Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm not really sure where to start looking

When requesting a certificate, a server always gets the error message "You cannot request a certificate at this time because no certificate types are available". Then for each certificate the error is "The permissions on the certificate template do not allow the current user to enroll for this type of certificate".

Our CA server resides in one AD site, and a server in that site is able to request certificates from the CA. Another server in a different site (same domain) gets the error, although others servers in different sites work fine

The same user on a machine where certificates can be obtained is also the one having an issue on the problematic machine. Domain Admins has full rights on at least one template, and my admin user is a Domain Admin

Any insight would be much appreciated to know where I should look next. Thanks

share|improve this question

Well, the message indicates it's user permissions rather than site membership causing a problem. Compare the permissions on the certificate template with the user account you're trying to request the certificate as.

If it hadn't been a message about permissions, I'd have assumed there was a stonking great firewall between sites, causing RPC connectivity failures.

A client looks up the certificates it's able to (auto/) enroll for at the forest level, uses that to find templates it has Enroll or Autoenroll permissions for, and then asks a CA whether it can please have one of those certificate types.

Each CA has a subset of that list of templates that it's able to issue, and has another level of permissions applied to the CA itself, so you need permissions to both the template and the CA in order to complete a certificate signing request. If you have multiple CAs, you need to check the permissions (and certificates allowed to be issued) on each.

So, short version: Work out how Problem User's permissions are different from Working User's permissions in terms of {Template in AD permissions} and {CA permissions}. If they shouldn't be different in any way (i.e. same/duplicated user doesn't work in Site B), I agree with Shane on a possible Repl issue.

share|improve this answer
Adding a relevant link to elaborate Tristan's answer…. – maweeras Dec 23 '11 at 2:17

Is replication working (and current) between the sites?

The updated certificate template information may not have made it to the other site yet.

share|improve this answer
Turns out server was in wrong AD group for GP to apply – marcwenger Dec 23 '11 at 19:03
@marcwenger Great! Feel free to add your own answer and accept it. – Shane Madden Dec 23 '11 at 19:18

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.