Multiple policies are separated by commas. This section lists the name of the policies for this CA. Is the only required section, and must be at the beginning of your CAPolicy.inf file.

The first two lines of the CAPolicy.inf file are: Is the parameter that is to the right of the equal sign. Is the parameter that is to the left of the equal sign. A section always appears in brackets in the. INF file that covers a logical group of keys. The following key words are used to describe the. Not all the settings below are required in the file, but those that are required will be called out. It will be impossible here to define a default template suitable for all purposes, so I’m just going to describe all the options and allow you to decide which settings meet your needs. INF file structure to specify sections, settings, and values for those settings.

I’m simply going to document the available settings in the CAPolicy.inf which, if you follow Chris’ guidance, you’ll find will come in handy.Īs I mentioned earlier, the CAPolicy.inf file uses the. Please followįor that sort of information. I’m not going to discuss what settings you need for your particular configuration, nor will I offer guidance on how you should set up your PKI to meet whatever your needs may be. Once you have created your CAPolicy.inf file, you must copy it into the %systemroot% folder (e.g., C:Windows) of your server before you install ADCS or renew the CA certificate. The CAPolicy.inf can be used to configure CAs in these more complicated deployments. The CAPolicy.inf file is not required to install ADCS with the default settings, but in many cases the default settings are insufficient. The information in this post relies heavily on the information published in the Windows Server 2003 Help File, but this information is updated to include information pertinent to Windows Server 2008 R2.Īnother helpful document that discusses many of these settings is available onįirst, what is a CAPolicy.inf file? The CAPolicy.inf contains various settings that are used when installing the Active Directory Certification Service (ADCS) or when renewing the CA certificate. On designing and implementing a PKI when I realized that it would be helpful to better document theįile. First published on TechNet on Oct 15, 2009

Inf file syntax