> For AI agents: [llms.txt](https://docs.trustedauth.com/llms.txt) provides a Markdown index of this documentation.

# Create the PIV - Key Management template

1. On the **Microsoft CA** machine, go to **Start > Windows Administrative Tools >** **Certification Authority**.

2. Click your Certificate Authority to expand the root folder.

   ![Root Folder](/assets/images/root-folder-f70cabd09cdf2326b9799c92cb6c3af3.png)

3. To set the user permissions, right-click **Certificate Templates**, and then select **Manage**. The **Certificate Templates Console** appears.

   ![Certificate Templates Console](/assets/images/certificate-templates-console-a0ed824eb7d67ce9219bd3d7541885cc.png)

4. Scroll the template list, right-click the **PIV - PIV Authentication** template and select **Duplicate Template**. The **Properties of New Template** dialog box appears.

   ![Piv Key Management](/assets/images/piv-key-management-4e575dd5c34055a2158dc1999462f218.png)

5. Click the **General** tab, and configure the following settings:

   1. In the **Template display name** field, enter PIV - Key Management. The Template name field is filled in automatically with the template display name (with no spaces).
   2. Select **Publish certificate in Active Directory**.

6. Click the **Request Handling** tab, and do the following:

   1. From the **Purpose** drop-down list, select **Encryption**.

      When asked to confirm the change, click **Yes**.

      ![Request Handling Confirmation](/assets/images/request-handling-confirmation-7b3c712b33a2456488fa5d22911f089a.png)

   2. Optional. If you want the key to be archived and available for recovery, select **Archive the subject's private key**.

7. Click the **Extensions** tab.

8. Select **Application Policies**, and then click **Edit**. The **Edit Application Policies Extension** dialog box appears.

9. Add the **Secure Email** policy to the list of application policies, as follows:

   1. On the **Edit Application Policies Extension** dialog box, click **Add**. The **Add Application Policy** dialog box appears.
   2. Scroll the **Application policies** list and select **Secure Email**, and then click **OK**.

10. On the **Edit Application Policies Extension** dialog box, remove the application policies that are not required.

    1. Select **Any Purpose** and click **Remove**.
    2. Select **Client Authentication** and click **Remove**.
    3. Select **Smart Card Logon** and click **Remove**.
    4. Click **OK** to close the dialog box.

11. In the **Extensions** tab, select **Issuance Policies** and then click **Edit**. The **Edit Issuance Policies** dialog box appears.

12. On the **Edit Issuance Policies** dialog box, select `id-fpki-common-authentication` and then click **Remove**.

13. Click **OK** to close the dialog box.

14. If you selected to **Publish certificate in Active Directory**, do the following:

    1. Click the **Issuance Requirements** tab.
    2. Select **The number of authorized signatures** and enter 1 in the text box.
    3. From the **Policy type required in signature** drop-down list, select **Application policy**.
    4. From the **Application policy** drop-down list, select **Certificate Request Agent**.

15. Click **OK** to close the Properties dialog box.

    The **PIV - Key Management** certificate template is added to the list of templates.