AWS::PCAConnectorAD::Template EnrollmentFlagsV4
Template configurations for v4 template schema.
Syntax
To declare this entity in your Amazon CloudFormation template, use the following syntax:
JSON
{ "EnableKeyReuseOnNtTokenKeysetStorageFull" :
Boolean
, "IncludeSymmetricAlgorithms" :Boolean
, "NoSecurityExtension" :Boolean
, "RemoveInvalidCertificateFromPersonalStore" :Boolean
, "UserInteractionRequired" :Boolean
}
YAML
EnableKeyReuseOnNtTokenKeysetStorageFull:
Boolean
IncludeSymmetricAlgorithms:Boolean
NoSecurityExtension:Boolean
RemoveInvalidCertificateFromPersonalStore:Boolean
UserInteractionRequired:Boolean
Properties
EnableKeyReuseOnNtTokenKeysetStorageFull
-
Allow renewal using the same key.
Required: No
Type: Boolean
Update requires: No interruption
IncludeSymmetricAlgorithms
-
Include symmetric algorithms allowed by the subject.
Required: No
Type: Boolean
Update requires: No interruption
NoSecurityExtension
-
This flag instructs the CA to not include the security extension szOID_NTDS_CA_SECURITY_EXT (OID:1.3.6.1.4.1.311.25.2), as specified in [MS-WCCE] sections 2.2.2.7.7.4 and 3.2.2.6.2.1.4.5.9, in the issued certificate. This addresses a Windows Kerberos elevation-of-privilege vulnerability.
Required: No
Type: Boolean
Update requires: No interruption
RemoveInvalidCertificateFromPersonalStore
-
Delete expired or revoked certificates instead of archiving them.
Required: No
Type: Boolean
Update requires: No interruption
UserInteractionRequired
-
Require user interaction when the subject is enrolled and the private key associated with the certificate is used.
Required: No
Type: Boolean
Update requires: No interruption