AD CS: disposition is the request’s state

The state is a field

A certificate-authority request list can show a disposition: issued, pending, denied, or another word the console uses. That word is the state of the request. It is not a guess about what someone hoped would happen.

Only a row whose disposition says issued is an issued certificate in that view. Pending means the CA has not issued it. Denied means the CA refused it. Do not describe a pending or denied row as a certificate that exists.

Stop at the state

This page does not explain how to make a request succeed. The field is for reading. If the word is denied, the note says denied. It does not add a procedure. If the word is issued, you still do not have a sign-in; that would be a different log.

A template name on the same row is which template the request used. It does not change the disposition. A flagged template elsewhere does not turn a denied request into an issued one.

What to file

File the request id, the disposition word as printed, the requester, and the template name if the row has it. If you did not see the disposition column, write “disposition not in the paste” and do not assume issued.

Worked case: a pending row called a certificate

Request 240 on the lab CA shows disposition Pending, requester riley, template LabWifi. A draft says a LabWifi certificate was issued to riley and should be treated as a credential in use.

The note quotes disposition Pending and says no certificate was issued in this row. There is no sign-in to cite. The template name is recorded as the template on the request, not as proof a certificate exists. The draft’s “in use” line is removed.

request: 240
disposition: Pending
requester: riley
template: LabWifi
certificate issued: no
sign-in: not in this row