0

I've recently set up a new Windows 2012 R2 Enterprise SHA2 issuing CA to replace an old Windows 2008 R2 SHA1 issuing CA. This also has Web Enrollment installed as is accessed by the public so all DNS records in place to contact this over web along with trusted certificates. All appears to have gone well other than when testing the final stage of requesting a certificate. Upon submitting the request form the following error is displayed:

Request Mode: newreq - New Request

Disposition: (never set)

Disposition message: (none)

Result: No mapping between account names and security IDs was done. 0x80070534 (WIN32: 1332 ERROR_NONE_MAPPED)

COM Error Info: CCertRequest::Submit: No mapping between account names and security IDs was done. 0x80070534 (WIN32: 1332 ERROR_NONE_MAPPED)

LastStatus: No mapping between account names and security IDs was done. 0x80070534 (WIN32: 1332 ERROR_NONE_MAPPED)

Suggested Cause: No suggestions.

The last section is my favorite and most helpful....!

Investigating this error so far has indicated that this is due to having anonymous authentication enabled on the certsrv site within IIS but this is a public facing CA and don't want clients to be challenged/prompted for credentials as they won't have any to use in the first place. Also, the previous SHA1 CA had only anonymous authentication enabled and had no challenge appear so can't see why this one's any different.

Any ideas?

Improve this question
3
  • You should edit the question to detail all the steps you took before getting this error message. It looks like the OS is a Windows server: you should specify which version using the appropriate tag.
    – Anthony Geoghegan
    Mar 31, 2017 at 20:06
  • looks like a kerberos error to me
    – Jacob Evans
    Apr 1, 2017 at 5:07
  • 1
    I've updated the question to include more detail of the environment as suggested.
    – jshizzle
    Apr 1, 2017 at 9:49

1 Answer 1

Reset to default
1

this is a public facing CA and don't want clients to be challenged/prompted for credentials as they won't have any.

I believe a Standalone CA would be more appropriate.

An Enterprise Certificate Authority enforces credential checks on users during certificate enrollment. Each certificate template has a security permission set in Active Directory that determines whether the certificate requester is authorized to receive the type of certificate they have requested.

It may be possible to put the square peg in the round hole by granting permission to Everyone, and setting the Windows security option "Network access: Let Everyone permissions apply to anonymous users", but that would be unorthodox.

Improve this answer
3
  • Ah that sounds about right you know. I forgot to mention (probably quite important) that other than the OS and CA name, the only difference between the two is that the old one is standalone and the new one is Enterprise. I only found out the original was standalone after setting up the new one so was hoping this wouldn't matter too much as my findings, after a little investigating, suggested that certificates of Enterprise CAs are automatically trusted but didn't see any differences other than that. Should probably looked a little harder. I'll test this tomorrow and get back to you.
    – jshizzle
    Apr 2, 2017 at 12:36
  • Thanks Greg, that looks to be the solution. I'm now up and running, although getting an 500 - internal error when attempting to install the certificate from external browser request now but have noticed a few missing Handler mappings on the CertSrv site compared to the old CA IIS site so will sort this out first.
    – jshizzle
    Apr 4, 2017 at 11:30
  • How do you "publish" a template? (Don't see anything in the UI.) Is it "New" - "Certificate Template to Issue" in certsrv? P.S. In my case, adding "enroll" permissions for "authenticated users" seems to only work for the "web server" template, but not, say, "computer" or "domain controller". I.e. only "web server" is showing up as a template at https://dc02.mydomain.local/certsrv/certrqxt.asp. (Before I update permissions - nothing, "no templates found" error.) Once the "web server" template shows up and I use it to submit a request, I get the same error as you.
    – kindzmarauli
    Sep 27, 2023 at 22:55

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .