0 down vote favorite I have one WinServer 2008 Domain controller and a CA server on it. I login with Administrator account and want to request a certificate "on behalf" of a user of my DC.

for doing that, at first i duplicated these certificate templates:

smart logon smart user enrollment agent

I changed configuration and permission for new templates so that Administrator account can read, write and enroll for these templates.

After creating these new templates and assigning permissions and configuration, from mmc and certificate snap-in, for user account certificates, and for "Personal" section, we requested a new certificate for Administrator account to make it an enrollment agent as shown below:

enter image description here

then it be generated with no problem and we want to request a certificate on behalf of a user with this new certificate. But, in "Select enrollment agent certificate" and when we click on "Browse" button, we have a problem because there is no certificate to select, as shown below: there is no certificate available to choose enter image description here

i read a lot of documents online but i did not found the resson to solve this problem!


Default setting on Enrollment Agent template requires CA manager approval. It appears that you didn't read status message when enrolled the certificate that states about manual certificate approval.

Open Certification Authority MMC snap-in, expand Pending Requests folder. You should see pending request for enrollment agent. Finish the request by approving it and running the following command on a computer where you requested Enrollment Agent certifiicate:

certutil -pulse

this command will trigger autoenrollment and autoenrollment will retrieve and install issued enrollment agent certificate.

  • tancks for answer i do and pending request folder issue but yet no available certificate for enroll behalf of!! – saeidfaraji98 Jul 26 '17 at 6:18
  • Make sure if certificate is installed in the Personal store. – Crypt32 Jul 26 '17 at 6:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.