Tools · Identity defense · 11 / 25
AD CS: an issued-certificate row is not a sign-in
A row from the CA’s issued-certificate view shows a request id, a requester, a subject, and a not-after time. It does not show that the certificate was used to sign in.
The row is an issuance record
The CA can list certificates it has issued: a request id, the account that requested it, the subject name printed on it, and the time it stops being valid. That is what this row can support. It is a record that issuance happened, with those fields.
It is not a sign-in log. Nothing on the row says the certificate was presented anywhere. A template finding from a separate export is also not this row. Do not paste a template label onto an issuance and call the result a sign-in.
Requester and subject are two fields
Write the requester and the subject as two values. If they are the same string, say they match on this row. If they differ, say they differ, and stop. A difference is a fact about the issuance. It is not, by itself, a description of how the certificate was used, and this lesson does not add that description.
Not-after is the end of validity printed on the certificate. It is not the time of a sign-in, and it is not proof the certificate is still in use.
What to file
File the request id, requester, subject, not-after, and the template name if the row includes it. File “sign-in not in this row.” If a template audit exists, cite it as a different source. Do not add steps for requesting or presenting a certificate. Those steps are not in the row.
Worked case: matching names read as a sign-in
The lab CA lists request 100, requester riley, subject riley, not-after 2027-01-15, template LabWifi. A separate template export had flagged LabWifi. A draft says riley signed in with a certificate from that template.
The note quotes the four fields and says the requester and subject match. It says sign-in is not in this row. The template export stays a configuration citation, not a sentence about this certificate being presented. No one is disabled from this row alone.
request: 100 requester: riley subject: riley not-after: 2027-01-15 template on the row: LabWifi sign-in: not in this row names: match
Diagram
An issuance row versus a sign-in
The CA recorded a certificate. It did not record a logon.
Request id. Which issuance
Requester and subject. Two names, which may match or differ
Not-after. When the certificate stops being valid
A sign-in. No service, no IP, no time of use
A procedure. No steps for requesting or presenting it
A template story. A template export is a different source
Check yourself
1. What does an issued-certificate row show?
2. Requester and subject are both riley. What may you write?
3. A template export flagged the same template. How do you cite it?