Requesting certificates via Certificate Enrollment Policy Web Service (CEP) fails with error message "The requested certificate template is not supported by this CA."

Assume the following scenario:

• You try to request a certificate via a Certificate Enrollment Policy Web Service (CEP) from an Active Directory-integrated certification authority (Enterprise Certification Authority).
• The operation fails with the following error message:

The requested certificate template is not supported by this CA.

The Certificate Enrollment Web Services (Certificate Enrollment Policy Web Service, CEP, and Certificate Enrollment Web Service, CES) enable the automatic request and renewal of certificates from a certification authority via a Web-based interface. This eliminates the need to contact the certification authority directly via Remote Procedure Call (RPC). For a more detailed description, see the article "Certificate request basics via Certificate Enrollment Web Services (CEP, CES)„.

The error may occur if the certificate template was recently added to the certification authority and the enrollment policy cache on the client has not yet been updated.

For the computer account, the Enrollment Policy Cache can be cleared with the following command.

certutil -f -policyserver * -policycache delete

For the logged-in user, the enrollment policy cache can be cleared with the following command.

certutil -f -user -policyserver * -policycache delete 

Related links:

• View and clear the certificate enrollment policy cache for the Certificate Enrollment Policy Web Service (CEP).