Certificate web enrollment HTTP 500 errors

Question

Certificate web enrollment pages now return HTTP 500 errors

The issue started after an IIS update on the CA server. I'm not sure whether an IIS or ASP.NET module is causing it. The AD CS Web Enrollment pages are currently unavailable

I would appreciate any help for this issue.

Answer 1

Hi Sofia Costa

When the certificate web enrollment pages start throwing HTTP 500 errors right after an IIS update, it usually points to a broken dependency in IIS or ASP.NET. The first thing I’d suggest is checking the IIS logs and the Windows Event Viewer to see which module is failing often it’s the ASP.NET role services or the ISAPI filters tied to AD CS. If you recently patched IIS, double‑check that the Web Enrollment role service is still installed and hasn’t been disabled. Sometimes re‑registering ASP.NET with IIS (aspnet_regiis -i) clears up the mismatch. Another quick win is recycling the application pool for the CertSrv site, since stale configs can cause 500s. If that doesn’t help, verify that the CA server’s permissions on the CertSrv virtual directory are intact updates can reset ACLs. Worst case, you may need to remove and re‑add the AD CS Web Enrollment role, but that’s usually a last resort.

So: start with logs, confirm role services, recycle the app pool, and re‑register ASP.NET if needed.

If this guidance helps you get the pages back online, please hit “accept answer” so others know it worked for you.