Requesting certificates via Certificate Enrollment Web Service (CES) fails with error code "ERROR_INTERNET_NAME_NOT_RESOLVED".

Assume the following scenario:

• You try to request a certificate via a Certificate Enrollment Web Service (CEP) from an Active Directory-integrated certification authority (Enterprise Certification Authority).
• The operation fails with the following error message:

The name or address could not be resolved 0x80072ee7 (INet: 12007 ERROR_INTERNET_NAME_NOT_RESOLVED)

The Certificate Enrollment Web Services (Certificate Enrollment Policy Web Service, CEP, and Certificate Enrollment Web Service, CES) enable the automatic request and renewal of certificates from a certification authority via a Web-based interface. This eliminates the need to contact the certification authority directly via Remote Procedure Call (RPC). For a more detailed description, see the article "Certificate request basics via Certificate Enrollment Web Services (CEP, CES)„.

Possible causes can be:

• The host name of the CES is not entered in the Domain Name System or is incorrect.
• The wrong CES address is entered in the msPKI-Enrollmen-Servers attribute on the pKIEnrollmentService object in Active Directory.

Details: The wrong CES address is entered in the msPKI-Enrollmen-Servers attribute on the pKIEnrollmentService object in Active Directory.

The entered enrollment server address can be checked with the ADSI editor (adsiedit.msc). However, changes should only be made via the command line.

Related links:

• Requesting certificates via the Certificate Enrollment Policy Web Service (CEP) fails with error message "A valid certification authority (CA) configured to issue certificates based on this template cannot be located, or the CA does not support this operation, or the CA is not trusted."