Tag: MS-XCEP

There is a known bug in the Certificate Enrollment Policy Web Service (CEP) that causes certificate templates configured for compatibility with Windows Server 2016 or Windows 10 not to display.

Continue reading "Certificate Enrollment Policy Web Service does not display certificate templates configured for compatibility with Windows Server 2016 or Windows 10"

Assume the following scenario:

• An attempt is made to request a certificate via Windows PowerShell using Certificate Enrollment Web Services.
• The request fails with the following error message:

Get-Certificate : CX509EnrollmentPolicyWebService::LoadPolicy: Access was denied by the remote endpoint. 0x803d0005 (-2143485947 WS_E_ENDPOINT_ACCESS_DENIED)

Continue reading "Requesting a certificate via the Certificate Enrollment Web Services using Windows PowerShell fails with error message "Access was denied by the remote endpoint. 0x803d0005 (-2143485947 WS_E_ENDPOINT_ACCESS_DENIED)""

Assume the following scenario:

• An attempt is made to request a certificate via Windows PowerShell using Certificate Enrollment Web Services. The name of the certificate template is included with the -Template argument.
• The request fails with the following error message:

Get-Certificate : CertEnroll::CX509CertificateTemplates::get_ItemByName: Cannot find object or property. 0x80092004

(-2146885628 CRYPT_E_NOT_FOUND)

Continue reading "Requesting certificates via Certificate Enrollment Web Services using Windows PowerShell fails with error message "Cannot find object or property. 0x80092004 (-2146885628 CRYPT_E_NOT_FOUND)""

Assuming one implements Microsoft's Active Directory Administrative Tiering Model, or applies similar hardening measures to one's servers, this will have an impact on the CEP components.

Continue reading "Required Windows security permissions for the Certificate Enrollment Policy Web Service (CEP)"

If, in addition to Active Directory Certificate Services, the administrative tiering model is also implemented for the Active Directory directory service, the question arises as to how the individual PKI components are to be assigned to this model in order to be able to perform targeted security hardening.

Continue reading "Classification of AD CS components in the Administrative Tiering Model"

After installing a Certificate Enrollment Policy Web Service (CEP), or after more extensive maintenance work, an extensive functional test should be performed to ensure that all components are working as desired.

Continue reading "Performing a functional test for the Certificate Enrollment Policy Web Service (CEP)"

Implementing a Certificate Enrollment Policy Web Service (CEP) often requires planning the firewall rules to be created on the network. The following is a list of the required firewall rules and any pitfalls.

Continue reading "Required firewall rules for the Certificate Enrollment Policy Web Service (CEP)"

Assume the following scenario:

• You try to request a certificate via a Certificate Enrollment Policy Web Service (CEP) from an Active Directory-integrated certification authority (enterprise CA).
• The operation fails with the following error message:

The requested certificate template is not supported by this CA.

Continue reading "The request for a certificate via the Certificate Enrollment Policy Web Service (CEP) fails with the error message "The requested certificate template is not supported by this CA.""

When trying to track down an error in the Certificate Enrollment Policy Web Service (CEP), it is helpful to enable debug logging.

Continue reading "Enable debug logging for the Certificate Enrollment Policy Web Service (CEP)"

Assume the following scenario:

• You try to request a certificate via a Certificate Enrollment Policy Web Service (CEP) from an Active Directory-integrated certification authority (enterprise CA).
• The operation fails with the following error message:

Fehler: Die Serververbindung wurde aufgrund eines Fehlers beendet. 0x80072efe (WinHttp:12030) ERROR_WINHTTP_CONNECTION_ERROR

Continue reading "Requesting a certificate via the Certificate Enrollment Policy Web Service (CEP) fails with the error message "ERROR_WINHTTP_CONNECTION_ERROR""

Assume the following scenario:

• You try to request a certificate via a Certificate Enrollment Policy Web Service (CEP) from an Active Directory-integrated certification authority (Enterprise Certification Authority).
• To do this, you use the Microsoft Management Console (MMC), either for the logged-on user (certmgr.msc) or for the computer (certlm.msc).
• However, the list of available certificate templates within the MMC is completely empty.
• In the list of available certificate templates within the MMC, you choose to show all certificate templates. All desired certificate templates show:

Cannot find Object or property.
A valid certification authority (CA) configured to issue certificates based on this template cannot be located, or the CA does not support this operation, or the CA is not trusted. 

Continue reading "Requesting certificates via the Certificate Enrollment Policy Web Service (CEP) fails with error message "A valid certification authority (CA) configured to issue certificates based on this template cannot be located, or the CA does not support this operation, or the CA is not trusted.""

Assume the following scenario:

• A user requests a certificate.
• An enrollment policy is configured for this, which points to a Certificate Enrollment Policy Web Service (CEP).
• The connection to the CEP fails and the user receives the following error message:

Error: Access was denied by the remote endpoint. 0x803d0005 -2143485947 WS_E_ENDPOINT_ACCESS_DENIED

Continue reading "Requesting certificates via the Certificate Enrollment Policy Web Service (CEP) fails with error message "Error: Access was denied by the remote endpoint. 0x803d0005 -2143485947 WS_E_ENDPOINT_ACCESS_DENIED""

Assume the following scenario:

• A role configuration for the Certificate Enrollment Policy Web Service (CEP) is performed.
• The role configuration fails with the following error message:

CCertificateEnrollmentPolicyServerSetup::InitializeInstallDefaults: Access is denied. 0x80070005 (WIN32: 5 ERROR_ACCESS_DENIED)

Continue reading "The role configuration for the Certificate Enrollment Policy Web Service (CEP) fails with error message "Access is denied. 0x80070005 (WIN32: 5 ERROR_ACCESS_DENIED)""

Assume the following scenario:

• A role configuration for the Certificate Enrollment Policy Web Service (CEP) is performed using PowerShell (Install-AdcsEnrollmentPolicyWebService).
• The role configuration fails with the following error message:

Cannot validate argument on parameter 'SSLCertThumbprint'. The argument is null or empty. Provide an argument that is not null or empty, and then try the command again.

Continue reading "Role configuration for Certificate Enrollment Policy Web Service fails with error message "The argument is null or empty.""

The following describes how to install the Certificate Enrollment Policy Web Service (CEP).

Continue reading "Installing a Certificate Enrollment Policy Web Service (CEP)"