I'm trying to decommission a Server 2008 machine that hosts DC, NPS, and CA. I've deployed two new servers to take over as root CA and RADIUS server (both new servers are 2012R2). The new root CA is issuing certificates (DC authentication auto-enroll), and the new NPS server has been restored with our existing configuration.
Since I'm moving the NPS server off of a DC, I need to issue it a RAS and IAS Server cert from my new CA. When I try to select the certificate that I created to issue, the interface is only listing certificate templates with a schema version of 1 as available to issue. Is this due to my domain functional level (2008)? Or the fact that I still have an authorized CA running Server 2008 standard? Or am I missing something else?
EDIT 1: For my purposes, it turns out that a regular old Computer cert allows RADIUS to authenticate. I'd still like to figure out why I cannot issue schema version 2/3 cert templates in this configuration.
EDIT 2: I have removed all certificate templates from the Server 2008 CA. When I manage templates from the 2012R2 CA, I can see the V2&3 certificates, but when I enter "Certificate Template to Issue" screen, only V1 templates are listed.
EDIT 3: Template example:
- Duplicate Computer template (Creates a version 2 template)
- General: Change display name, check Publish certificate in Active Directory
- Security: Confirm Authenticated Users have Read, all other permissions Default
- All other settings default