On my NPS server which is also a Domain Controller, the Issuing CA has for some reason automatically given the Domain Controller a certificate based on the "Domain Controller" certificate template.

I wanted to give the NPS server a certificate based on the "RAS and IAS" certificate template which it could use to authenticate itself to network clients, but I noticed the "Domain Controller" certificate that was already issued can be used for "Server Authentication". So is there a need to issue the "RAS and IAS" certificate now? Can the NPS server just use the "Domain Controller" certificate to authenticate itself to network clients?

2 Answers 2


The templates include, among other things, a list of Key Usage (KU) and Extended Key Usage (EKU) fields that you would like in the issued certificate. Outside of very specific Microsoft services, the template field itself is not checked when evaluating a certificate (it is a Microsoft-only field, not a standard), but basically every PKI application will use the KU and EKU fields and in fact must.

Check with the application (e.g, NPS) which KU and EKU parameters it will accept in the resulting certificate. A lot of the certificate templates basically issue Server Authentication EKU certificates making them largely equivalent, but it's still useful to use the right certificate templates for a few reasons:

  • It makes it easier to determine why that certificate was issued
  • and which component may be using it
  • You can lock down the permissions so that only a few people can issue very privileged certificates
  • You can issue and revoke certificates for each service instead of for the entire server/device

There are downsides though, including trying to force particular services to only use their specific (template) certificate when multiple certificates are installed on the same Windows server. If you're only really trying to provide simple connection security, then re-using one certificate for multiple purposes may not be an issue.


If NPS server is installed directly on domain controller, then you don't need to use separate certificate from "RAS and IAS server" certificate template, because they are interchangeable in this context.

That is, domain controller certificate can be used for RADIUS, but "RAS and IAS" certificate cannot be used for domain controller specific purposes.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .