Can a single NDES server support multiple certificate templates?

Sreeram Raju 40 Reputation points
2026-07-30T05:20:39.4266667+00:00

Hello Team,

My internal PKI team mentioned that a Network Device Enrollment Service (NDES) server can only be configured to issue one certificate template, and that supporting multiple templates on a single NDES instance isn't possible.

Is this statement accurate? What are the limitations or supported workarounds if we need to issue multiple certificate types using NDES?

Windows for business | Windows Server | Directory services | Certificates and public key infrastructure (PKI)
0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Ivy Bui (WICLOUD CORPORATION) 515 Reputation points Microsoft External Staff Moderator
    2026-07-30T07:01:22.6066667+00:00

    Hello Sreeram Raju

    Thank you for contacting Microsoft Q&A.

    The statement that an NDES server can only issue a single certificate template is not entirely accurate.

    A single NDES server can support multiple certificate templates by configuring separate template mappings for different certificate request types. NDES uses three registry-based template mappings:

    • SignatureTemplate for requests containing signing key usage
    • EncryptionTemplate for requests containing encryption key usage
    • GeneralPurposeTemplate for requests containing both signing and encryption key usages

    Based on the key usage specified in the incoming SCEP request, NDES selects the corresponding certificate template and submits the request to the Certification Authority (CA).

    The main limitation is that a single NDES instance supports up to three template mappings through these configuration settings. If your environment requires more than three distinct certificate templates, the typical approaches are:

    • Deploy additional NDES servers and configure different template mappings on each server.
    • Review whether some certificate templates can be consolidated to reduce the number of templates required.

    Therefore, a single NDES server is capable of issuing multiple certificate types; however, the number of certificate templates that can be directly mapped and used by one NDES instance is limited by the available NDES template mappings.

    Hope you found something helpful here. Please let me know if you need further assistance.

    If this answer could solve the issue, it's appreciated to accept the answer.

    Thank you again for your patience and support!

    Ivy Bui

    Was this answer helpful?

    0 comments

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.