Troubleshooting - Page 6 - Uwe Gradenegger

Requesting certificates via Certificate Enrollment Web Services using Windows PowerShell fails with error message "Access was denied by the remote endpoint. 0x803d0005 (-2143485947 WS_E_ENDPOINT_ACCESS_DENIED)".

Assume the following scenario:

An attempt is made to request a certificate via Windows PowerShell using Certificate Enrollment Web Services.
The request fails with the following error message:

Get-Certificate : CX509EnrollmentPolicyWebService::LoadPolicy: Access was denied by the remote endpoint. 0x803d0005 (-2143485947 WS_E_ENDPOINT_ACCESS_DENIED)

Requesting certificates via Certificate Enrollment Web Services using Windows PowerShell fails with error message "Cannot find object or property. 0x80092004 (-2146885628 CRYPT_E_NOT_FOUND)"

Assume the following scenario:

An attempt is made to request a certificate via Windows PowerShell using Certificate Enrollment Web Services. The name of the certificate template is included with the -Template argument.
The request fails with the following error message:

Get-Certificate : CertEnroll::CX509CertificateTemplates::get_ItemByName: Cannot find object or property. 0x80092004

(-2146885628 CRYPT_E_NOT_FOUND)

Windows Defender detects certutil as malware (Win32/Ceprolad.A)

Assume the following scenario:

One leads a Functional test for the Certificate Enrollment Policy Web Server (CEP) by.
For this, one uses a certutil command that uses Kerberos authentication, e.g.:

certutil -ping -kerberos -config "https://{Servername}/ADPolicyProvider_CEP_Kerberos/service.svc/CEP" CEP

The certutil command is incorrectly detected by Windows Defender or Windows Defenter Advanced Threat Protection as Win32/Ceprolad.A.

Certificate request fails with error message "Error Parsing Request The request subject name is invalid or too long. 0x80094001 (-2146877439 CERTSRV_E_BAD_REQUESTSUBJECT)".

Assume the following scenario

A certificate request is sent to a certification authority.
The certificate request fails with the following error message:

Error Parsing Request The request subject name is invalid or too long. 0x80094001 (-2146877439 CERTSRV_E_BAD_REQUESTSUBJECT)

Requesting certificates via Network Device Enrollment Service (NDES) fails with error message "The public key does not meet the minimum size required by the specified certificate template. 0x80094811 (-2146875375 CERTSRV_E_KEY_LENGTH)".

Assume the following scenario:

A network device enrollment service (NDES) is implemented in the network.
Requesting a certificate fails with the following error message:

"The public key does not meet the minimum size required by the specified certificate template. 0x80094811 (-2146875375 CERTSRV_E_KEY_LENGTH)"

Requesting certificates via Network Device Enrollment Service (NDES) fails with error message "The operation timed out 0x80072ee2 (WinHttp: 12002 ERROR_WINHTTP_TIMEOUT)".

Assume the following scenario:

A network device enrollment service (NDES) is implemented in the network.
Requesting a certificate fails with the following error message:

The operation timed out 0x80072ee2 (WinHttp: 12002 ERROR_WINHTTP_TIMEOUT)

Requesting certificates via Network Device Enrollment Service (NDES) fails with HTTP error code 500

Assume the following scenario:

A network device enrollment service (NDES) is implemented in the network.
The NDES server uses a domain account for the identity of the SCEP IIS application pool.
Requesting certificates via NDES fails with HTTP error code 500 (Internal Server Error).
Calling the mscep and mscep_admin pages also fails with HTTP error code 500.
Even after an iisreset or restart of the NDES server, no event appears after calling the mscep or mscsp_admin page that the NDES service has started or that there were errors.

The Network Device Enrollment Service (NDES) logs the error message "The Network Device Enrollment Service cannot be started (0x80004005). Unspecified error"

Assume the following scenario:

An NDES server is configured on the network.
When accessing the NDES application web page (mscep) and the NDES administration web page (certsrv/mscep_admin), HTTP error 500 (Internal Server Error) is reported with error code 0x80004005.
The events are No. 2 and No. 8 stored in the application event log:

The Network Device Enrollment Service cannot be started (0x80004005). Unspecified error

Certificate enrollment policy check via Certificate Enrollment Policy (CEP) web service fails with error code "WS_E_ENDPOINT_FAULT_RECEIVED".

Assume the following scenario:

Users (or computers) should request certificates via the Certificate Enrollment Policy (CEP) web service.
For this purpose, a certificate enrollment policy is configured, which points to a Certificate Enrollment Policy Web Service (CEP).
Authentication is done via Kerberos.
When checking the address, the connection to the CEP fails and you get the following error message:

An error occurred while obtaining certificate enrollment policy.
 Url: https://cews.adcslabor.de/ADCS%20Labor%20Issuing%20CA%201_CES_Kerberos/service.svc/CES
 Error: A message containing a fault was received from the remote endpoint. 0x803d0013 (-2143485933 WS_E_ENDPOINT_FAULT_RECEIVED)

Login via smart card using Remote Desktop (RDP) fails with error message "The requested key container does not exist on the smart card."

Assume the following scenario:

A user logs on to a remote desktop system using the smart card logon function.
The user uses a Yubico Yubikey as a smartcard. The required middleware is installed on both the local and the remote system.
The login fails with the following error message:

The system could not log you on. The requested key container does not exist on the smart card.

Effects of the failure of the online responder (OCSP) on the verification of the revocation status of a certificate

The following section examines how the revocation status check behaves if the online responder should fail. Depending on the configuration of the certificates issued, the behavior can vary considerably.

Creation of a manual certificate request fails with error message "Expected INF file section name 0xe0000000".

Assume the following scenario:

An information file for a manual certificate request is created.
Creating the certificate request using the file fails with the following error message:

Expected INF file section name 0xe0000000 (INF: -536870912)

Certificate Enrollment Web Service (CES) request fails with error code "WS_E_ENDPOINT_FAULT_RECEIVED".

Assume the following scenario:

A Certificate Enrollment Web Service (CES) is implemented in the network.
A certificate request is sent to the CES.
The certificate request fails with the following error message:

A message containing a fault was received from the remote endpoint. 0x803d0013 (-2143485933 WS_E_ENDPOINT_FAULT_RECEIVED)

The SMTP Exit module does not work on Windows Server Core

Assume the following scenario:

A certificate authority is installed on Windows Server Core.
The SMTP file supplied with the certification authority is used. Exit module configured.
However, the Certification Authority does not send e-mails.
In the event log, the Event no. 46 logged with the following error message:

The "Windows default" Exit Module "Initialize" method returned an error. Class not registered The returned status code is 0x80040154 (-2147221164). The Certification Authority was unable to initialize email messaging objects.

Certificate request fails with error message "The system cannot find the file specified. 0x80070002 (WIN32: 2 ERROR_FILE_NOT_FOUND)".

Assume the following scenario:

A certificate request is sent to a certification authority.
The certificate request fails with the following error message:

Error Parsing Request The system cannot find the file specified. 0x80070002 (WIN32: 2 ERROR_FILE_NOT_FOUND)