Tag: Certificate template

Requesting a certificate is not possible because the certificate template is not displayed. The error message is "Can not find a valid CSP in the local machine."

Assume the following scenario:

  • A certificate is requested for a user or a computer from a certification authority via the certificate management console (certlm.msc or certmgr.msc).
  • Autoenrollment does not request a certificate from the desired certificate template, although it is enabled and the permissions are set accordingly.
  • The desired certificate template is not displayed when requesting manually via the Microsoft Management Console (MMC). If the "Show all templates" check box is selected, the following error message is displayed for the desired certificate template:
Cannot find object or property.
Can not find a valid CSP in the local machine.

Continue reading "Requesting a certificate is not possible because the certificate template is not displayed. The error message is "Can not find a valid CSP in the local machine.""

The display name of a certificate template is not resolved. Only the object identifier (OID) of the certificate template is displayed.

Assume the following scenario:

  • For a certificate template, only the object identifier is shown, but not the display name and/or
  • Queries against the certification authority database contain only the object identifier for the certificate template ("CertificateTemplate" field), but not the display name.

Continue reading "The display name of a certificate template is not resolved. Only the object identifier (OID) of the certificate template is displayed."

Details of the event with ID 4898 of the source Microsoft-Windows-Security-Auditing

Event Source:Microsoft-Windows-Security-Auditing
Event ID:4898 (0x1322)
Event log:Security
Event type:Information
Event text (English):Certificate Services loaded a template. %1 v%2 (Schema V%3) %4 %5 Template Information: Template Content: %7 Security Descriptor: %8 Additional Information: Domain Controller: %6
Event text (German):Die Zertifikatdienste haben eine Vorlage geladen. %1 v%2 (Schema V%3) %4 %5 Vorlageninformationen: Vorlageninhalt: %7 Sicherheitsbeschreibung: %8 Zusätzliche Informationen: Domänencontroller: %6

Continue reading "Details of the event with ID 4898 of the source Microsoft-Windows-Security-Auditing"

Details of the event with ID 53 of the source Microsoft-Windows-CertificationAuthority

Event Source:Microsoft-Windows-CertificationAuthority
Event ID:53 (0x35)
Event log:Application
Event type:Warning
Symbolic Name:MSG_DN_CERT_DENIED_WITH_INFO
Event text (English):Active Directory Certificate Services denied request %1 because %2. The request was for %3. Additional information: %4
Event text (German):Die Anforderung %1 wurde abgelehnt, da %2. Die Anforderung war für %3. Weitere Informationen: %4

Continue reading "Details of the event with ID 53 of the source Microsoft-Windows-CertificationAuthority"

Certificate Enrollment Policy Web Service does not display certificate templates configured for compatibility with Windows Server 2016 or Windows 10

There is a known bug in the Certificate Enrollment Policy Web Service (CEP) that causes certificate templates configured for compatibility with Windows Server 2016 or Windows 10 not to display.

Continue reading "Certificate Enrollment Policy Web Service does not display certificate templates configured for compatibility with Windows Server 2016 or Windows 10"

How are the compatibility settings for certificate templates technically mapped?

Since the Certificate Services management tools in Windows Server 2012, you can select the desired compatibility for the certification authority and certificate recipient when configuring a certificate template.

In the following, this function is described in more detail, as well as possible effects in practice.

Continue reading "How are the compatibility settings for certificate templates technically mapped?"

Overview of the availability of options when changing the compatibility settings of a certificate template

Since the Certificate Services management tools in Windows Server 2012, you can select the desired compatibility for the certification authority and certificate recipients when configuring a certificate template.

The following is an overview of which options become available in each case when the compatibility settings for the certification authority and/or the certificate recipients are changed.

Continue reading "Overview of the availability of options when changing the compatibility settings of a certificate template"

Requesting certificates via the Network Device Enrollment Service (NDES) fails with error message "The public key does not meet the minimum size required by the specified certificate template. 0x80094811 (-2146875375 CERTSRV_E_KEY_LENGTH)"

Assume the following scenario:

  • A Network Device Enrollment Service (NDES) is implemented in the network.
  • Requesting a certificate fails with the following error message:
"The public key does not meet the minimum size required by the specified certificate template. 0x80094811 (-2146875375 CERTSRV_E_KEY_LENGTH)"

Continue reading "Requesting certificates via the Network Device Enrollment Service (NDES) fails with error message "The public key does not meet the minimum size required by the specified certificate template. 0x80094811 (-2146875375 CERTSRV_E_KEY_LENGTH)""

Manually requesting a Remote Desktop (RDP) certificate

There are cases in which you cannot or do not want to obtain Remote Desktop certificates from a certification authority in your own Active Directory forest, for example, if the system in question is not a domain member.

In this case, the use of certificate templates is not possible, and one must manually create a Certificate Signing Request (CSR).

Continue reading "Manually requesting a Remote Desktop (RDP) certificate"

Performing a functional test for a certification authority

After installing a certification authority, after migrating to a new server, or after more extensive maintenance work, an extensive functional test should be performed to ensure that all components of the certification authority are working as desired.

Continue reading "Performing a functional test for a certification authority"

Planning of certificate validity and renewal period of end entity certificates with autoenrollment

If autoenrollment is used, the participants request certificates on their own and also renew them on their own.

Regarding the validity of the certificates and the period for their automatic renewal, there are two values that can be configured in the "General" tab of a certificate template:

  • Validity period: Describes the overall validity of the issued certificate.
  • Renewal period: Describes from which time window, viewed backwards from the expiration date of the certificate, automatic renewal is attempted for the first time (e.g. 6 weeks before expiration).

Continue reading "Planning of certificate validity and renewal period of end entity certificates with autoenrollment"

Certificates for domain controllers do not contain the domain name in the Subject Alternative Name (SAN)

Assume the following scenario:

  • Certificates for domain controllers are issued by an Active Directory integrated certification authority (enterprise CA)
  • The certificate template used for this purpose was created by yourself
  • The issued certificates contain in the Subject Alternative Name (SAN) only the fully qualified computer name of the respective domain controller, but not the fully qualified name and the NETBIOS name of the domain

Continue reading "Certificates for domain controllers do not contain the domain name in the Subject Alternative Name (SAN)"

Identify the active Remote Desktop (RDP) certificate

If you have configured a certificate template for Remote Desktop certificates and an appropriate Group Policy , or manually assigned a Remote Desktop certificate , you may want to verify that the certificates on the participating computers are being used correctly by the Remote Desktop session host.

Continue reading "Identify the active Remote Desktop (RDP) certificate"

Have certificate holders automatically renew all certificates issued for a certificate template

When operating a certification authority, it may be necessary to renew all issued certificates for a specific certificate template, for example due to major configuration changes or a change of the issuing certification authority. The following describes a mechanism with which this can be achieved automatically.

Continue reading "Have certificate holders automatically renew all certificates issued for a certificate template"