> For AI agents: [llms.txt](https://docs.trustedauth.com/llms.txt) provides a Markdown index of this documentation. # Configure Microsoft CA for PIV certificate templates ## About PIV certificate templates and permissions To create digital IDs with the correct attributes to work with Identity as a Service, first create the templates in Microsoft CA to specify the contents of the certificate, and then configure the CA to use them correctly. Personal Identity Verification (PIV) standards-based certificates - PIV is based on the U.S. government standard (FIPS 201) for identifying employees and contractors who have access to federal facilities and federal information systems. Developed by the NIST Computer Security Division in response to the 2004 Homeland Security Presidential Directive 12 (HSPD 12), PIV is based on the issuance of smart cards with biometric identification. - PIV certificates are supported on Windows 7 and later operating systems. - PIV can be used for both physical and logical access, both of which can be supported on the same smart card. ## PIV certificate templates Creating the **PIV Authentication** and **PIV - Content Signer** templates enables you to create a one key-pair credential. Creating all templates allows you to make a four key-pair credential. The procedures in this section describe how to create the following templates: | Template name | Certificate used for | | ----------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | PIV - PIV Authentication | Can be used for physical or logical access: requires a PIN in either case. See [Create the PIV - PIV Authentication certificate template](/docs/authentication-and-security/manage-certificate-authorities/configure-a-microsoft-ca/configure-microsoft-ca-for-piv-certificate-templates/create-the-piv-piv-authentication-certificate-template.md). | | PIV - Card Authentication | Usually used for physical access only: no PIN required. See [Create the PIV - Card Authentication certificate template](/docs/authentication-and-security/manage-certificate-authorities/configure-a-microsoft-ca/configure-microsoft-ca-for-piv-certificate-templates/create-the-piv-card-authentication-certificate-template.md). | | PIV - Digital Signature | Used to sign email or secure files. See [Create the Digital Signature certificate template](/docs/authentication-and-security/manage-certificate-authorities/configure-a-microsoft-ca/configure-microsoft-ca-for-piv-certificate-templates/create-the-digital-signature-certificate-template.md). | | PIV - Key Management | Used to encrypt email or secure files and manage keys. See [Create the PIV - Key Management template](/docs/authentication-and-security/manage-certificate-authorities/configure-a-microsoft-ca/configure-microsoft-ca-for-piv-certificate-templates/create-the-piv-key-management-template.md). | | PIV - Content Signer (device) | Used to sign biometric identification information. Used to sign hashes of other smart credential content. These are used for additional smart card authentication according to the PIV standards. **Note:** This template is mandatory. See [Create the PIV - Content Signer (device) certificate](/docs/authentication-and-security/manage-certificate-authorities/configure-a-microsoft-ca/configure-microsoft-ca-for-piv-certificate-templates/create-the-piv-content-signer-device-certificate-template.md). | Once you have created the certificates, you need to make them available for issuance. You also need permit the serialNumber to be added to the Subject DN of issued certificates and permit the piv-interim extension in issued certificates. See [Make PIV certificates available for issuance](/docs/authentication-and-security/manage-certificate-authorities/configure-a-microsoft-ca/configure-microsoft-ca-for-piv-certificate-templates/make-piv-certificates-available-for-issuance.md). important Before you begin, complete the procedure, [Set Certificate Authority permissions](/docs/authentication-and-security/manage-certificate-authorities/configure-a-microsoft-ca/configure-microsoft-ca-for-piv-certificate-templates/set-certificate-authority-permissions.md). ## Topics in this section [📄️PIV Authentication template Use this procedure to create the PIV-PIV Authentication certificate template.](/docs/authentication-and-security/manage-certificate-authorities/configure-a-microsoft-ca/configure-microsoft-ca-for-piv-certificate-templates/create-the-piv-piv-authentication-certificate-template.md) [📄️CA permissions After you create the PIV-PIV Authentication certificate template, you need to set the following permissions required to issue certificates with Microsoft CA:](/docs/authentication-and-security/manage-certificate-authorities/configure-a-microsoft-ca/configure-microsoft-ca-for-piv-certificate-templates/set-certificate-authority-permissions.md) [📄️Card Authentication template 1. On the Microsoft CA machine, go to Start \\> Windows Administrative Tools \\> Certification Authority.](/docs/authentication-and-security/manage-certificate-authorities/configure-a-microsoft-ca/configure-microsoft-ca-for-piv-certificate-templates/create-the-piv-card-authentication-certificate-template.md) [📄️Digital Signature template 1. On the Microsoft CA machine, go to Start \\> Windows Administrative Tools \\> Certification Authority.](/docs/authentication-and-security/manage-certificate-authorities/configure-a-microsoft-ca/configure-microsoft-ca-for-piv-certificate-templates/create-the-digital-signature-certificate-template.md) [📄️Key Management template 1. On the Microsoft CA machine, go to Start \\> Windows Administrative Tools \\> Certification Authority.](/docs/authentication-and-security/manage-certificate-authorities/configure-a-microsoft-ca/configure-microsoft-ca-for-piv-certificate-templates/create-the-piv-key-management-template.md) [📄️Content Signer device template 1. On the Microsoft CA machine, go to Tools and select Certification Authority.](/docs/authentication-and-security/manage-certificate-authorities/configure-a-microsoft-ca/configure-microsoft-ca-for-piv-certificate-templates/create-the-piv-content-signer-device-certificate-template.md) [📄️PIV certificate issuance Once you have created the certificates, you need to make them available for issuance. You also need permit the serialNumber to be added to the Subject DN of issued certificates and permit the piv-interim extension in issued certificates.](/docs/authentication-and-security/manage-certificate-authorities/configure-a-microsoft-ca/configure-microsoft-ca-for-piv-certificate-templates/make-piv-certificates-available-for-issuance.md)