to use Supply in the request, make sure enrollment permission is tightly restricted because the requester can provide the certificate identity information.
9. On the Security tab, grant Read and Enroll only to the security group or computer accounts that actually require this template. Avoid granting broad enrollment permissions.
10. Save the new template.

After creating the template, open certsrv.msc, expand the issuing CA, and select:

Certificate Templates > New > Certificate Template to Issue

Select the new ECDSA TLS Server template and allow sufficient time for Active Directory replication if the template is not immediately available.

Please validate with one certificate before production deployment.

Before deploying this configuration to both production services, I strongly recommend enrolling one pilot certificate first.

For that pilot certificate, verify that:

• The expected ECC/ECDSA public-key algorithm is being used.
• Server Authentication is present.
• The Subject/SAN contains the exact DNS/FQDN that clients use.
• The complete issuing and root CA certificate chain is trusted.
• CRL or other configured certificate revocation checking works correctly.
• The private key is available to the service that needs it.
• The VPN gateway can successfully use the certificate.
• The web application/server can successfully bind and use the certificate for TLS.
• The expected VPN and HTTPS clients can successfully establish connections.

If all of these checks succeed, you can then expand enrollment to the intended production systems.

• Important consideration for the VPN gateway and web application

I would avoid selecting a specific ECC curve or changing the key-usage configuration only because it is used in another AD CS example.

The correct cryptographic settings ultimately depend on what the specific VPN gateway and web/TLS platform support.

It is therefore possible that the VPN gateway and internal web application will require different certificate settings. If their supported ECC curves, EKUs, key usages, private-key requirements, or enrollment methods are different, using separate certificate templates would be more appropriate than trying to make one template satisfy both products.

Moreover, I want to clarify the support boundary so that the next steps are clear.

Microsoft Q&A can help with configuring and troubleshooting the Windows Server 2019 AD CS infrastructure and certificate template. However, without knowing the specific VPN gateway product and web application/TLS implementation, it is not possible to confirm their end-to-end ECDSA compatibility based only on the AD CS configuration.

If AD CS successfully enrolls and issues the ECDSA certificate, but the VPN gateway or application does not accept or use it, I recommend checking the respective product documentation or contacting the product vendor to confirm its supported:

• Certificate signature/public-key algorithms
• ECC curves
• EKUs and Key Usage requirements
• TLS versions and cipher support
• Subject/SAN requirements
• Certificate/private-key import formats

This validation is important because it helps determine whether the issue is on the AD CS/template side or is instead a compatibility requirement of the VPN gateway or application.

I hope this helps clarify both the ECDSA template configuration and the validation required before deploying it to your VPN gateway and internal web application.

References:

Manage Certificate Templates in Windows Server | Microsoft Learn

Configure the Server Certificate Template for Network Remote Access | Microsoft Learn

Request and Renew AD CS Certificates - Windows Server | Microsoft Learn

If you find it useful, please click Accept Answer.

Thank you for choosing Microsoft Q&A.