Certificate issuance permissions control whether the CA will issue a certificate request. Certificate template permissions control who can enroll, autoenroll, or sometimes modify the template itself. Both matter, but template permissions are often more dangerous because a misconfigured template can be abused to generate certificates that authenticate with unintended privileges across Active Directory.
How certificate issuance permissions differ from certificate template permissions
Certificate issuance permissions govern the CA decision to approve or deny a request. Template permissions govern who can enroll, autoenroll, or alter the certificate template’s behaviour, which means they shape what requests can be made in the first place and what attributes those certificates may carry.
That difference matters operationally because issuance is a request-level gate, while template control is a design-level gate. A tightly locked CA can still be bypassed in practice if a template is misconfigured to allow unintended enrollment, supply attacker-controlled subject data, or expose the wrong authentication properties.
Why template permissions are usually the higher-risk control
Template permissions are often the more dangerous part of the model because they can define the certificate characteristics that downstream systems trust, not just whether a single request is approved. If the template allows broad enrollment, permissive subject handling, or unsafe EKU and mapping behaviour, the resulting certificate can become a reusable authentication artifact rather than a simple document of approval.
That is why template review should focus on who can enroll, who can autoenroll, who can modify the template, and whether the template can produce certificates that map into privileged Active Directory paths. The AD CS Security Guide is useful here because it treats template abuse as an attack-path problem, not just a CA administration problem.
In practice, issuance permissions are usually narrower and easier to reason about, while template permissions can have hidden blast radius across the directory. A template that seems routine for one team may still become a domain escalation primitive if it can mint authentication-capable certificates for unintended principals.
How to evaluate both controls in an AD CS review
Start by separating approval authority from enrollment authority. Then check whether any template can be used to request certificates with authentication value, whether the template can be changed by non-CA owners, and whether the CA is relying on a trusted approval step to compensate for a weak template design.
That review should include certificate lifecycle and revocation assumptions, because a certificate that was issued correctly can still be dangerous if it can be reused after compromise or if its private key is exposed. The Machine Identity, PKI and Certificate Lifecycle Guide helps frame certificate handling as an ongoing control, not a one-time issuance event.
For practitioners who want a broader PKI baseline, PKI Basics Guide is useful for understanding where template rules sit in the trust chain and why certificate properties matter after issuance.
Risk and Threat Considerations
Misunderstanding the split can leave an organisation with a CA that appears controlled but still issues dangerous certificates through weak templates. The main threat is not only unauthorised issuance, but unauthorised certificate content, because certificate attributes can enable authentication paths that were never intended for the requester.
Failure mechanism: An attacker or insider abuses a permissive template to obtain a certificate with authentication-capable properties, then uses that certificate to impersonate a higher-privileged identity or persist access beyond the original request path.
Impact: The organisation may end up with silent privilege escalation, difficult-to-detect persistence, and certificate-based access that survives password resets unless the certificate, key material, and trust path are fully addressed.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1649 — Steal or Forge Authentication Certificates | AD CS template abuse can lead to certificate theft or forging for authentication. |
| Recommendation — Hunt for certificate abuse paths and detect forged or misissued authentication certificates. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | Certificate templates and issuance affect credential lifecycle and misuse risk. |
| IA-2 — Identification and Authentication (Organizational Users) | AD CS certificates can become an authentication factor for organizational users. | |
| AC-6 — Least Privilege | Template and issuance permissions should be limited to the minimum required roles. | |
| Recommendation — Apply IA-5 to govern certificate lifecycle, issuance, and revocation handling. Validate that certificate-based authentication is restricted to intended user populations. Restrict template administration and enrollment to the minimum necessary access. | ||
| CIS Controls v8 | CIS-5 — Account Management | Certificate enrollment and template administration are account-governed access paths. |
| Recommendation — Review and remove unnecessary enrollment and template administration privileges. | ||
Practitioner Guidance
What to verify: Confirm whether the CA approval policy and the template ACLs are being reviewed separately. If a template can be enrolled by more users than can be approved by the CA, treat the template as the more sensitive control surface and review it first.
Decision rule: If a template can issue certificates that authenticate to Active Directory, prioritise template ACLs, subject controls, and mapping behaviour before focusing on issuance approval workflows. If the template cannot create an authentication-capable certificate, the risk is usually narrower and easier to contain.
What practitioners underestimate: The most damaging AD CS failures often come from apparently minor template permissions, not from the CA’s issuance button itself. A safe approval process does not compensate for a template that can mint the wrong certificate in the wrong hands.
Practitioner takeaway: Treat issuance permissions as the gate that answers “may this request be approved?” and template permissions as the gate that answers “what dangerous certificate could be created at all?”
Related resources from NHI Mgmt Group
- Which frameworks apply to AD CS template abuse and identity escalation?
- How should security teams reduce the risk of AD CS abuse when a certificate authority can be tricked into trusting attacker-supplied data?
- How should security teams use decoy certificate templates to detect AD CS abuse early?
- What do teams get wrong about certificate expiration and renewal in AD CS environments?
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 31, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org