When attempting to contact a server running the Certification Authority Web Enrolment role, you may see the following error.
In order to complete certificate enrolment, the Web site for the CA must be configured to use HTTPS authentication
Solution
The correct fix is to set the web server (IIS) to serve the certificate website securely using https, though you can just set Internet explorer to ‘work’ from your client machine if you are in a hurry.
Make Internet Explorer Accept Your Certification Authority
Note: This would need to be done on every machine that you wanted to access the Certificate Services web portal from.
1. From within Internet Explorer > Internet Options > Security > Trusted Sites > Sites.
2. Untick ‘Require server verification (https:) for all sites in this zone’ > Then add in the URL of the CA > Close.
3. With Trusted sites still selected > Custom level > ‘Initialize and script ActiveX controls not marked as safe for scripting’ > Enable > OK > Yes.
4. Restart the browser and try again.
Set IIS to serve Certificate Services Securely (via https).
This assumes you have your CA and the web portal installed correctly.
1. On the Certificate Services Server > Launch IIS Manager > Expand {server-name} > Sites > Default Web Site > Right Click > Edit Bindings > https > Edit > Select the self signed server certificate [NOT the CA ONE] > OK.
Note: If https is missing simply add it!
2. Expand Default Web Site > Certsrv > SSL Settings.
3. Tick ‘Require SSL’ > Apply.
4. That should be all you need, if it does not take effect straight away then drop to command line and run iisreset /noforce.
Related Articles, References, Credits, or External Links
I was configuring a ADCS (Active Directory Certificate Services) on a DC (Domain Controller) for a client today and wanted to setup web-enrolment. I gave the Certificate Service User permissions to the IIS_USRS Group and everything was going well. Then, this error popped up when assigning the service account in setup.
Solution
This can be easily fixed, just follow these instructions and then you will be cooking on gas! (Remember I am on a domain controller)
Go to Active Directory Users and Computers (dsa.msc) Locate the ‘Builtin’ container > then the Administrators group > and add your server account.
REALY: Yes, you need the right to ‘Log on Locally’, and remember this is a Domain Controller, try adding that right manually though GPO, its restricted.
So, when you try and authenticate for the Service Account in setup, it will come up with no errors
To prove that it’s not all smoke and mirrors, here is the user authenticated,
Related Articles, References, Credits, or External Links
I spun up a new Certificate Services server on my test network today, because I needed to issue some certificates for something I’m working on. It was a pretty vanilla build, just the Certificate Services role, and the Web Enrollment feature.
Solution
I spent a while searching this one down, as you can see (above) it was showing me the root cause of the problem. The page you normally see when you log into the web portal is default.asp, and that file is not in that folder.
1. Open IIS manager and then open the settings for the CertSrv virtual directory. Use the browse button to change the location.
2. Change the location to the sub folder en-US (or if you are in a different locale select your local one). > OK > OK.
3. Restart the web services and try again.</p?
Related Articles, References, Credits, or External Links
When you setup SBS2008 (and Exchange 2007) it creates and uses a self signed certificate, which is fine. But by default it only lasts two years. The best option is to buy a proper certificate, but if you simply want to generate a new one here’s how to do it.
Solution
1. Here you can see your certificate has expired.
2. Normally you need to access your certificate services web enrolment console to carry this procedure out. But when you navigate to https://localhost/certsrv you will probably see this:
Server Error in Application “SBS WEB APPLICATIONS”
Note: If web enrolment is installed, and you still cant access certificate services (CertSrv) then click here
3. You are seeing this error because certificate services might be installed, but the “Certificate Authority Web Enrolment” role service is not, you can add it from server manager.
4. Select it and follow the on screen prompts > Go and have a coffee.
5. Now you should be able to access the web front end.
6. To get a certificate we need a certificate request, you can write the powershell yourself like so:
[box] New-ExchangeCertificate -GenerateRequest -Path c:mail_yourpublicdomianname_co.csr -KeySize 2048 -SubjectName “c=gb, s=Your State COunty, l=Your City, o=Your Org, ou=Your Department, cn=mail.yourpublicdomianname.com” -PrivateKeyExportable $True [/box]
OR simply go here and let the good folk at Digicert do the heavy lifting for you.
7. Now you have the code, generate the request, on the Exchange server > Start > All Programs > Microsoft Exchange Server 2007 > Exchange Management Shell > Execute the command you copied above.
8. This will dump the request on the C: drive (because in your command above you set the path to C:mail_yourpublicdomianname_co.csr) Locate it and open it with Notepad. Then select and copy ALL the text (copy as shown no extra spaces etc.)
9. If you have closed it down log into certificate services web access. Select “Request Certificate” > We will be submitting an advanced certificate request.
10. “Submit a certificate request by using………..”.
11. Paste in the text you copied at step 8, change the certificate template to “Web Server” > Submit.
12. Download the certificate.
13. Save it somewhere you can find it (the root of the C: drive is easiest, as you are going to be referencing it in a command shortly).
14. Job done, close the browser window.
15. Back at the Exchange Management Shell issue the following command:
It will ask you for the thumbprint > paste it in > when prompted enter “A” to confirm all.
17. That’s the job finished.
SBS2008 Unable to access Certificate Services
I’ve seen this on a few SBS2008 Servers, when you install the web enrolment service it installs into the servers “Default Web Site”, For any other Windows/Exchange combo that’s fine but SBS likes to do things its own way. It creates another web site called “SBS Web Applications” and uses that. That’s fine, but only one can be up and running at a time.
CertSrv The Webpage cannot be found
1. Warning: You are about to stop things like OWA briefly. From Administrative tools launch the Internet Information Services (IIS) Manager > Locate the SBS Web Applications site and click stop (right hand column) > then select the Default Web site and start it.
2. Select the CertSrv virtual directory.
3. You can now browse via http/https and this will open the site in your default browser. Don’t forget to stop the Default website, and restart the SBS Web Applications site when you are finished.
Related Articles, References, Credits, or External Links
Cisco ISE arms itself with a self generated certificate out of the box, (well the NFR appliance does anyway). To replace that cert with one signed by your own CA, this is the procedure. (Note: I’m using Microsoft Certificate Services on Server 2012 R2).
Solution
Step 1: Import the CA Certificate into ISE
Note: If you have a lot issuing servers it’s a good idea the repeat this procedure for EVERY issuing server you have in your PKI environment. Assuming you have an off-line root that would be every SubCA (to use Microsoft terminology). On my test network I only have one so that’s not a problem.
1. Connect to the web enrollment portal of your Certificate services folder > Download a CA Certificate, certificate chain, or CRL.
9. Again save it somewhere you can find it easily.
10. Open the PEM file you just created, and copy all the text to the clipboard.
11. Back at you web enrollment portal > Request a certificate.
12. Advanced certificate request.
13. Submit a certificate request by using…
14. Paste in your copied text (make sure no spaces get added to the end, this usually happens, be careful) > Set the template to Web Server (of your own template, if you are not using the default one) > Submit.
15. Select DER encoded > Download certificate > Save it with a name that is recognizable as the ISE appliance.
16. On the ISE web portal > Local Certificates > Add > Bind CA Signed Certificate.
17. Browse to the new cert > Select EAP and HTTPS > Submit.
18. Now remember to connect to the ISE appliance using its FQDN (you did remember to create a record in DNS for it didn’t you?)
At this point if you get an error either the URL is wrong, or you didn’t create a DNS record, or the machine you are on does not trust your issuing servers root certificate.</p?
Related Articles, References, Credits, or External Links
