Microsoft CA - Certificate Authority Web Enrollment Access Issue

Question

I have an Intermediate CA running on Server 2019 with the Certificate Authority Web Enrollment Service installed. I have a user trying to access the certsrv site and is receiving a 403 error.

The application pool is set to use the built-in applicationpoolidentity and certserv authentication is set to use anonymous authentication using IUSR.

At the server level in IIS, it has Active Directory Client Certificate Authentication and Anonymous Authentication enabled.

Why would this user be getting a "403: Access is denied" error? How do I fix this?

Answer 1

Hello,

Thank you for posting in Q&A forum.

A 403 error generally means that the server understood the request but refused to authorize it. Given the setup you describe, there may be a few different issues at play. Here are some steps you can take to diagnose and potentially resolve the issue:

1. Review physical path permissions:

Make sure the 'C:\Windows\System32\CertSrv' folder and all its subfolders and files have read access for 'IUSR' and the application pool identity (e.g. 'ApplicationPoolIdentity').

2. Verify site-level authentication settings in IIS:

Make sure that in the authentication settings for the 'certsrv' site, 'Anonymous Authentication' is enabled and other authentication methods such as 'Active Directory Client Certificate Authentication' are disabled.

3. Application Pool Settings:

In IIS, make sure the application pool is set to use the 'ApplicationPoolIdentity' identity. Under 'Application Pools', select the relevant application pool, click 'Advanced Settings', and make sure the 'Identity' field is 'ApplicationPoolIdentity'.

4. Check IIS logs: Logs are usually in the path 'C:\inetpub\logs\LogFiles', look for the log entry corresponding to the 403 error to get more information about the error.
5. Local Security Policy: Open the 'Local Security Policy' manager ('secpol.msc'), in 'Local Policies > User Rights Assignment', make sure 'IUSR' and 'ApplicationPoolIdentity' have the permissions 'Access this computer from the network' and 'Log on locally'.
6. IIS Role Services: Make sure all necessary IIS role services are installed and configured correctly, especially those that the Web Enrollment service depends on.

I hope the information above is helpful.

Best Regards,

Yanhong Liu

============================================

If the Answer is helpful, please click "Accept Answer" and upvote it.