Tag: Registry

The Network Device Enrollment Service (NDES) logs the error message "The Network Device Enrollment Service cannot create or modify the registry key Software\Microsoft\Cryptography\MSCEP\EncryptedPassword."

Assume the following scenario:

  • An NDES server is configured on the network.
  • The NDES server is configured to work with a static password.
  • When accessing the NDES administration web page (certsrv/mscep_admin), users are repeatedly prompted for authentication despite having correct credentials.
  • The following event is stored in the application event log:
The Network Device Enrollment Service cannot create or modify the registry key "Software\Microsoft\Cryptography\MSCEP\EncryptedPassword". Grant Read and Write permissions on the registry key "Software\Microsoft\Cryptography\MSCEP" to the account that the Network Device Enrollment Service is running as.

Continue reading "The Network Device Enrollment Service (NDES) logs the error message "The Network Device Enrollment Service cannot create or modify the registry key Software\Microsoft\Cryptography\MSCEP\EncryptedPassword.""

The Network Device Enrollment Service (NDES) administration web page (certsrv/mscep_admin) reports "The password cache is full."

Assume the following scenario:

  • An NDES server is configured on the network.
  • When calling the administration web page (certsrv/mscep_admin) the following message appears:
The password cache is full.

Continue reading "The Network Device Enrollment Service (NDES) administration web page (certsrv/mscep_admin) reports "The password cache is full.""

Publishing a certificate revocation list (CRL) fails with error message "The directory name is invalid. 0x8007010b (WIN32/HTTP: 267 ERROR_DIRECTORY)"

Assume the following scenario:

  • A new certificate revocation list (CRL) is created on the certification authority.
  • Publishing fails with the following error message:
The directory name is invalid. 0x8007010b (WIN32/HTTP: 267 ERROR_DIRECTORY)

Continue reading "Publishing a certificate revocation list (CRL) fails with error message "The directory name is invalid. 0x8007010b (WIN32/HTTP: 267 ERROR_DIRECTORY)""

Requesting a certificate fails with the error message "A valid certification authority (CA) configured to issue certificates based on this template cannot be located, or the CA does not support this operation, or the CA is not trusted."

Assume the following scenario:

  • You try to request a certificate from an Active Directory integrated certification authority (enterprise CA).
  • To do this, you use the Microsoft Management Console (MMC), either for the logged-on user (certmgr.msc) or for the computer (certlm.msc).
  • However, the desired certificate template is not offered for selection, even though it has been correctly published on the certification authority.
  • The logged-on user (or computer) also has the necessary permissions to request certificates from the certificate template in question (Enroll).
  • In the list of available certificate templates within the MMC, you have all certificate templates displayed. The desired certificate template shows:
A valid certification authority (CA) configured to issue certificates based on this template cannot be located, or the CA does not support this operation, or the CA is not trusted.

Continue reading "Requesting a certificate fails with the error message "A valid certification authority (CA) configured to issue certificates based on this template cannot be located, or the CA does not support this operation, or the CA is not trusted.""