Requesting certificates via Enroll on Behalf of (EOBO) fails with the error message "The operation is denied. It can only be performed by a certificate manager that is allowed to manage certificates for the current requester."

• A certificate is requested for a user from a certification authority via the certificate management console (certmgr.msc).
• One uses here the Enroll on Behalf of (EOBO) Mechanism.
• The certificate request fails with the following error message:

The operation is denied. It can only be performed by a certificate manager that is allowed to manage certificates for the current requester.

The Certification Authority will use the Event no. 21 log.

Cause

Occurs when the user does not have the right to request a certificate for that user due to restricted enrollment agent settings on the certificate authority.

Related links:

• Basics: Enroll on Behalf of (EOBO)