Templates Decide Content — Operator training

A requester sends a CSR stuffed with subject fields, SANs and extensions. How much of that lands in the certificate? In goca: none of it, unless a template says so.

The guiding rule: the CSR is a key carrier, not a content authority. Every subject field, SAN and extension in the final certificate comes from the template, drawing from declared sources with fixed precedence: fixed (the template's own value — always wins) → ra (trusted attributes supplied by a registered RA, outside the CSR) → csr (only where the template explicitly allows it). Anything the CSR contains that the template doesn't source is ignored — not negotiated, not warned about downstream: ignored.

This inversion is the whole security model of certificate content. The requester proves possession of a key; what gets asserted about that key is your policy's decision, written down once, versioned, and enforced identically on every channel.

Metaphor: a passport office. You bring the photo; the office decides every field printed, from its own records.

Where it breaks: a passport office copies your name from documents you hand it. A template reads only the CSR fields it explicitly sources — the default is not "trust the applicant".

Now I can say who decides what goes in a certificate — and it isn't the CSR.