# Windows Certificate Commands Cheatsheet

This is a plain-text copy of a cheatsheet published by Ellington Technologies, made for pasting into an AI assistant. It's generated from the same source file as the web page. If the two ever differ, the web page is correct: https://jeremiahellington.com/resources/cheatsheets/windows-certificate-commands

- Source (authoritative web version): https://jeremiahellington.com/resources/cheatsheets/windows-certificate-commands
- Author: Jeremiah Ellington
- Published: 2026-10-28
- Last updated: 2026-10-29
- Last reviewed: 2026-10-28
- Next scheduled review: 2027-04-30
- Applies to: Windows Server 2016 to 2025 and Windows 11: certutil, certreq, certlm.msc and certmgr.msc; the PowerShell Cert: drive in Windows PowerShell 5.1 and PowerShell 7.6 (the -DnsName, -EKU, -ExpiringInDays and -SSLServerAuthentication filters need 5.1 or 7.1 and later); the ADCSAdministration module on an enterprise issuing CA. Checked against Microsoft Learn on 2026-10-27, not lab-tested

The Windows tools for finding, checking, requesting and installing certificates, organised around four everyday jobs: renewing a server certificate, fixing an untrusted chain, moving a certificate to a new server, and publishing a template on an AD CS issuing CA.

---

Every example uses made-up people and names: the domain `corp.example.com`, the server `app01.corp.example.com` and a CA called `Example Issuing CA`. `<thumbprint>` stands for the certificate's SHA-1 thumbprint, which the first job shows you how to find. Everything here was **checked against Microsoft Learn, not lab-tested** (October 27, 2026).

Microsoft's own caution on certutil: it "isn't recommended to be used in any production code". It's a tool for looking at certificates by hand. For scripts, use the PowerShell `Cert:` drive.

## Before you start: consoles and stores

| Console | Opens |
|---|---|
| `certlm.msc` | Certificates for the local computer (all users, and services that run as the computer) |
| `certmgr.msc` | Certificates for the current user |
| `certtmpl.msc` | Certificate templates in AD DS (on a CA or a machine with the AD CS tools) |

The certutil page lists the short store names but not the console names. The console names below follow Microsoft's .NET `StoreName` documentation, which describes `My` as the store "for personal certificates", `Root` as the one "for trusted root certificate authorities" and `CertificateAuthority` (`CA` in commands) as the one "for intermediate certificate authorities".

| Name in commands | Name in the console | Holds |
|---|---|---|
| `My` | Personal | This computer's (or user's) own certificates, usually with private keys |
| `Root` | Trusted Root Certification Authorities | Trust anchors |
| `CA` | Intermediate Certification Authorities | Intermediate CA certificates |
| `NTAuth` (with `-enterprise`) | n/a | The forest's NTAuth store, used for certificate-based domain sign-in |

certutil uses the local computer's stores unless you add `-user`. In PowerShell, the same stores are `Cert:\LocalMachine\<name>` and `Cert:\CurrentUser\<name>`.

## Certificates on Windows: four everyday jobs

The next four sections each walk through one common job: renewing a server certificate before it expires, fixing a chain that a client won't trust, moving a certificate and its key to a new server, and publishing a certificate template on an issuing CA. Each one starts with a short situation, finds out what's going on with read-only commands, makes the change (each step labelled, with `-WhatIf` first wherever the command supports it), confirms it worked, and lists what to try if it didn't. A quick-reference table closes each section.

> **Important:**
> These four sections were checked against Microsoft Learn, not lab-tested. The people and names are made up, and the sample output is illustrative, not captured from a real system. No real certificate, key or thumbprint appears on this page.

> **Caution:**
> **Steps labelled "Changes this computer", "Changes the CA" or "CA submission" install, delete, import, publish or issue things.** A wrong certificate in the wrong store can break HTTPS, LDAPS or sign-in on that server. Before you run them on a production server, back up the certificate and its key (or confirm you can re-issue it), try the change on a test machine, and know how you'll undo it. Run them from an elevated prompt.

## Renew a server certificate before it expires

### The situation: an expiry warning for app01

Tuesday morning. Lee Park, who looks after the intranet at corp.example.com, gets a monitoring alert: the HTTPS certificate on `app01.corp.example.com` expires in 21 days. Staff reach the site as both `app01.corp.example.com` and `app.corp.example.com`, and both names have to keep working.

### Find out what's going on (read-only)

*Read-only*

```powershell
Get-ChildItem Cert:\LocalMachine\My -ExpiringInDays 30           # expires within 30 days
Get-ChildItem Cert:\LocalMachine\My |
    Format-List Subject, Issuer, NotAfter, Thumbprint, HasPrivateKey, DnsNameList, EnhancedKeyUsageList
Get-ChildItem Cert:\LocalMachine\My -SSLServerAuthentication    # Server Authentication EKU
Get-ChildItem Cert:\LocalMachine\My -DnsName "*.corp.example.com"
Get-ChildItem Cert:\LocalMachine -Recurse -ExpiringInDays 0      # already expired, every store
certutil -store My                    # the same Personal store, through certutil
certutil -q -v -store My              # verbose: every extension, the template and the key provider
certutil -store My <thumbprint>       # one certificate
```

*Sample output (illustrative)*

```text
PS> Get-ChildItem Cert:\LocalMachine\My -ExpiringInDays 30 | Format-List Subject, NotAfter, Thumbprint, HasPrivateKey, DnsNameList

Subject       : CN=app01.corp.example.com
NotAfter      : 11/17/2026 9:00:00 AM
Thumbprint    : <thumbprint>
HasPrivateKey : True
DnsNameList   : {app01.corp.example.com, app.corp.example.com}
```

Look for: the `NotAfter` date, `HasPrivateKey : True` (the certificate has its private key on this computer), and every name staff use in `DnsNameList`. `DnsNameList` comes from the SAN's DNS names, or from the subject if there's no SAN.

> **Note:**
> The `-SSLServerAuthentication` and `-EKU` filters also return certificates with **no** EKU at all, because Windows treats those as valid for every purpose.

### Make the change

`certreq -new` creates a new private key on this computer as well as the request file. `certreq -accept` installs the issued certificate.

`app01.corp.example.com` is an internal name, so the certificate comes from the company's enterprise CA, `Example Issuing CA`, not a public one. This request file asks for a server certificate with a SAN and the Server Authentication EKU (1.3.6.1.5.5.7.3.1), and, in `[RequestAttributes]`, names the `WebServer` template, as the example on Microsoft's certreq page does. An enterprise CA issues certificates from templates, so name one it publishes. Save it as `app01.inf`. The `[Extensions]` section carries both the SAN (2.5.29.17) and the EKU (2.5.29.37), using the `{text}` form that the certreq page's `[Extensions]` table gives for each; Microsoft's LDAPS page uses a separate `[EnhancedKeyUsageExtension]` section for the EKU instead. Both forms are documented. Keep `Exportable = FALSE` unless you have to move the key to another machine; Microsoft's certreq page says that for "a high level of security, private keys shouldn't be exportable".

*app01.inf (example)*

```ini
[Version]
Signature="$Windows NT$"

[NewRequest]
Subject = "CN=app01.corp.example.com"
KeyLength = 2048
KeySpec = 1
KeyUsage = 0xa0                ; digital signature + key encipherment
Exportable = FALSE
MachineKeySet = TRUE           ; key belongs to the computer, not to you
RequestType = PKCS10

[RequestAttributes]
CertificateTemplate = WebServer   ; the template the enterprise CA issues from

[Extensions]
2.5.29.17 = "{text}"
_continue_ = "DNS=app01.corp.example.com&"
_continue_ = "DNS=app.corp.example.com"
2.5.29.37 = "{text}1.3.6.1.5.5.7.3.1"
```

*Changes this computer: creates a key and the request*

```powershell
certreq -new .\app01.inf .\app01.req       # creates the key and the request (CSR)
certutil -dump .\app01.req                 # read-only: check names, EKU and template before you send it
```

Send the request to the CA. `-config` names the CA as `CAHostName\CAName`; replace `<CAHost>` with the CA server's name. If the CA issues it straight away, certreq saves it as `app01.cer`.

*CA submission: the CA issues a certificate from this request*

```powershell
certreq -submit -config "<CAHost>\Example Issuing CA" .\app01.req .\app01.cer
```

*Changes this computer: installs the certificate*

```powershell
certreq -accept .\app01.cer                # installs the issued certificate and links it to the key
```

`certreq -accept` needs no `-machine` here: the certreq page says the `-user` and `-machine` options aren't needed when there's an outstanding request that matches the certificate, and `certreq -new` left one on this computer.

If the CA is an enterprise CA in your forest, you can enroll from a template instead of writing an INF:

*Changes this computer: enrolls from an enterprise CA*

```powershell
certreq -enroll -machine -policyserver * WebServer   # enroll from an enterprise CA template
certreq -autoenroll -q                     # trigger autoenrollment now
gpupdate /force                            # autoenrollment also runs when Group Policy refreshes
```

> **Tip:**
> Put every name clients use in the SAN, including the one in the subject. RFC 9525 says the subject's common name "MUST NOT be used to identify a service", and modern clients match only the SAN and ignore the CN: Apple, for example, says "DNS names in the CommonName of a certificate are no longer trusted." Some older clients still fall back to the CN, but don't rely on it.

### Confirm it worked

*Read-only*

```powershell
Get-ChildItem Cert:\LocalMachine\My -DnsName "app.corp.example.com" |
    Format-List Subject, NotAfter, Thumbprint, HasPrivateKey, DnsNameList
certutil -verifystore My <thumbprint>     # check the new certificate's chain
```

Look for: a new certificate with a later `NotAfter`, `HasPrivateKey : True`, and both names in `DnsNameList`. Then point the site's HTTPS binding at the new thumbprint (in IIS Manager, or whatever runs the site) and browse to both names.

### If it didn't work

- **`HasPrivateKey` is False after `certreq -accept`.** The certificate didn't link to the key that `certreq -new` created, often because the request was made on another computer or as another user. On the computer that made the request, `certutil -repairstore My <thumbprint>` re-links an installed certificate to its private key (this changes the store).
- **One name works and the other gives a name error.** That name isn't in the SAN. Modern clients match the SAN and ignore the subject, so add it to the INF and request again.
- **The CA rejects the request or leaves it pending.** Check the template. Microsoft's checks for a template a requester can't use (in *Manage certificate templates in Windows Server*) are that the CA is an enterprise CA, the template is on that CA's issuance list (`Get-CATemplate` on the CA lists it), AD DS replication is complete, and you have Read and Enroll permissions on the template. A pending request waits for the CA administrator; once it's issued, `certreq -retrieve -config "<CAHost>\Example Issuing CA" <requestid> .\app01.cer` fetches it.

### Quick reference: renew a server certificate

| Command | What it does | Read-only or changes something |
| --- | --- | --- |
| `Get-ChildItem Cert:\LocalMachine\My -ExpiringInDays 30` | Lists Personal certificates that expire within 30 days | Read-only |
| `Get-ChildItem Cert:\LocalMachine -Recurse -ExpiringInDays 0` | Lists already-expired certificates in every store | Read-only |
| `Get-ChildItem Cert:\LocalMachine\My -SSLServerAuthentication` | Lists certificates with the Server Authentication EKU (or no EKU) | Read-only |
| `Get-ChildItem Cert:\LocalMachine\My -DnsName "*.corp.example.com"` | Finds certificates by DNS name | Read-only |
| `Get-ChildItem Cert:\LocalMachine\My -EKU "*Client Authentication*"` | Finds certificates by EKU (or no EKU) | Read-only |
| `certutil -store My` | Lists the local computer Personal store (`-user` for yours) | Read-only |
| `certutil -q -v -store My` | Verbose: every extension, the template and the key provider | Read-only |
| `certreq -new app01.inf app01.req` | Creates a private key and a request | Changes this computer |
| `certutil -dump app01.req` | Decodes a certificate, request or CRL file | Read-only |
| `certreq -submit -config "<CAHost>\Example Issuing CA" app01.req app01.cer` | Sends the request to the CA and saves the issued certificate | CA submission (the CA issues a certificate) |
| `certreq -retrieve -config "<CAHost>\Example Issuing CA" <requestid> app01.cer` | Fetches a certificate after the CA has issued a pending request | Writes a file (certificate only) |
| `certreq -accept app01.cer` | Installs the issued certificate and links it to the key | Changes this computer |
| `certreq -enroll -machine -policyserver * WebServer` | Enrolls from an enterprise CA template | Changes this computer |
| `certreq -autoenroll -q` | Triggers autoenrollment now | Changes this computer |
| `certutil -repairstore My <thumbprint>` | Re-links an installed certificate to its private key | Changes this computer |

## Fix a chain a client won't trust

### The situation: an untrusted root on a new laptop

Ana Silva at corp.example.com rebuilt a laptop from a fresh Windows image. Now every internal site warns that its certificate isn't trusted, though the same sites work on everyone else's machine. The internal certificates come from `Example Issuing CA`, which chains to the company's own root.

### Find out what's going on (read-only)

Copy the site's certificate to the laptop as `app01.cer` (export it from the browser, or from `certlm.msc` on the server without the key), then:

*Read-only*

```powershell
certutil -verify .\app01.cer              # build the chain and check it with the local stores
certutil -verify -urlfetch .\app01.cer    # also fetch and check the AIA and CDP URLs
certutil -store Root                      # trusted roots (local computer)
certutil -store CA                        # intermediates; also what "certutil -store" shows with no store name
certutil -enumstore                       # list the store names on this computer
certutil -enterprise -store NTAuth       # CAs in the forest's NTAuth store
certutil -dump .\example-root-ca.cer      # decode the root you plan to trust
certutil -hashfile .\example-root-ca.cer SHA256   # file hash, to compare two copies
```

`-urlfetch` downloads the issuer certificates (AIA) and CRLs (CDP) named in the certificate, so it needs network access to those addresses.

*Sample output (illustrative, trimmed)*

```text
PS> certutil -verify .\app01.cer
Issuer:
    CN=Example Issuing CA
Subject:
    CN=app01.corp.example.com
...
A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider.
```

Look for: whether the chain stops at the root (the root is missing from `Root`) or before it (an intermediate is missing from `CA`, and `-urlfetch` can't fetch it either). Compare the root's `-hashfile` output with a copy you got from the CA administrator another way.

### Make the change

Add the company root to the laptop's trusted roots. Before you add it by hand, ask the CA administrator how other machines get this root; if that process skipped the rebuilt laptop, fix it too.

*Changes this computer: every user and service will trust this root*

```powershell
certutil -addstore Root .\example-root-ca.cer   # every user and service on this computer will trust this root
```

### Confirm it worked

*Read-only*

```powershell
certutil -verify .\app01.cer
certutil -verifystore My <thumbprint>     # on the server: check a certificate that's already installed
```

The untrusted-root message should be gone. Then reopen the site in the browser.

### If it didn't work

- **It still fails, but now at the intermediate.** The laptop can't reach the AIA address, or the intermediate isn't published there. Run `certutil -verify -urlfetch` from the laptop to see which address fails, and fix the network path or the CA's publication rather than piling certificates into stores.
- **Smart card or certificate sign-in to the domain still fails.** That uses the forest's NTAuth store, not the laptop's Root store. Check that `certutil -enterprise -store NTAuth` lists the issuing CA, and talk to whoever runs the CA.

### Quick reference: chain and trust

| Command | What it does | Read-only or changes something |
| --- | --- | --- |
| `certutil -verify app01.cer` | Builds the chain and checks it with the local stores | Read-only |
| `certutil -verify -urlfetch app01.cer` | Also fetches and checks the AIA and CDP URLs | Read-only (connects over the network) |
| `certutil -verifystore My <thumbprint>` | Checks a certificate that's already installed | Read-only |
| `certutil -store Root` / `certutil -store CA` | Lists trusted roots / intermediates | Read-only |
| `certutil -enumstore` | Lists the store names on this computer | Read-only |
| `certutil -enterprise -store NTAuth` | Shows the CAs in the forest's NTAuth store | Read-only |
| `certutil -hashfile file.cer SHA256` | File hash, to compare two copies | Read-only |
| `certutil -addstore Root example-root-ca.cer` | Trusts a root for every user and service on this computer | Changes this computer |

## Move a certificate to a new server

### The situation: app01 moves to new hardware

The intranet is moving from `app01` to a new server, and Lee wants the new box to answer as `app.corp.example.com` with the same certificate until the next renewal. The old certificate has to go from `app01` once the move is done.

### Find out what's going on (read-only)

*Read-only*

```powershell
Get-ChildItem Cert:\LocalMachine\My -DnsName "app.corp.example.com" |
    Format-List Subject, NotAfter, Thumbprint, HasPrivateKey
certutil -store My <thumbprint>
```

Look for: `HasPrivateKey : True`. Without the key on this computer, there's nothing to move: request a new certificate on the new server instead (see the first job).

### Make the change

On the old server, export the certificate and key. Leave the password off the command line, so it doesn't end up in your shell history.

> **Note:**
> **Verify on your system:** Microsoft's certutil page lists the `-p Password` option for `-exportPFX` and `-importPFX` but doesn't say what happens when you leave it off. Expect certutil to ask for the password; if your version doesn't, stop and check `certutil -exportPFX -?` rather than typing the password into the command.

*Changes this computer: writes the private key to a file*

```powershell
certutil -exportPFX My <thumbprint> .\app01.pfx  # exports certificate AND private key
```

On the new server, import it. certutil's `NoExport` modifier "Makes the private key non-exportable", which matches the `Exportable = FALSE` advice in the first job.

*Changes this computer: imports the certificate and key*

```powershell
certutil -importPFX My .\app01.pfx NoExport      # imports certificate and key into the local computer Personal store; the key can't be exported again
```

Before you touch `app01`, bind the certificate to the site on the new server, test HTTPS against the new server, and move traffic to it. Only then remove the old copy from `app01` and delete the PFX. Try `-WhatIf` on the PowerShell command first.

*Changes app01: removes the old certificate and key*

```powershell
Remove-Item Cert:\LocalMachine\My\<thumbprint> -WhatIf      # on app01: preview
Remove-Item Cert:\LocalMachine\My\<thumbprint> -DeleteKey   # on app01: deletes the certificate and its private key
certutil -delstore My <thumbprint>               # or: deletes the certificate from the store
```

> **Warning:**
> A PFX file holds the private key. Treat it like a password: protect it with a strong password, don't email it, and delete working copies when you're done. Leave the password off the command line (don't use `-p`), so it doesn't end up in your shell history. Never add certutil's `-privatekey` option to output you'll share; Microsoft describes it as "Display password and private key data".

### Confirm it worked

*Read-only*

```powershell
Get-ChildItem Cert:\LocalMachine\My -DnsName "app.corp.example.com" |
    Format-List Subject, NotAfter, Thumbprint, HasPrivateKey   # on the new server: HasPrivateKey True
certutil -verifystore My <thumbprint>
```

On `app01`, the same `Get-ChildItem` should return nothing. Then delete the working copy of `app01.pfx`.

### If it didn't work

- **The export refuses.** The key was created with `Exportable = FALSE`, which is the safer default. Request a new certificate on the new server instead of trying to force the key out.
- **The import works but `HasPrivateKey` is False.** Run `certutil -repairstore My <thumbprint>` on the new server to re-link the certificate to its key, then check again.

### Quick reference: move a certificate

| Command | What it does | Read-only or changes something |
| --- | --- | --- |
| `certutil -store My <thumbprint>` | Shows one certificate | Read-only |
| `certutil -exportPFX My <thumbprint> app01.pfx` | Exports the certificate and private key | Changes this computer (writes the key to a file) |
| `certutil -importPFX My app01.pfx NoExport` | Imports certificate and key into the local computer Personal store, key not exportable | Changes this computer |
| `Remove-Item Cert:\LocalMachine\My\<thumbprint> -WhatIf` | Previews the delete | Read-only (preview) |
| `Remove-Item Cert:\LocalMachine\My\<thumbprint> -DeleteKey` | Deletes the certificate and its private key | Changes this computer |
| `certutil -delstore My <thumbprint>` | Deletes the certificate from the store | Changes this computer |
| `certutil -repairstore My <thumbprint>` | Re-links an installed certificate to its private key | Changes this computer |

## Publish a template on the issuing CA (AD CS)

### The situation: a pilot web server template

Morgan Diaz, who runs `Example Issuing CA`, has built a new template with the short name `PilotWebServer` in `certtmpl.msc`. Two web teams want to try it before it replaces the old one, so Morgan needs the CA to start issuing it without disturbing anything else.

### Find out what's going on (read-only)

Run these on an enterprise issuing CA with the ADCSAdministration module. `Get-CATemplate` lists what the CA issues; template names are short names without spaces, not display names.

*Read-only (-WhatIf previews; nothing runs)*

```powershell
Get-CATemplate
Add-CATemplate -Name "PilotWebServer" -WhatIf     # preview only
```

Look for: `PilotWebServer` isn't in the list yet, and the `-WhatIf` preview names the template you expect.

### Make the change

*Changes the CA*

```powershell
Add-CATemplate -Name "PilotWebServer"      # the CA starts issuing this template
```

> **Caution:**
> Publishing a template lets everyone with Enroll permission on it request certificates. Microsoft's advice is to pilot a new template on a narrow group first, so check who has Enroll permission before you publish.

### Confirm it worked

*Read-only*

```powershell
Get-CATemplate                             # PilotWebServer is now listed
```

Then ask one of the pilot teams to enroll a test server with `certreq -enroll -machine -policyserver * PilotWebServer`.

### If it didn't work, or you need to roll back

- **You need to undo it.** Microsoft says "the usual first rollback action is to remove the new template from the affected CA's issuance list, not delete its AD DS object". Preview, then remove it. Removing a template doesn't revoke certificates already issued from it.
- **Don't use `Remove-CATemplate -AllTemplates` to undo one template:** it removes every removable template from the CA.

*Changes the CA: preview with -WhatIf first*

```powershell
Remove-CATemplate -Name "PilotWebServer" -WhatIf  # preview only
Remove-CATemplate -Name "PilotWebServer"   # the CA stops issuing it; issued certificates stay valid
```

### Quick reference: AD CS templates

| Command | What it does | Read-only or changes something |
| --- | --- | --- |
| `Get-CATemplate` | Lists the templates the CA issues | Read-only |
| `Add-CATemplate -Name "PilotWebServer" -WhatIf` | Previews publishing a template | Read-only (preview) |
| `Add-CATemplate -Name "PilotWebServer"` | The CA starts issuing the template | Changes the CA |
| `Remove-CATemplate -Name "PilotWebServer" -WhatIf` | Previews removing a template | Read-only (preview) |
| `Remove-CATemplate -Name "PilotWebServer"` | The CA stops issuing it; issued certificates stay valid | Changes the CA |

## Related

- [OpenSSL certificate inspection](https://jeremiahellington.com/resources/cheatsheets/openssl-certificate-inspection): the same checks from Linux or macOS, including a live server with `s_client`.
- [Certificates explained](https://jeremiahellington.com/resources/certificates-explained): what the subject, SAN, EKU, chain and CRL fields mean.

---

## Sources and official documentation

- [Microsoft Learn: certutil](https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/certutil)
- [Microsoft Learn: certreq](https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/certreq_1)
- [Microsoft Learn: How to view certificates with the MMC snap-in (certlm.msc and certmgr.msc)](https://learn.microsoft.com/en-us/dotnet/framework/wcf/feature-details/how-to-view-certificates-with-the-mmc-snap-in)
- [Microsoft Learn: about_Certificate_Provider (PowerShell 7.5)](https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.security/about/about_certificate_provider?view=powershell-7.5)
- [Microsoft Learn: about_Certificate_Provider (Windows PowerShell 5.1)](https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.security/about/about_certificate_provider?view=powershell-5.1)
- [Microsoft Learn: StoreName enum (what My, Root and CertificateAuthority hold)](https://learn.microsoft.com/en-us/dotnet/api/system.security.cryptography.x509certificates.storename)
- [Microsoft Learn: X509Certificate2.HasPrivateKey](https://learn.microsoft.com/en-us/dotnet/api/system.security.cryptography.x509certificates.x509certificate2.hasprivatekey)
- [Microsoft Learn: Configure certificates for LDAP over SSL in AD DS](https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/configure-ldap-signing-certificates)
- [Microsoft Learn: Windows Hello for Business on-premises certificate trust deployment guide (certutil -q -v -store my, certreq -autoenroll -q, NTAuth)](https://learn.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/deploy/on-premises-cert-trust)
- [Microsoft Learn: Manage certificate templates in Windows Server](https://learn.microsoft.com/en-us/windows-server/identity/ad-cs/manage-certificate-templates)
- [Microsoft Learn: Get-CATemplate](https://learn.microsoft.com/en-us/powershell/module/adcsadministration/get-catemplate?view=windowsserver2025-ps)
- [RFC 9525: Service Identity in TLS (the SAN, not the common name, identifies the server)](https://www.rfc-editor.org/rfc/rfc9525)
- [Apple: Requirements for trusted certificates in iOS 13 and macOS 10.15 (SAN, not CommonName)](https://support.apple.com/en-us/103769)
- [Microsoft Learn: Add-CATemplate](https://learn.microsoft.com/en-us/powershell/module/adcsadministration/add-catemplate?view=windowsserver2025-ps)
- [Microsoft Learn: Remove-CATemplate](https://learn.microsoft.com/en-us/powershell/module/adcsadministration/remove-catemplate?view=windowsserver2025-ps)

## Review history

- Technical review: Jeremiah Ellington, 2026-10-28
- Editorial review: Jeremiah Ellington, 2026-10-28