> For AI agents: [llms.txt](https://docs.trustedauth.com/llms.txt) provides a Markdown index of this documentation.

# Create the Digital Signature certificate template

1. On the **Microsoft CA** machine, go to **Start > Windows Administrative Tools >** **Certification Authority**.

2. Click your Certificate Authority to expand the root folder.

   ![Root Folder](/assets/images/root-folder-f70cabd09cdf2326b9799c92cb6c3af3.png)

3. To set the user permissions, right-click **Certificate Templates**, and then select **Manage**. The **Certificate Templates Console** appears.

   ![Certificate Templates Console](/assets/images/certificate-templates-console-a0ed824eb7d67ce9219bd3d7541885cc.png)

4. Scroll the template list, right-click the **PIV - PIV Authentication** template and select **Duplicate Template**. The **Properties of New Template** dialog box appears.

   ![Piv Digital Signature](/assets/images/piv-digital-signature-8655e6b2cf8555ead7026f6f4ac46912.png)

5. Click the **General** tab, and configure the following settings:

   1. In the **Template display name** field, enter PIV - Digital Signature. The Template name field is filled in automatically with the template display name (with no spaces).
   2. Optional. Select **Publish certificate in Active Directory**.

6. Click the **Request Handling** tab.

7. From the **Purpose** drop-down list, select **Signature**.

   When asked to confirm the change, click **Yes**.

   ![Request Handling Confirmation](/assets/images/request-handling-confirmation-7b3c712b33a2456488fa5d22911f089a.png)

8. Click the **Extensions** tab.

9. Select **Application Policies**, and then click **Edit**. The **Edit Application Policies Extension** dialog box appears.

10. Add the **Secure Email** policy to the list of application policies, as follows:

    1. On the **Edit Application Policies Extension** dialog box, click **Add**. The **Add Application Policy** dialog box appears.
    2. Scroll the **Application policies** list and select **Secure Email**, and then click **OK**.
    3. On the **Edit Application Policies Extension** dialog box, remove the application policies that are not required.
    4. Select **Any Purpose** and click **Remove**.
    5. Select **Client Authentication** and click **Remove**.
    6. Select **Smart Card Logon** and click **Remove**.
    7. Click **OK** to close the dialog box.

11. In the **Extensions** tab, select **Issuance Policies** and then click **Edit**. The **Edit Issuance Policies** dialog box appears.

    1. Select `id-fpki-common-authentication` and then click **Remove**.
    2. Click **OK**.

12. If you selected to **Publish certificate in Active Directory**, complete the following:

    1. Click the **Issuance Requirements** tab.
    2. Select **The number of authorized signatures** and enter 1 in the text box.
    3. From the **Policy type required in signature** drop-down list, select **Application policy**.
    4. From the **Application policy** drop-down list, select **Certificate Request Agent**.

13. Click **OK** to close the open dialog boxes to return to the **Certificate Templates Console**.

    The **PIV - Digital Certificate** certificate template is added to the list of templates.