Assume the following scenario:
- You try to request a certificate via a Certificate Enrollment Policy Web Service (CEP) from an Active Directory-integrated certification authority (Enterprise Certification Authority).
- The operation fails with the following error message:
Error: The server connection was terminated due to an error. 0x80072efe (WinHttp:12030) ERROR_WINHTTP_CONNECTION_ERROR
The Certificate Enrollment Web Services (Certificate Enrollment Policy Web Service, CEP, and Certificate Enrollment Web Service, CES) enable the automatic request and renewal of certificates from a certification authority via a Web-based interface. This eliminates the need to contact the certification authority directly via Remote Procedure Call (RPC). For a more detailed description, see the article "Certificate request basics via Certificate Enrollment Web Services (CEP, CES)„.
If you call the CEP address with a browser, you get an error message that no matching SSL cipher suites could be determined.
In this case, a hardware load balancer was connected upstream of the CEP, on which there was apparently a configuration problem. The problem was solved by creating a new configuration on the hardware load balancer.
A packet analysis with WireShark showed that the load balancer on the SSL client Hello kept sending back an RST message. The client reduced the cipher suites until all of them failed, which also explains the message when called with the browser.
Related links:
- Configure the Certificate Enrollment Policy Web Service (CEP) to work with a domain account.
- Configure the Certificate Enrollment Policy Web Service (CEP) to work with a Group Managed Service Account (gMSA).
English 
Deutsch