A blank template editor is where certificate policy mistakes are born. goca doesn't hand you one: first boot on a regular instance seeds eighteen starting points — TLS server (ECDSA and PQC variants), TLS client, smartcard logon, S/MIME signing and encryption, code signing, OCSP signing, timestamping, device identity, the root-ca/ica/qualified-ica CA profiles, and the eIDAS-profile templates: QWAC, QSeal, QSigC and their PSD2 variants. (Profiles matching the eIDAS shapes — not a certification claim.)
Three deliberate choices in the seeding are worth reading as policy advice:
- Seeded unbound. No
issuerRef— a starter must never name a CA that may not exist in your estate. Binding a CA is your first act before a template can issue. - Dangerous profiles arrive gated. CA profiles and code signing demand n-of-m approval out of the box.
- Your edits win, permanently. Seeding is per name and happens once; a template you have changed is never re-written by a later restart.
Treat the library as reviewed starting points, not defaults to ship blind: open each one you intend to use, read what it asserts, and make binding it a decision.
Now I know what first boot seeded — and that binding a CA is my first act.