ML-DSA – Uwe Gradenegger

Requesting Certificates with ML-DSA-Based Keys Through the Network Device Enrollment Service (NDES)

With the May 2026 security update, Microsoft has added support for the ML-DSA algorithm in Active Directory Certificate Services.

In her documentary They do say that NDES is not compatible with ML-DSA,:

You can enroll ML-DSA certificates using the Certificates Microsoft Management Console (MMC) snap-in and certreq.exe. Enrollment through the Network Device Enrollment Service (NDES) is not currently available.

But that's not entirely true…

Configuring an SSL certificate binding for Microsoft Internet Information Server (IIS) fails with an error message when using ML-DSA-based keys

Assume the following scenario:

A web server certificate was generated using an ML-DSA-based key pair.
We would like to integrate this with Internet Information Services (IIS).
The configuration fails with the following error message:

There was an error while performing this operation.

Details: 

A specified logon session does not exist. It may already have been terminated. (Exception from HRESULT: 0x80070520)

Requests for certificates using ML-DSA-based keys fail with the error message „The parameter is incorrect. 0x80070057 (WIN32: 87 ERROR_INVALID_PARAMETER)“

Assume the following scenario:

People are trying to apply for certificates using the ML-DSA algorithm.
The request fails with the following error message:

The parameter is incorrect. 0x80070057 (WIN32: 87 ERROR_INVALID_PARAMETER)

Details of the event with ID 13 of the source Microsoft-Windows-CertificateServicesClient-CertEnroll

Event Source:	Microsoft-Windows-CertificateServicesClient-CertEnroll
Event ID:	13 (0xC25A000D)
Event log:	Application
Event type:	Error
Event text (English):	Certificate enrollment for %1 failed to enroll for a %2 certificate with request ID %4 from %3 (%5).
Event text (German):	The certificate enrollment for %1 failed to enroll for a certificate %2 with request ID %4 of %3 (%5).

Details of the event with ID 33 of the source Microsoft-Windows-OnlineResponder

Event Source:	Microsoft-Windows-OnlineResponder
Event ID:	33 (0x21)
Event log:	Application
Event type:	Error
Symbolic Name:	MSG_E_CACONFIG_CREATE_ENROLLMENT_REQUEST_FAILED
Event text (English):	The Online Responder Service failed to create an enrollment request for the signing certificate template %2 for configuration %1.(%3).
Event text (German):	The online responder service could not create registration requests for the signature certificate template "%2" for the configuration %1.(%3)