2

I have an enterprise certificate authority running on a Windows Server 2012 R2 member server. The web interface for the CA has recently started popping up an error each time I go to request a certificate:

"No certificate templates could be found. You do not have permission to request a certificate from this CA, or an error occurred while accessing the Active Directory".

The CA is still able to issue certs, requesting a certificate through the MMC on a PC works.

I have, obviously, googled the error and have found some possibilities and tried out the advice that I've found. So far I've:

1) Created a new application pool and made sure that the application pool identity for the website is NetworkService instead of ApplicationPoolIdentity

2) Checked that the site has Windows authentication enabled and all other authentication types disabled

3) Checked that the sServerConfig entry in CertDat.inc matches the DnsHostName entry in the pkiEnrollmentService (it does)

4) Checked the permissions on the certificate templates

5) Updated the server

6) Rebooted the server

All to no avail. I've tried with my user account which has domain admin access and with the domain Administrator account which has enterprise admin rights.

I've checked the event logs. Every so often, an entry appears saying:

The "Windows default" Policy Module logged the following warning: The Active Directory Connection to local.domain.controller.fqdn has been reestablished to local.domain.controller.fqdn

but I don't think that's pertinent to anything.

I'm not sure what else to try, does anyone have any suggestions?

Many thanks

Norphus
  • 165
  • 1
  • 3
  • 12
  • I would suggest to get rid of Web Enrollment Pages component from Enterprise CA servers. They are useless. Instead, you should consider to use modernized Certificates MMC snap-in. – Crypt32 Oct 31 '16 at 14:34
  • Not entirely useless beause, as far as I know, I can't use the MMC to submit a base64 string to the CA whereas I **can** with the web interface. – Norphus Oct 31 '16 at 14:43
  • You can submit a file that contains Base64-formatted string, either, from GUI, or CLI. – Crypt32 Oct 31 '16 at 15:15
  • OK, cool. How do you do that please? – Norphus Oct 31 '16 at 15:26
  • 1
    GUI: open `certsrv.msc`, right-click on CA node -> All Tasks -> Submit New Request. If you prefer CLI or you need to specify template name, then you can run: `certreq -submit -attrib "CertificateTemplate:" path\requestfile.req`, where `` is the common name of the certificate template. – Crypt32 Oct 31 '16 at 15:38
  • Just to add to Crypt32's info - `certsrv.msc` needs to be run from the CA server (you can find the CA by running `certutil -dump` ) – KERR Nov 02 '17 at 06:01

0 Answers0