1
vote
1answer
29 views

PKI - Cert Template could not be loaded. This function is not supported on this system

I've built PKI's many times yet this organization's results have me puzzled. Offline Root 2008 R2 Standard 2xEnterprise Subordinate CA's 2008 R2 Enterprise Installed services, all is good. When I go ...
1
vote
1answer
60 views

ADCS - How can I diagnose the exact reason a certificate request was denied by a policy module?

I need to develop operational procedures to audit and understand why a specific request was rejected by an Active Directory Certificate Services (ADCS) Policy Module. I've attempted turning on all ...
2
votes
0answers
127 views

Windows Sub CA not issuing certificates

I set up a fresh 2-tier PKI to try and replace an old broken PKI with a CA that was no longer available. Everything seems to be working between the offline root and online issuing CAs, but now I'm ...
2
votes
1answer
404 views

Multiple CA's on Windows Server 2012

Is it possible to create multiple Certficate Authorities in Windows Server 2012? Specifically: I'd like to create a standalone root CA which will have its private key in offline secure storage. The ...
1
vote
1answer
981 views

How to autoenroll certificates from a Certification Authority in a trusted domain?

I have two Active Directory domains in two separate forests, all at Windows Server 2008 R2 functional levels. There is a two-way forest trust between the domains. Domain A contains a Windows Server ...
0
votes
0answers
392 views

WS 2008 R2 Online Responder not Responding to OCSP Requests

I'm trying to configure an Online Responder (OCSP Responder) for a Windows-based PKI (2008 R2) and I can't for the life of me get the OCSP service to validate when I check it in the Enterprise PKI ...
2
votes
1answer
3k views

Child domain new cert request - certificate template permissions do not allow current user to enroll 0x80094012

I have the following AD configuration: rootca (standalone not domain connected) mydom.local dc1.mydom.local svr1.mydom.local subca.mydom.local(enterprise subordinate CA) other.mydom.local ...
1
vote
1answer
308 views

Decommissioning PKI - How do I set a CRL Next update to null?

I am planning on deploying two Windows 2008R2 PKIs: One for legacy devices that don't support SHA-2 / ECP and another one that does support it. When the time comes to decommission the SHA1 ...
2
votes
1answer
2k views

Unable to submit certificate request to 2k8R2 CA

I have created a two-tier CA using Windows Server 2008 R2. The .inf files used to create this standalone root and an enterprise subCA are at the end of this post. The root is installed OK and issued ...
1
vote
1answer
4k views

How to publish a CRL for an internal Windows certification authority?

I have an Active Directory domain with an Enterprise Root Certification Authority in it; the domain uses a private domain name ("domain.local"), and we also have a public domain name ("domain.com"). ...
1
vote
2answers
639 views

Requesting certificates fails in different site

I'm not really sure where to start looking When requesting a certificate, a server always gets the error message "You cannot request a certificate at this time because no certificate types are ...
0
votes
1answer
187 views

Can not find a specific group in MS Windows 2008

In a MS-Win 2008 SP2 I am trying to find the group CERTSVC_DCOM_ACCESS. I followed this link Error in MS-CA request instructions but I can not seem to find that group. Where it? Does it have a ...
2
votes
1answer
355 views

PKI Issuing CA on Domain Controllers

I am setting up a PKI which will initially be used internally. As we may grow our use of this I have opted for a three tier hierarchy - Offline Root and Policy CAs (one Policy CA at the moment for ...
0
votes
1answer
164 views

Shorten CA Certificate lifetime with Certificate Services?

I recently setup Windows 2003 Certificate Services and installed a five year certificate. I'm now working with a vendor that requires our public CA key so that they can trust all certificates ...