Tag: AEPolicy

Assume the following scenario:

• The company would like to use smart card logon.
• The domain controllers are equipped with certificates that can be used for smart card logon .
• The users are equipped with certificates that can be used for smart card logon.
• Logon to the domain via smart card fails with the following error message:

A certification chain processed correctly, but one of the CA certificates is not trusted by the policy provider. 0x800b0112 (-2146762478 CERT_E_UNTRUSTEDCA)

Continue reading "Smart card logon fails with error message "A certification chain processed correctly, but one of the CA certificates is not trusted by the policy provider. 0x800b0112 (-2146762478 CERT_E_UNTRUSTEDCA)""

I recently encountered the phenomenon that due to a faulty request logic, several users had made new certificate requests at regular intervals.

The certificate template was configured to have incoming certificate requests approved by a certificate manager, i.e., certificates were not issued automatically. Certificate requests were to be checked using a separate code and then approved.

One would now expect that (since all certificate requests would eventually be approved) users would now find multiple certificates of the same type in their certificate store (and the applications that use it). However, this was not the case.

Continue reading "What happens if a user has requested multiple certificates?"

Assume the following scenario:

• A certification authority hierarchy is established in the network and the root certification authority is mapped in the configuration partition of the Active Directory forest.
• Domain members are configured to run the autoenrollment process to update trusted root certification authorities from the Configuration partition.
• However, this process does not work for some clients. The root CA certificates are not automatically downloaded and entered into the local trust store.
• As a consequence certificate requests can fail because, for example, the certification authority hierarchy is not trusted.

Continue reading "The local certificate store for trusted root certification authorities is not synchronized from Active Directory"

Assume the following scenario:

• A certificate template is configured for automatic certificate request (autoenrollment).
• The certificate template is published on a certification authority (Enterprise Certification Authority) integrated into Active Directory.
• However, the users or computers configured for automatic certificate request do not request certificates as intended.

The following is a troubleshooting guide.

Continue reading "Troubleshooting for automatic certificate request (autoenrollment) via RPC/DCOM (MS-WCCE)"

The following describes the process that runs in the background when certificates are requested manually or automatically in order to achieve the highest possible level of automation.

Continue reading "Basics: Manual and automatic certificate requests via Lightweight Directory Access Protocol (LDAP) and Remote Procedure Call / Distributed Common Object Model (RPC/DCOM) with the MS-WCCE protocol"

Here's the scenario:

• A user requests a certificate from an Active Directory integrated certification authority (enterprise CA).
• The certificate of the certification authority is trusted, i.e. it is located in the Trusted Root Certification Authorities store.
• The certificate request fails with the following error message:

A certification chain processed correctly, but one of the CA certificates is not trusted by the policy provider. 0x800b0112 (-2146762478 CERT_E_UNTRUSTEDCA)

Continue reading "Requesting a certificate fails with the error message "A certification chain processed correctly, but one of the CA certificates is not trusted by the policy provider. 0x800b0112 (-2146762478 CERT_E_UNTRUSTEDCA)""