If you want to request or renew certificates on a Windows client using the Microsoft Management Console (MMC), you have several options—all of which achieve the same result but behave differently. Below, we’ll discuss the differences.
I recently encountered the phenomenon that due to a faulty request logic, several users had made new certificate requests at regular intervals.
The certificate template was configured to have incoming certificate requests approved by a certificate manager, i.e., certificates were not issued automatically. Certificate requests were to be checked using a separate code and then approved.
One would now expect that (since all certificate requests would eventually be approved) users would now find multiple certificates of the same type in their certificate store (and the applications that use it). However, this was not the case.
Continue reading "What happens if a user has requested multiple certificates?"
With the introduction of version 2 certificate templates along with Windows XP and Windows Server 2003, the option was introduced for a certificate template to replace one or more others.
This makes it possible to replace issued certificates with those of another certificate template, or to consolidate multiple certificate templates into a single one.
Continue reading "Basics: Replacing (Superseding) Certificate Templates"
Assume the following scenario:
The RD Session Host server cannot install a new template-based certificate to be used for Transport Layer Security (TLS) 1.0\Secure Sockets Layer (SSL) authentication and encryption. The following error occurred: The permissions on the certificate template do not allow the current user to enroll for this type of certificate.Assume the following scenario:
The RD Session Host server cannot install a new template-based certificate to be used for Transport Layer Security (TLS) 1.0\Secure Sockets Layer (SSL) authentication and encryption. The following error occurred: The requested certificate template is not supported by this CA.Assume the following scenario:
Assume the following scenario:
The revocation function was unable to check revocation for the certificate. 0x80092012 (-2146885614 CRYPT_E_NO_REVOCATION_CHECK).Assume the following scenario:
The user account does not have permissions to run this task.Continue reading "Programmatically trigger the autoenrollment process for the logged-on user"
The following is an overview of the Windows Event Viewer events generated by Windows certificate clients, their activation, and their identification.
Continue reading "Enable logging for automatic certificate request (autoenrollment)"
Assume the following scenario:
The following is a troubleshooting guide.
| Event Source: | Microsoft-Windows-CertificateServicesClient-CertEnroll |
| Event ID: | 95 (0x425A005F) |
| Event log: | Application |
| Event type: | Information |
| Event text (English): | Successfully installed Logon Certificate for %1 Request thumbprint: %2 Thumbprint: %3 Process: %4 |
| Event text (German): | Das Anmeldezertifikat für %1 wurde erfolgreich installiert. Anforderungsfingerabdruck: %2 Fingerabdruck: %3 Prozess: %4 |
| Event Source: | Microsoft-Windows-CertificateServicesClient-CertEnroll |
| Event ID: | 94 (0xC25A005E) |
| Event log: | Application |
| Event type: | Error |
| Event text (English): | Failed to install Logon Certificate for %1 failed Request thumbprint: %2 Thumbprint: %3 %4 Process: %5 %6 |
| Event text (German): | Fehler beim Installieren des Anmeldezertifikats für %1 Anforderungsfingerabdruck: %2 Fingerabdruck: %3 %4 Prozess: %5 %6 |
| Event Source: | Microsoft-Windows-CertificateServicesClient-CertEnroll |
| Event ID: | 96 (0xC25A0060) |
| Event log: | Application |
| Event type: | Error |
| Event text (English): | Failed to remove Logon Certificate request for %1 Request thumbprint: %2 Process: %3 %4 |
| Event text (German): | Fehler beim Entfernen der Anmeldezertifikatanforderung für %1 Anforderungsfingerabdruck: %2 Prozess: %3 %4 |
| Event Source: | Microsoft-Windows-CertificateServicesClient-CertEnroll |
| Event ID: | 98 (0xC25A0062) |
| Event log: | Application |
| Event type: | Error |
| Event text (English): | Failed to import PFX Certificate for %1 Flags: %2 Provider: %3 Container: %4 Process: %5 %6 |
| Event text (German): | Fehler beim Importieren des PFX-Zertifikats für %1 Flags: %2 Anbieter: %3 Container: %4 Prozess: %5 %6 |
| Event Source: | Microsoft-Windows-CertificateServicesClient-CertEnroll |
| Event ID: | 93 (0x425A005D) |
| Event log: | Application |
| Event type: | Information |
| Event text (English): | Logon Certificate Request creation for %1 succeeded for the %2 template for key %3 Request thumbprint: %4 Process: %5 |
| Event text (German): | Die Anmeldezertifikatanforderung für %1 für die %2-Vorlage für Schlüssel %3 wurde erfolgreich erstellt. Anforderungsfingerabdruck: %4 Prozess: %5 |