Problem with Certificate Services for EAP-TLS authentication

Question

I am trying to enroll iOS devices via SCEP using Certificate Services. Devices are failing to get the correct attributes for certificates, namely "NT Principal Name". I have one user that it's working properly, but the rest of my users it's not. Any reason why I am getting it to work for one user but not the rest?

TIA!

Answer 1

I have identified the problem to be between our MDM solution and AD.

Answer 2

Hello Matthew Vaughan- [O365],

Good day!

Based on the decryption "Only missing attribute of "NT Principal Name" in certs.", would you please provide the screenshot about it?

So you can enroll certificate the successfully, but you can not use such certificate normally, am I right?

Best Regards,
Daisy Zhou

Answer 3

1. Attributes are same for working user and non-working user
2. Security group has permissions to read and enroll certs.
3. Permissions for cert template is set properly.
4. There are no cert failures. Only missing attribute of "NT Principal Name" in certs.

Answer 4

Hello Matthew Vaughan- [O365],

Thank you for posting on the Microsoft Community Forum.

1.Where and how you set "NT Principal Name" when you enroll iOS device certificates?

2.Please check how to set "NT Principal Name" correctly?
3.Please perform the same steps on non-working user as working user.
4.Can you enroll certificate successfully? Or maybe you can not enroll certificate successful?

5.Or maybe you can enroll certificate successfully, but can not use it successfully with any error message?

Based on your description, here are some suggested steps to help you diagnose and troubleshoot the issue:

1. Check User Attributes: Ensure that the attributes of the user object are configured correctly in Active Directory. Particular attention is paid to attributes related to certificate requests, such as Common Name (CN), Organization (O), and so on. Ensure that these attributes are consistent with the requirements of the certificate template.
2. Check the security group that the user belongs to: Make sure that all users belong to the same security group that has access to the certificate service and the permission to request certificates. In Active Directory, check the security group that the user belongs to ensure that there are no restrictions associated with certificate requests.
3. Permissions for the certificate template: Check the permission settings for the certificate template to make sure that all users have the appropriate permissions. In the Certificate Authority Management Console, edit the certificate template related to SCEP to view read and request permissions.
4. Certificate Request Logs: View the certificate request logs on the certificate authority server for details about the failed requests. Compare the requests of users who work with those that don't work to see if there are any significant differences.

I hope you the information above is helpful.

If you have any questions or concerns, please do not hesitate to let us know.

Best Regards,

Daisy Zhou