Unable to sign CSR with Microsoft Windows CA

Question

Hello Guys,

I have created CSR (using the blow guide) for one of our NPS servers.
https://documentation.meraki.com/zGeneral_Administration/Other_Topics/Creating_an_Offline_Certificate_Request_in_Windows_Server

When trying to sign it with our CA I receive the following error:

The DNS name is unavailable and cannot be added to Subject Alternate Name.
0x8009480f (-2146875377 CERTSRV_E_SUBJECT_DNS_REQUIRED)
Denied by the Policy Module

I have tried to put different values in SAN during CSR creation but no luck,
I have tried and not to put anything in SAN field during CSR creation but no luck,
I have checked the record in AD and found server with correct fqdn,
I have tried different templates

I am wondering if any of guys might have an idea,

Regards,
Przemek

Answer 1

Hello @Przemyslaw Wawrzyczny ，

Thank you for posting here.

Based on the description, I did some tests in my lab.

I can enroll certificate through web page successfully.

Here are the steps for your references.

Step 1.On the CA server, duplicate one specific certificate template based on your needs and requirements.

For example:
RAS and IAS server

Subject Name tab
Select “Supply in the request”

Tip: we must select “Supply in the request” under subject name tab, then we can see this certificate template through web page.

Security tab
Authenticated Users: Read permission
Domain Computers or sepcific machine name: Read and Enroll permission
RAS and IAS servers: Read and Enroll permission

Step 2.Issue certificate template on the CA server.

Step 3.Create CSR file

1.On the machine we want to request certificate using RAS and IAS server certificate template, open certlm.msc and create CSR file as below.

2. Click "Next" button.
   

3.Select the certificate template.

4.Supply the subject and SAN (we must supply subject and SAN here).

5.Save the CSR file.

Step 4.Open IE and type http://machine.b.local/certsrv/( or https://machine.b.local/certsrv/) and click Enter.

Tip: Machine is the computer name with Certification Authority Web Enrollement role installed.

Step 5. Request certificate with CSR file created above (copy the content of CSR file and paste here).

Step 6. we can see the certificate we requested.

Hope the information above is helpful.

Best Regards,
Daisy Zhou

============================================

If the Answer is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.