Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have active directory environment in 2003 R2. I have installed 2008 R2 Enterprise Edition CA. Then I have created custom template from web server template and add expiry date as 15 years. my root certificate is valid for 25 years. Then I went to templates and and remove the default web server template and added the newly created template. Then I tried to request a certificate through IIS in another server in domain. But it is not issuing the certificate. When I check it in the CA fail certificate, the error occurred.

Denied by policy module 0x80094800 the request was for a certificate template that is not supported by Active Directory certificate service policy: webserver

I have tried certutil -setreg CA\ValidityPeriodUnits 21 It is not working.

When I remove the custom template and added the Web server template it issues only 2 year valid certificate.

Please help.

share|improve this question
See here: – TheCleaner Mar 31 '14 at 14:36
I have checked the permissions, there are available – user34694 Mar 31 '14 at 14:48

IIRC, the IIS MMC is hard coded to always request the template with the name "webserver". Your custom template does not have this name, I think re-using that name for a custom template is not even possible. After you've removed it, the "not found" error is incorrectly reported as "access denied".

To use your custom template, you'll need to use the browser interface to the CA, and select your template there.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.