Merge pull request #124363 from Chris-Hailes/main

Update to enterprise ca certificate requirements for Azure Premium Firewall

Author: v-dirichards

articles/firewall/media/premium-deploy-certificates-enterprise-ca/certificate-template-key-usage-extension.png

@@ -28,12 +28,28 @@ To use an Enterprise CA to generate a certificate to use with Azure Firewall Pre
 - an [Azure Key Vault](premium-certificates.md#azure-key-vault) 
 - a Managed Identity with Read permissions to **Certificates and Secrets** defined in the Key Vault Access Policy 
 
+## Create a new Subordinate Certificate Template
+
+1. Run `certtmpl.msc` to open the Certificate Template Console.
+2. Find the **Subordinate Certification Authority** template in the console.
+3. Right-click on the **Subordinate Certification Authority** template and select **Duplicate Template**.
+4. In the **Properties of New Template** window, go to the **Compatibility** tab and set the appropriate compatibility settings or leave them as default.
+5. Go to the **General** tab, set the **Template Display Name** (for example: `My Subordinate CA`), and adjust the validity period if necessary. Optionally, select the **Publish certificate in Active Directory** checkbox.
+6. In the **Settings** tab, ensure the required users and groups have read and `enroll` permissions.
+7. Navigate to the **Extensions** tab, select **Key Usage**, and select **Edit**.
+   - Ensure that the **Digital signature**, **Certificate signing**, and **CRL signing** checkboxes are selected.
+   - Select the **Make this extension critical** checkbox and select **OK**.
+   
+   :::image type="content" source="media/premium-deploy-certificates-enterprise-ca/certificate-template-key-usage-extension.png" alt-text="Screenshot of certificate template key usage extensions.":::
+8. Select **OK** to save the new certificate template.
+9. Ensure the new template is enabled so it can be used to issue certificates.
+
 ## Request and export a certificate
 
 1. Access the web enrollment site on the Root CA, usually `https://<servername>/certsrv` and select **Request a Certificate**.
 1. Select **Advanced Certificate Request**.
 1. Select **Create and Submit a Request to this CA**.
-1. Fill out the form using the Subordinate Certification Authority template.
+1. Fill out the form using the Subordinate Certification Authority template created in the previous section.
    :::image type="content" source="media/premium-deploy-certificates-enterprise-ca/advanced-certificate-request.png" alt-text="Screenshot of advanced certificate request":::
 1. Submit the request and install the certificate.
 1. Assuming this request is made from a Windows Server using Internet Explorer, open **Internet Options**.