Eventhough I've used the "LoadDefaultTemplates=0" in my CAPolicy.inf when installing my subordinate I noticed that it still issued 1 certificate after the setup. This is the CAExhange cerificate and it issued it towards it self. Now I am wondering if this is default behavior or not?

I checked the CA Exchange template and I don't see any computer accounts in there (the cert in question is issued to a computer account). I also didn't enable autoenroll yet through GPO.

The setup I use is pretty straight forward: CA1 = Offline Root CA S1 = Subordinate issuing CA

No default templates are loaded, if I go to Certification Authority -> Certificate Templates, is see that this is empty.

So now I wonder how the CAExchange cert got issued?


By default, ADCS do not use CA Exchange certificate template to generate CA Exchange certificate. Instead, ADCS uses built-in configuration for these certificates which has 1 month validity. This is normal and expected behavior and you should not worry about this. In fact, CA Exchange certificate is the only certificate can be generated by ADCS server without requiring eponymous template installed.

Why this is done? PKI Health console (pkiview.msc) relies on CA Exchange certificate to build the Enterprise CA map and would fail if no templates are installed. To workaround this, Microsoft allows ADCS to autogenerate CA Exchange certificate without installing certificate template.

  • Thanks for the detailed explanation! I didn't know that. Now I don't have to worry anymore as it is default behavior. – kevin rennenberg Feb 15 '19 at 10:51
  • Exactly, it is default behavior and you don’t need to worry. – Crypt32 Feb 15 '19 at 11:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.