Requesting certificates via Network Device Enrollment Service (NDES) fails with error message "The public key does not meet the minimum size required by the specified certificate template. 0x80094811 (-2146875375 CERTSRV_E_KEY_LENGTH)".

Assume the following scenario:

• A network device enrollment service (NDES) is implemented in the network.
• Requesting a certificate fails with the following error message:

"The public key does not meet the minimum size required by the specified certificate template. 0x80094811 (-2146875375 CERTSRV_E_KEY_LENGTH)"

The Network Device Enrollment Service (NDES) provides a way for devices that do not have an identifier in Active Directory (for example, network devices such as routers, switches, printers, thin clients, or smartphones and tablets) to request certificates from a certification authority. For a more detailed description, see the article "Network Device Enrollment Service (NDES) Basics„.

In addition, the NDES server logs the following event:

The Network Device Enrollment Service cannot submit the certificate request (The public key does not meet the minimum size required by the specified certificate template.).  0x80004005

Cause

Do you know TameMyCerts? TameMyCerts is an add-on for the Microsoft certification authority (Active Directory Certificate Services). It extends the function of the certification authority and enables the Application of regulationsto realize the secure automation of certificate issuance. TameMyCerts is unique in the Microsoft ecosystem, has already proven itself in countless companies around the world and is available under a free license. It can downloaded via GitHub and can be used free of charge. Professional maintenance is also offered.

This error occurs if the key length in the certificate request is less than configured in the certificate template configured for the NDES server. Thus, either the "Minimum Key Length" in the certificate template must be reduced, or a new certificate request with a sufficiently large key must be formed and sent to the NDES server.

Related links:

• Requesting certificates via Network Device Enrollment Service (NDES) fails with error message "The operation timed out 0x80072ee2 (WinHttp: 12002 ERROR_WINHTTP_TIMEOUT)".
• Overview of Windows events generated by the Network Device Enrollment Service (NDES).