After installing or migrating a certificate authority to a new server, you can no longer publish your own certificate templates

Author Uwe GradeneggerPosted on Categories Active Directory, TroubleshootingTags , ,

Assume the following scenario:

The Certification Authority will use the Event no. 126 log.

Current information about advanced features supported by this Certification Authority is not available from the domain controller. Stop and restart Certificate Services in order to update this information. Element not found. 0x80070490 (WIN32: 1168 ERROR_NOT_FOUND)

Cause

Do you know TameMyCerts? TameMyCerts is an add-on for the Microsoft certification authority (Active Directory Certificate Services). It extends the function of the certification authority and enables the Application of regulationsto realize the secure automation of certificate issuance. TameMyCerts is unique in the Microsoft ecosystem, has already proven itself in countless companies around the world and is available under a free license. It can downloaded via GitHub and can be used free of charge. Professional maintenance is also offered.

Up to Windows Server 2008 R2 there was a distinction whether one had installed the "Standard Edition" or the "Enterprise Edition" (for Windows 2000: Advanced Server) of the operating system. Only if the certificate authority was installed on the "Enterprise Edition" of the operating system could you use your own certificate templates.

Do not confuse the terms "Enterprise Edition" and "Enterprise Certification Authority". In the first case the variant of the operating system is meant, in the second case the installation type of the certification authority.

The distinction whether "Standard Edition" or "Enterprise Edition" is realized by a flag on the pKIEnrollmentService object. An Active Directory Enterprise CA should have the following flags set:

  • CA_FLAG_SUPPORTS_NT_AUTHENTICATION (0x2)
  • CA_FLAG_CA_SERVERTYPE_ADVANCED (0x8)

So the resulting value in the "flags" attribute on the pKIEnrollmentService object of the certification authority should be "10". For example, if the value is set to "2", the CA_FLAG_CA_SERVERTYPE_ADVANCED Flag not set.

There is also the possibility to have the values resolved with the following command line command:

certutil -v -ds "{common-name-of-the-CA}" flags

Also, when migrating the certification authority (which involves reinstalling the certification authority role on the new server), the CA_FLAG_CA_SERVERTYPE_ADVANCED flag may no longer be set.

You can change the value directly in the ADSI editor or with the following command line command on the certification authority, which updates the "flags" attribute at the next start of the certification authority service:

certutil -setreg CA\SetupStatus +SETUP_UPDATE_CAOBJECT_SVRTYPE

In both cases, the certification authority service must be restarted so that the changed settings are read in.

Now the flag should be resolved correctly and the custom certificate templates should be selectable for publishing.

Related links:

External sources

en_USEnglish
de_DEDeutsch en_USEnglish