I'm having strange issue with my current AD CA server, when I try to generate a certificate by using the url https://localhost/certsrv/certrqma.asp I got the following error eventhough I did the following steps:

  1. Login to the server using DOMAIN\Administrator credentials
  2. Turn Off DEP by using the following command: bcdedit /set {current} nx AlwaysOff

OS: Windows Server 2008 SP2 standard 32 bit

the Error pop up message:

[Window Title]
Microsoft Windows

[Main Instruction]
Certificate Enrollment Control has stopped working

A problem caused the program to stop working correctly. Please close the program.

[Close the program]

Here's the Error pop up message:

Message from webpage
An unexpected error (0x000001CE) occurred while getting the CSP list.

Here's the Error log:

    Log Name:      Application
    Source:        Application Error
    Date:          6/02/2012 3:29:54 PM
    Event ID:      1000
    Task Category: (100)
    Level:         Error
    Keywords:      Classic
    User:          N/A
    Computer:      ADCASrv01-VM.domain.com
    Faulting application CertEnrollCtrl.exe, version 6.0.6001.18000, time stamp 0x47918d6d, faulting module scksp.dll_unloaded, version, time stamp 0x49e037f2, exception code 0xc0000005, fault offset 0x6ef33b1d, process id 0x3490, application start time 0x01cce487f9651aea.

Any help and guidance will be greatly appreciated.



1 Answer 1


CertEnrollCtrl.exe is a client-side ActiveX control used to enroll certificates, and it looks like it's crashing for you. (That's why you're seeing DEP error messages-- the program is failing and a thread of execution is heading off into non-executable memory. Disabling DEP isn't going to help because the root cause is a failure and, ultimately, a bug in the program's exception handling.)

I'd try accessing the web management interface from a remote computer to see if the control crashes in the same manner. I'm betting it will not. That doesn't tell you why it's crashing when execute server-side, but debugging that failure is well beyond the scope of Server Fault. There is a hotfix version of the certificate enrollment control that might be worth checking out.

You can rule out the certificate authority itself by using the MMC to enroll a certificate. Assuming that works the failure is likely isolated to the certificate enrollment control.

  • Hi Evan yes it is working fine remotely if it is accessed using browser from the remote server or laptop. The Hotfix that you supplied I me is The CertEnroll control does not work in Internet Explorer on a computer that is running Windows 7 or Windows Server 2008 R2 ? Which is 64 only due to R2 only available in x64. My current CA server is 32 bit. Feb 8, 2012 at 1:00
  • I also tried using the MMC in the local server to generate the certificate and it is also end up in error. Feb 8, 2012 at 2:53
  • What did the failures in the MMC look like? What was the error message, and did anything get reported in the event log? Feb 8, 2012 at 3:33

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .