<div class="content" name="GetCAProperty" uuid="7c715f9f-db50-41c3-abfc-0021c6390d4e"><p>The GetCAProperty method retrieves a property value from the
<span><a href="719b890d-62e6-4322-b9b1-1f34d11535b4#gt_c925d5d7-a442-4ba4-9586-5f94ccec847a" data-linktype="relative-path">CA</a></span>.</p><dl>
<dd>
<div><pre> HRESULT GetCAProperty(
   [in, string, unique, range(1, 1536)] wchar_t const * pwszAuthority,
   [in] long PropID,
   [in] long PropIndex,
   [in] long PropType,
   [out, ref] CERTTRANSBLOB* pctbPropertyValue
 );
</pre></div>
</dd></dl><p><b>pwszAuthority: </b>Contains the name of the CA. </p><p><b>PropID: </b> An integer value that specifies the
property to be returned.</p><dl>
<dd>
<table><thead>
  <tr>
   <th>
   <p>Property name</p>
   </th>
   <th>
   <p>Numerical value</p>
   </th>
   <th>
   <p>Type/Index</p>
   </th>
   <th>
   <p>Meaning</p>
   </th>
  </tr>
 </thead><tbody><tr>
  <td>CR_PROP_FILEVERSION</td>
  <td>0x00000001</td>
  <td>String</td>
  <td>A string that MUST contain the CA version information.</td>
 </tr><tr>
  <td>CR_PROP_PRODUCTVERSION</td>
  <td>0x00000002</td>
  <td>String</td>
  <td>A string that MUST contain the build number of the CA.</td>
 </tr><tr>
  <td>CR_PROP_EXITCOUNT</td>
  <td>0x00000003</td>
  <td>Long</td>
  <td>MUST be the number of exit algorithms registered on the CA.</td>
 </tr><tr>
  <td>CR_PROP_EXITDESCRIPTION</td>
  <td>0x00000004</td>
  <td>String indexed</td>
  <td>A string that MUST contain the name of the exit algorithm identified by the PropIndex parameter.</td>
 </tr><tr>
  <td>CR_PROP_POLICYDESCRIPTION</td>
  <td>0x00000005</td>
  <td>String</td>
  <td>A string that MUST contain the description of the policy algorithm on the CA.</td>
 </tr><tr>
  <td>CR_PROP_CANAME</td>
  <td>0x00000006</td>
  <td>String</td>
  <td>A string that MUST contain the CN, as specified in [RFC3280], of a CA.</td>
 </tr><tr>
  <td>CR_PROP_SANITIZEDCANAME</td>
  <td>0x00000007</td>
  <td>String</td>
  <td>A string that MUST contain the sanitized name of the CA. More information about sanitized name is specified in section 3.1.1.4.1.1.</td>
 </tr><tr>
  <td>CR_PROP_SHAREDFOLDER</td>
  <td>0x00000008</td>
  <td>String</td>
  <td>A string that MUST contain the UNC path of a folder that contains the CA information and signature certificates.</td>
 </tr><tr>
  <td>CR_PROP_PARENTCA</td>
  <td>0x00000009</td>
  <td>String</td>
  <td>A string that MUST contain the name of the parent CA to the current CA.</td>
 </tr><tr>
  <td>CR_PROP_CATYPE</td>
  <td>0x0000000A</td>
  <td>Long</td>
  <td>MUST be a CAINFO structure that MUST contain the CA type. More information is specified in section 3.2.1.4.3.2.10.</td>
 </tr><tr>
  <td>CR_PROP_CASIGCERTCOUNT</td>
  <td>0x0000000B</td>
  <td>Long</td>
  <td>MUST be the number of signing certificates on the CA.</td>
 </tr><tr>
  <td>CR_PROP_CASIGCERT</td>
  <td>0x0000000C</td>
  <td>Binary, indexed</td>
  <td>MUST be a binary object that contains a signing certificate identified by the PropIndex parameter.</td>
 </tr><tr>
  <td>CR_PROP_CASIGCERTCHAIN</td>
  <td>0x0000000D</td>
  <td>Binary, indexed</td>
  <td>MUST be a binary object that contains the certificate chain for a signing certificate identified by the PropIndex parameter.</td>
 </tr><tr>
  <td>CR_PROP_CAXCHGCERTCOUNT</td>
  <td>0x0000000E</td>
  <td>Long</td>
  <td>MUST be 0x1.</td>
 </tr><tr>
  <td>CR_PROP_CAXCHGCERT</td>
  <td>0x0000000F</td>
  <td>Binary, indexed</td>
  <td>MUST be a binary object that contains the CA&#39;s current exchange certificate from the Current_CA_Exchange_Cert datum. The PropIndex parameter MUST be 0x0 or 0xFFFFFFFF.</td>
 </tr><tr>
  <td>CR_PROP_CAXCHGCERTCHAIN</td>
  <td>0x00000010</td>
  <td>Binary, indexed</td>
  <td>MUST be a binary object that contains the certificate chain for the CA&#39;s current exchange certificate from the Current_CA_Exchange_Cert datum. The PropIndex parameter MUST be 0x0 or 0xFFFFFFFF.</td>
 </tr><tr>
  <td>CR_PROP_BASECRL</td>
  <td>0x00000011</td>
  <td>Binary, indexed</td>
  <td>MUST be a base CRL, for a CA signing certificate identified by the PropIndex parameter.</td>
 </tr><tr>
  <td>CR_PROP_DELTACRL</td>
  <td>0x00000012</td>
  <td>Binary, indexed</td>
  <td>MUST be a delta CRL, for a CA signing certificate identified by the PropIndex parameter. For more information about delta CRLs, see [MSFT-CRL]. Additional information is specified in [RFC3280] section 5.2.</td>
 </tr><tr>
  <td>CR_PROP_CACERTSTATE</td>
  <td>0x00000013</td>
  <td>Long indexed</td>
  <td>MUST be a byte array that contains the disposition status of all CA signing certificates. Disposition status is specified in section 3.2.1.4.3.2.19.</td>
 </tr><tr>
  <td>CR_PROP_CRLSTATE</td>
  <td>0x00000014</td>
  <td>Long indexed</td>
  <td>MUST be a byte array that contains the status for all the CRLs of the CA.</td>
 </tr><tr>
  <td>CR_PROP_CAPROPIDMAX</td>
  <td>0x00000015</td>
  <td>Long</td>
  <td>MUST be the maximum property identifier supported by the CA.</td>
 </tr><tr>
  <td>CR_PROP_DNSNAME</td>
  <td>0x00000016</td>
  <td>String</td>
  <td>MUST be the fully qualified domain name (FQDN) of the computer on which the CA is installed.</td>
 </tr><tr>
  <td>CR_PROP_ROLESEPARATIONENABLED</td>
  <td>0x00000017</td>
  <td>Long</td>
  <td>Indicates whether administrative role separation has been enabled on the CA. A nonzero return value means that role separation has been enabled. Zero means that role separation has not been enabled.</td>
 </tr><tr>
  <td>CR_PROP_KRACERTUSEDCOUNT</td>
  <td>0x00000018</td>
  <td>Long</td>
  <td>MUST be the minimum number of KRAs to use when archiving a private key. For more information about KRA usage, see [MSFT-ARCHIVE].</td>
 </tr><tr>
  <td>CR_PROP_KRACERTCOUNT</td>
  <td>0x00000019</td>
  <td>Long</td>
  <td>MUST be the maximum number of KRA certificates available on the CA.</td>
 </tr><tr>
  <td>CR_PROP_KRACERT</td>
  <td>0x0000001A</td>
  <td>Binary, indexed</td>
  <td>A KRA certificate identified by the PropIndex parameter.</td>
 </tr><tr>
  <td>CR_PROP_KRACERTSTATE</td>
  <td>0x0000001B</td>
  <td>Long, indexed</td>
  <td>MUST be a byte array that contains the status of the KRA certificates registered with the CA.</td>
 </tr><tr>
  <td>CR_PROP_ADVANCEDSERVER</td>
  <td>0x0000001C</td>
  <td>Long</td>
  <td>MUST identify whether the CA operating system is an advanced server platform.</td>
 </tr><tr>
  <td>CR_PROP_TEMPLATES</td>
  <td>0x0000001D</td>
  <td>String</td>
  <td>MUST be a collection of name and OID pairs that identify the templates supported by a CA.</td>
 </tr><tr>
  <td>CR_PROP_BASECRLPUBLISHSTATUS</td>
  <td>0x0000001E</td>
  <td>Long, indexed</td>
  <td>MUST be the publishing status of a signing certificate base CRL identified by the PropIndex parameter.</td>
 </tr><tr>
  <td>CR_PROP_DELTACRLPUBLISHSTATUS</td>
  <td>0x0000001F</td>
  <td>Long, indexed</td>
  <td>MUST be the publishing status of a signing certificate delta CRL identified by the PropIndex parameter.</td>
 </tr><tr>
  <td>CR_PROP_CASIGCERTCRLCHAIN</td>
  <td>0x00000020</td>
  <td>Binary, indexed</td>
  <td>MUST be a binary object that contains the certificate chain for a signing certificate and the CRL for the certificates in the chain identified by the PropIndex parameter.</td>
 </tr><tr>
  <td>CR_PROP_CAXCHGCERTCRLCHAIN</td>
  <td>0x00000021</td>
  <td>Binary, indexed</td>
  <td>MUST be a binary object for a chain containing CRLs for the CA&#39;s current exchange certificate from the Current_CA_Exchange_Cert datum. The PropIndex parameter MUST be 0x00000000 or 0xFFFFFFFF.</td>
 </tr><tr>
  <td>CR_PROP_CACERTSTATUSCODE</td>
  <td>0x00000022</td>
  <td>Long, indexed</td>
  <td>MUST be an HRESULT that identifies the result of certificate validation, as specified in [RFC3280], by the CA for the CA signing certificates identified by the PropIndex parameter.</td>
 </tr><tr>
  <td>CR_PROP_CAFORWARDCROSSCERT</td>
  <td>0x00000023</td>
  <td>Binary, indexed</td>
  <td>MUST be a forward cross certificate, by index, from a CA. For more information about cross certificates, see [MSFT-CROSSCERT].</td>
 </tr><tr>
  <td>CR_PROP_CABACKWARDCROSSCERT</td>
  <td>0x00000024</td>
  <td>Binary, indexed</td>
  <td>MUST be a backward cross certificate, by index, from a CA. For more information about cross certificates.</td>
 </tr><tr>
  <td>CR_PROP_CAFORWARDCROSSCERTSTATE</td>
  <td>0x00000025</td>
  <td>Long, indexed</td>
  <td>MUST be a byte array that identifies the status of all backward cross certificates for a CA.</td>
 </tr><tr>
  <td>CR_PROP_CABACKWARDCROSSCERTSTATE</td>
  <td>0x00000026</td>
  <td>Long, indexed</td>
  <td>MUST be a byte array that identifies the disposition status of all forward cross certificates for a CA.</td>
 </tr><tr>
  <td>CR_PROP_CACERTVERSION</td>
  <td>0x00000027</td>
  <td>Long, indexed</td>
  <td>MUST be an indexed 32-bit integer that contains the version number of a CA signing certificate.</td>
 </tr><tr>
  <td>CR_PROP_SANITIZEDCASHORTNAME</td>
  <td>0x00000028</td>
  <td>String</td>
  <td>The property MUST return the sanitized shortened name of the CA. More information about the sanitized name is specified in section 3.1.1.4.1.1.</td>
 </tr><tr>
  <td>CR_PROP_CERTCDPURLS</td>
  <td>0x00000029</td>
  <td>String, indexed</td>
  <td>MUST be a null-terminated [UNICODE] string of the format &#34;String1\nString2\n&#34;, where each string (separated by &#39;\n&#39;) MUST represent a URI to be part of a CRL Distribution Point (CDP) extension, as specified in [RFC3280] section 4.2.1.14.</td>
 </tr><tr>
  <td>CR_PROP_CERTAIAURLS</td>
  <td>0x0000002A</td>
  <td>String, indexed</td>
  <td>MUST be a null-terminated [UNICODE] string of the format &#34;String1\nString2\n&#34;, where each string (separated by &#39;\n&#39;) MUST represent a URI to be part of Authority Information Access extension, as specified in [RFC3280] section 4.2.2.1.</td>
 </tr><tr>
  <td>CR_PROP_CERTAIAOCSPRLS</td>
  <td>0x0000002B</td>
  <td>String, indexed</td>
  <td>MUST be a null-terminated [UNICODE] string of the format &#34;String1\nString2\n&#34;, where each string (separated by &#39;\n&#39;) MUST represent the OCSP URLs configured on the CA, as specified in [RFC3280] section 4.2.2.1.</td>
 </tr><tr>
  <td>CR_PROP_LOCALENAME</td>
  <td>0x0000002C</td>
  <td>String</td>
  <td>MUST be a null-terminated [UNICODE] string in the &#39;Language-Region&#39; format (as specified in [RFC4646]) that represents the locale of the CA.</td>
 </tr><tr>
  <td>CR_PROP_SUBJECTTEMPLATE_OIDS</td>
  <td>0x0000002D</td>
  <td>String</td>
  <td>MUST be a null-terminated [UNICODE] string of the format &#34;OID1\nOID2\n&#34;, where each OID (separated by &#39;\n&#39;) MUST represent a Relative Distinguished Name that is in a certificate Subject Distinguished Name.</td>
 </tr><tr>
  <td>CR_PROP_CRLPARTITIONCOUNT</td>
  <td>0x0000002E</td>
  <td>Long</td>
  <td>MUST be the maximum number of CRL partitions configured at the CA.</td>
 </tr><tr>
  <td>CR_PROP_PARTITIONED_BASECRL</td>
  <td>0x0000002F</td>
  <td>Binary, indexed</td>
  <td>MUST be a base CRL, for a CA signing certificate and partition identified by the PropIndex parameter.</td>
 </tr><tr>
  <td>CR_PROP_PARTITIONED_DELTACRL</td>
  <td>0x00000030</td>
  <td>Binary, indexed</td>
  <td>MUST be a delta CRL, for a CA signing certificate and partition identified by the PropIndex parameter.</td>
 </tr><tr>
  <td>CR_PROP_PARTITIONED_BASECRLPUBLISHSTATUS</td>
  <td>0x00000031</td>
  <td>Long, indexed</td>
  <td>MUST be the publishing status of a base CRL, for a CA signing certificate and partition identified by the PropIndex parameter.</td>
 </tr><tr>
  <td>CR_PROP_PARTITIONED_DELTACRLPUBLISHSTATUS</td>
  <td>0x00000032</td>
  <td>Long, indexed</td>
  <td>MUST be the publishing status of a delta CRL, for a CA signing certificate and partition identified by the PropIndex parameter.</td>
 </tr></tbody></table>
</dd></dl><p><b>PropIndex: </b>This parameter is used as the index
to a property that can contain multiple values.</p><p><b>PropType: </b>An integer value that specifies the
property data type.</p><dl>
<dd>
<table><thead>
  <tr>
   <th>
   <p>Value</p>
   </th>
   <th>
   <p>Meaning</p>
   </th>
  </tr>
 </thead><tbody><tr>
  <td>PROPTYPE_LONG 0x00000001</td>
  <td>The property type is a signed long integer or a byte array.</td>
 </tr><tr>
  <td>PROPTYPE_BINARY 0x00000003</td>
  <td>The property type is binary data.</td>
 </tr><tr>
  <td>PROPTYPE_STRING 0x00000004</td>
  <td>The property type is a string.</td>
 </tr></tbody></table>
</dd></dl><p><b>pctbPropertyValue: </b>If the function succeeds,
this method returns a <span><a href="d6bee093-d862-4122-8f2b-7b49102097dc" data-linktype="relative-path">CERTTRANSBLOB</a></span>
structure in this parameter that contains the property value. If the function
fails, the content of this parameter is undefined.</p><dl>
<dd>
<p>The data type of the value returned depends on the
value specified in the <i>PropType</i> parameter and the property specified in
the <i>PropID</i> parameter.</p>
</dd></dl><p><b>Return Values: </b>For a successful invocation,
the CA MUST return 0; otherwise, the CA MUST return a nonzero value.</p><p>The processing rules for this method are as follows:</p><p>If Config_CA_Interface_Flags contains the value
IF_NOREMOTEICERTREQUEST, the server SHOULD return 0x80094011
(CERTSRV_E_ENROLL_DENIED) to the client.<a id="Appendix_A_Target_101"></a><a aria-label="Product behavior note 101" href="c8bec234-0a53-4a7c-859d-2bb7b2537da5#Appendix_A_101" data-linktype="relative-path">&lt;101&gt;</a></p><p>If Config_CA_Interface_Flags contains the value
IF_ENFORCEENCRYPTICERTREQUEST and the RPC_C_AUTHN_LEVEL_PKT_PRIVACY
authentication level, as defined in <span><a href="../ms-rpce/290c38b1-92fe-4229-91e6-4fc376610c15" data-linktype="relative-path">[MS-RPCE]</a></span>
section <span><a href="../ms-rpce/425a7c53-c33a-4868-8e5b-2a850d40dc73" data-linktype="relative-path">2.2.1.1.8</a></span>,
is not specified on the RPC connection from the client, the CA MUST refuse to
establish a connection with the client by returning a non-zero error.<a id="Appendix_A_Target_102"></a><a aria-label="Product behavior note 102" href="c8bec234-0a53-4a7c-859d-2bb7b2537da5#Appendix_A_102" data-linktype="relative-path">&lt;102&gt;</a></p><p>If the server implements <span><a href="719b890d-62e6-4322-b9b1-1f34d11535b4#gt_456bc2c5-d6e8-4ff7-a723-1a08e6d3cf09" data-linktype="relative-path">advanced CA</a></span>
functionality, it MUST implement the CR_PROP_CAXCHGCERT property that is
specified in section <span><a href="585d9359-4bc5-471f-bba7-2d9a336debdc" data-linktype="relative-path">3.2.1.4.3.2.15</a></span>.</p><p>To return server properties to the client using this method,
the server implementation MUST follow the processing rules specified as
follows.</p><ol><li><p><span>    </span>Validate
arguments: The server MUST invoke the processing rules in section <span><a href="a7fdfc72-b1e0-4882-93da-9aefdf468b83" data-linktype="relative-path">3.2.1.4.2.1.1</a></span>
with the <i>CANameString</i> input parameter set to the CA name passed in the <i>pwszAuthority</i>
parameter and the <i>EmptyNameAllowed</i> input parameter set to false. If
false is returned, the CA MUST return the E_INVALIDARG (0x80070057) error code
to the client.</p>
</li><li><p><span>    </span> Returned server
property: The server MUST follow the steps that are specified in section <span><a href="be007c96-88bc-43d8-a577-f0c4cc52e243" data-linktype="relative-path">3.2.1.4.3.2.2</a></span>.
</p>
</li></ol><p>The following table defines the values that MUST be set for
the <i>PropIndex</i> and <i>PropType</i> parameters for each property value
passed via the <i>PropID</i> parameter.</p><table><thead>
  <tr>
   <th>
   <p>PropID value </p>
   </th>
   <th>
   <p>PropIndex MUST be </p>
   </th>
   <th>
   <p>PropType MUST be </p>
   </th>
  </tr>
 </thead><tbody><tr>
  <td>0x01</td>
  <td>0x00000000</td>
  <td>0x00000004</td>
 </tr><tr>
  <td>0x02</td>
  <td>0x00000000</td>
  <td>0x00000004</td>
 </tr><tr>
  <td>0x03</td>
  <td>0x00000000</td>
  <td>0x00000001</td>
 </tr><tr>
  <td>0x04</td>
  <td>The minimum index is 0. The maximum value is one less than the value stored in the Config_CA_Exit_Count datum.</td>
  <td>0x00000004</td>
 </tr><tr>
  <td>0x05</td>
  <td>0x00000000</td>
  <td>0x00000004</td>
 </tr><tr>
  <td>0x06</td>
  <td>0x00000000</td>
  <td>0x00000004</td>
 </tr><tr>
  <td>0x07</td>
  <td>0x00000000</td>
  <td>0x00000004</td>
 </tr><tr>
  <td>0x08</td>
  <td>0x00000000</td>
  <td>0x00000004</td>
 </tr><tr>
  <td>0x09</td>
  <td>0x00000000</td>
  <td>0x00000004</td>
 </tr><tr>
  <td>0x0a</td>
  <td>0x00000000</td>
  <td>0x00000001</td>
 </tr><tr>
  <td>0x0b</td>
  <td>0x00000000</td>
  <td>0x00000001</td>
 </tr><tr>
  <td>0x0c</td>
  <td>The minimum index is 0. The maximum index is one less than the count of rows in the Signing_Cert table. An index of 0xFFFFFFFF is allowed and indicates the maximum valid index.</td>
  <td>0x00000003</td>
 </tr><tr>
  <td>0x0d</td>
  <td>The minimum index is 0. The maximum index is one less than the count of rows in the Signing_Cert table. An index of 0xFFFFFFFF is allowed and indicates the maximum valid index.</td>
  <td>0x00000003</td>
 </tr><tr>
  <td>0x0e</td>
  <td>0x00000000</td>
  <td>0x00000001</td>
 </tr><tr>
  <td>0x0f</td>
  <td>0x00000000. An index of 0xFFFFFFFF is also valid and implies an index of 0x00000000.</td>
  <td>0x00000003</td>
 </tr><tr>
  <td>0x10</td>
  <td>0x00000000. An index of 0xFFFFFFFF is also valid and implies an index of 0x00000000.</td>
  <td>0x00000003</td>
 </tr><tr>
  <td>0x11</td>
  <td>The minimum index is 0. The maximum index is one less than the count of rows in the Signing_Cert table. An index of 0xFFFFFFFF is allowed and indicates the maximum valid index.</td>
  <td>0x00000003</td>
 </tr><tr>
  <td>0x12</td>
  <td>The minimum index is 0. The maximum index is one less than the count of rows in the Signing_Cert table. An index of 0xFFFFFFFF is allowed and indicates the maximum valid index.</td>
  <td>0x00000003</td>
 </tr><tr>
  <td>0x13</td>
  <td>The minimum index is 0. The maximum index is one less than the count of rows in the Signing_Cert table.</td>
  <td>0x00000001</td>
 </tr><tr>
  <td>0x14</td>
  <td>The minimum index is 0. The maximum index is one less than the count of rows in the Signing_Cert table.</td>
  <td>0x00000001</td>
 </tr><tr>
  <td>0x15</td>
  <td>0x00000000</td>
  <td>0x00000001</td>
 </tr><tr>
  <td>0x16</td>
  <td>0x00000000</td>
  <td>0x00000004</td>
 </tr><tr>
  <td>0x17</td>
  <td>0x00000000</td>
  <td>0x00000001</td>
 </tr><tr>
  <td>0x18</td>
  <td>0x00000000</td>
  <td>0x00000001</td>
 </tr><tr>
  <td>0x19</td>
  <td>0x00000000</td>
  <td>0x00000001</td>
 </tr><tr>
  <td>0x1a</td>
  <td>The minimum index is 0. The maximum index is one less than value of the Config_CA_KRA_Cert_Count datum.</td>
  <td>0x00000003</td>
 </tr><tr>
  <td>0x1b</td>
  <td>The minimum index is 0. The maximum index is one less than the value of the Config_CA_KRA_Cert_Count datum.</td>
  <td>0x00000001</td>
 </tr><tr>
  <td>0x1c</td>
  <td>0x00000000</td>
  <td>0x00000001</td>
 </tr><tr>
  <td>0x1d</td>
  <td>0x00000000</td>
  <td>0x00000004</td>
 </tr><tr>
  <td>0x1e</td>
  <td>The minimum index is 0. The maximum index is one less than the count of rows in the Signing_Cert table. An index of 0xFFFFFFFF is allowed and indicates the maximum valid index.</td>
  <td>0x00000001</td>
 </tr><tr>
  <td>0x1f</td>
  <td>The minimum index is 0. The maximum index is one less than the count of rows in the Signing_Cert table. An index of 0xFFFFFFFF is allowed and indicates the maximum valid index.</td>
  <td>0x00000001</td>
 </tr><tr>
  <td>0x20</td>
  <td>The minimum index is 0. The maximum index is one less than the count of rows in the Signing_Cert table. An index of 0xFFFFFFFF is allowed and indicates the maximum valid index.</td>
  <td>0x00000003</td>
 </tr><tr>
  <td>0x21</td>
  <td>0x00000000</td>
  <td>0x00000003</td>
 </tr><tr>
  <td>0x22</td>
  <td>The minimum index is 0. The maximum index is one less than the count of rows in the Signing_Cert table. An index of 0xFFFFFFFF is allowed and indicates the maximum valid index.</td>
  <td>0x00000001</td>
 </tr><tr>
  <td>0x23</td>
  <td>The index corresponds to a particular CA signing certificate. Since the last CA signing certificate cannot have a forward cross certificate, the minimum index is 0 and the maximum index is two less than the count of rows in the Signing_Cert table.</td>
  <td>0x00000003</td>
 </tr><tr>
  <td>0x24</td>
  <td>The index corresponds to a particular CA signing certificate. Since the first CA signing certificate cannot have a backward cross certificate, the minimum index is 1 and the maximum index is one less than the count of rows in the Signing_Cert table.</td>
  <td>0x00000003</td>
 </tr><tr>
  <td>0x25</td>
  <td>The index corresponds to a particular CA signing certificate. Since the last CA signing certificate cannot have a forward cross certificate, the minimum index is 0 and the maximum index is two less than the count of rows in the Signing_Cert table.</td>
  <td>0x00000001</td>
 </tr><tr>
  <td>0x26</td>
  <td>The index corresponds to a particular CA signing certificate. Since the first CA signing certificate cannot have a backward cross certificate, the minimum index is 1 and the maximum index is one less than the count of rows in the Signing_Cert table.</td>
  <td>0x00000001</td>
 </tr><tr>
  <td>0x27</td>
  <td>The minimum index is 0. The maximum index is one less than the count of rows in the Signing_Cert table.</td>
  <td>0x00000001</td>
 </tr><tr>
  <td>0x28</td>
  <td>0x00000000</td>
  <td>0x00000004</td>
 </tr><tr>
  <td>0x29</td>
  <td>The minimum index is 0. The maximum index is one less than the count of rows in the Signing_Cert table. An index of 0xFFFFFFFF is allowed and indicates the maximum valid index.</td>
  <td>0x00000004</td>
 </tr><tr>
  <td>0x2A</td>
  <td>The minimum index is 0. The maximum index is one less than the count of rows in the Signing_Cert table. An index of 0xFFFFFFFF is allowed and indicates the maximum valid index.</td>
  <td>0x00000004</td>
 </tr><tr>
  <td>0x2B</td>
  <td>The minimum index is 0. The maximum index is one less than the count of rows in the Signing_Cert table. An index of 0xFFFFFFFF is allowed and indicates the maximum valid index.</td>
  <td>0x00000004</td>
 </tr><tr>
  <td>0x2C</td>
  <td>0x00000000</td>
  <td>0x00000004</td>
 </tr><tr>
  <td>0x2D</td>
  <td>0x00000000</td>
  <td>0x00000004</td>
 </tr><tr>
  <td>0x2E</td>
  <td>0x00000000</td>
  <td>0x00000001</td>
 </tr><tr>
  <td>0x2F</td>
  <td>The minimum index is 0. The maximum value in the lower two bytes MUST be one less than the count of rows in the Signing_Cert table. The maximum value in the higher two bytes (obtained by right-shifting PropIndex by 16 bits) MUST be equal to Config_CA_CRL_Max_Partitions. An index value of 0xFFFFFFFF is invalid and MUST NOT be used.</td>
  <td>0x00000001</td>
 </tr><tr>
  <td>0x30</td>
  <td>The minimum index is 0. The maximum value in the lower two bytes MUST be one less than the count of rows in the Signing_Cert table. The maximum value in the higher two bytes (obtained by right-shifting PropIndex by 16 bits) MUST be equal to Config_CA_CRL_Max_Partitions. An index value of 0xFFFFFFFF is invalid and MUST NOT be used.</td>
  <td>0x00000001</td>
 </tr><tr>
  <td>0x31</td>
  <td>The minimum index is 0. The maximum value in the lower two bytes MUST be one less than the count of rows in the Signing_Cert table. The maximum value in the higher two bytes (obtained by right-shifting PropIndex by 16 bits) MUST be equal to Config_CA_CRL_Max_Partitions. An index value of 0xFFFFFFFF is invalid and MUST NOT be used.</td>
  <td>0x00000001</td>
 </tr><tr>
  <td>0x32</td>
  <td>The minimum index is 0. The maximum value in the lower two bytes MUST be one less than the count of rows in the Signing_Cert table. The maximum value in the higher two bytes (obtained by right-shifting PropIndex by 16 bits) MUST be equal to Config_CA_CRL_Max_Partitions. An index value of 0xFFFFFFFF is invalid and MUST NOT be used.</td>
  <td>0x00000001</td>
 </tr></tbody></table><p>When processing the GetCAProperty method, the server MUST
determine its behavior based on the requested property ID (<i>PropID</i>
parameter). All valid property IDs are listed in the preceding table.</p><p>The CA MUST return a nonzero error if either of the
following conditions is met.</p><ul><li><p><span><span> 
</span></span>The value of <i>PropID</i> is not listed in the preceding table.</p>
</li><li><p><span><span> 
</span></span>For a specific <i>PropID</i> value, the <i>PropType</i> value
does not match the required values that are defined in the preceding table.</p>
<p>For a specific non-indexed <i>PropID</i>
value, the <i>PropIndex</i> value does not match the required values that are
defined in the preceding table.</p>
</li></ul><p>For a specific indexed <i>PropID</i> value, if the PropIndex
value does not match the required values that are defined in the preceding
table, the CA MUST return a nonzero error.</p><p>The following sections specify the CA behavior of the method
for each requested property ID. The returned property MUST be returned to the
caller in the <i>pctbPropertyValue</i> parameter as a CERTTRANSBLOB structure.
The message format for this structure MUST be as specified in section 2.2.2.2
and its subsections.</p></div>