Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

We currently use the NDES Service on Windows 2008 R2 Enterprise where the same box is also the standalone Certificate Authority.

During initial setup, NDES created 2 service certificates for SCEP based on the templates CEPEncryption and EnrollmentAgentOffline.

These two SCEP certs have expired and we are struggling to renew / request new.

Attempting to renew them using the certificates MMC snap with the same key (all tasks->advanced operations->renew this certificate with the same key) produces an error

“An enrollment policy server cannot be located”

I have tried to follow the instructions at the following URL for renewing service certificates but they don't seem to be correct for the scenario we are in (likely the standalone CA).


Specifically steps 10,11 start deviating

  1. Right-click, select All Tasks, and then click Select New Certificates. (I don't have the Select New Certificates option).
  2. In the Certificate Enrollment dialog box, click Next. (on all renewal/request tasks I choose I receive the error noted above)

Can anyone help me with the error and educate me on how to renew these service certificates in this scenario?

share|improve this question

1 Answer 1

turns out the standalone CA scenario was causing the issue. The renewal and certificate request process built into the certificate MMC GUI requires a policy web server (which can't run on a standalone CA as it requires domain permissions to install).

As a result, you need to manually remove, request and accept the new certs. Found a blog post that details instructions on how to do it manually using certutil.


share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.