AEPolicy – Uwe Gradenegger

Smartcard login fails with error message "A certification chain processed correctly, but one of the CA certificates is not trusted by the policy provider. 0x800b0112 (-2146762478 CERT_E_UNTRUSTEDCA)"

Assume the following scenario:

The company would like to use smartcard logon.
The domain controllers are equipped with certificates that can be used for smartcard logon.
The users are equipped with certificates that can be used for smartcard logon.
The login to the domain via smartcard fails with the following error message:

A certification chain processed correctly, but one of the CA certificates is not trusted by the policy provider. 0x800b0112 (-2146762478 CERT_E_UNTRUSTEDCA)

What happens if a user has requested multiple certificates?

I recently encountered the phenomenon that due to a faulty request logic, several users had made new certificate requests at regular intervals.

The certificate template was configured to have incoming certificate requests released by a certificate manager, i.e. the certificates were not issued automatically. The certificate requests were to be checked by a separate code and then released.

One would now expect that (since all certificate requests would eventually be approved) users would now find multiple certificates of the same type in their certificate store (and the applications that use it). However, this was not the case.

The local certificate store for trusted root certificate authorities is not synchronized from Active Directory

Assume the following scenario:

A certification authority hierarchy is established in the network and the root certification authority is mapped in the configuration partition of the Active Directory forest.
Domain members are configured to run the autoenrollment process to update trusted root certificate authorities from the Configuration partition.
However, this process does not work for some clients. The root CA certificates are not automatically downloaded and entered into the local trust store.
As a consequence certificate requests can failbecause, for example, the certification authority hierarchy is not trusted.

Troubleshooting for automatic certificate request (autoenrollment) via RPC/DCOM (MS-WCCE)

Assume the following scenario:

A certificate template is configured for automatic certificate request (autoenrollment).
The certificate template is published on a certification authority (Enterprise Certification Authority) integrated into Active Directory.
However, the users or computers configured for automatic Certificate Enrollment do not apply for certificates as intended.

The following is a troubleshooting guide.

Basics of manual and automatic certificate requests via Lightweight Directory Access Protocol (LDAP) and Remote Procedure Call / Distributed Common Object Model (RPC/DCOM) with the MS-WCCE protocol

The following describes the process that runs in the background when certificates are requested manually or automatically in order to achieve the highest possible level of automation.