X.509 certificate template examples
Use the following example templates as a starting point when creating X.509 certificate templates for common PKI use cases.
Each example demonstrates a recommended template configuration, including key settings, certificate extensions, and usage constraints. You can use these examples as provided or customize them to meet your organization's security, compliance, and operational requirements.
Template | Description |
|---|---|
Issues certificates for user, device, or application authentication Commonly used for mutual TLS (mTLS), device identity, VPN access, and certificate-based authentication | |
Issues server certificates used to establish encrypted TLS connections Includes settings commonly required for web servers, APIs, gateways, and other TLS-enabled services | |
Issues subordinate Certificate Authority (CA) certificates that can be used to sign and issue additional certificates within a PKI hierarchy | |
Issues post-quantum ML-DSA (Dilithium) certificates Designed to provide quantum-resistant digital signatures and support post-quantum cryptography deployments | |
Issues post-quantum SLH-DSA (SPHINCS+) certificates Commonly used for providing hash-based digital signatures for environments requiring quantum-resistant authentication | |
Issues post-quantum FN-DSA (Falcon) certificates that provide quantum-resistant digital signatures with smaller signature sizes and efficient verification Suitable for environments where bandwidth, storage, or certificate size considerations are important | |
Issues certificates intended for quantum-safe key establishment scenarios using the ML-KEM algorithm Used for enabling secure key exchange in post-quantum environments | |
Issues composite certificates that combine multiple cryptographic algorithms within a single certificate to support hybrid and migration-focused PKI deployments |