All Windows 2K8R2 SP1 environment.
I have a working Enterprise Certificate Authority in my domain. I want to issue a Computer certificate (for Server Authentication purpose) to an external, stand-alone machine. So I add the Certification Authority Web Enrollment, Certificate Enrollment Web Service, and Certificate Enrollment Policy Web Service role services to my ECA.
Now on my standalone machine, I browse to http://myCA/certsrv. I see that I am only able to request a "User Certificate." In the Advanced Certificate Request, there is still no option to request a Computer certificate or anything that will give me what I need, as far as I can tell.
So I edit the certrqtp.inc file on my ECA such that I replace rgAvailReqTypes(1,5) with rgAvailReqTypes(2,5), and I add this to toward the end of the file:
rgAvailReqTypes(1,FIELD_TEMPLATE)="Computer"
rgAvailReqTypes(1,FIELD_FRIENDLYNAME)="Computer"
rgAvailReqTypes(1,FIELD_OID)="1.3.6.1.5.5.7.3.1"
rgAvailReqTypes(1,FIELD_CSPLIST)=""
Now when I browse the website, I see a new certificate request type: Computer. However, when I try to submit that request on my standalone machine, I get this error:
Certificate Request Denied
The disposition message is "Denied by Policy Module 0x80094800, The request was for
a certificate template that is not supported by the Active Directory Certificate
Services policy: 1.3.6.1.5.5.7.3.1(Server Authentication). ".
How can I issue a computer certificate from my ECA to an external, standalone computer?
If it helps, I am trying to use the cert on the standalone computer for the purposes of running a WinRM listener on that computer that uses SSL.
edit: What I did was request a "Web Server" certificate from the CA, which was granted. It was automatically installed into my user account store. From there, I exported the certificate on my standalone machine, and then imported it into my Local Computer -> Personal store. Now I have a certificate in there that is named after my HOSTNAME of my standalone computer, in the Subject property, it says CN = HOSTNAME, and for "intended purposes" it says "Server Authentication."
However, now I get this:
Even though I have a certificate in my local computer personal store that appears to meet all those requirements. :(