Problem with CA Web Enrolment in Windows Server 2022

Question

Hello,

Every time I deploy Exchange Server I need to create and install a web server certificate on the mail server: for this the copy of the built-in Web Server certificate template is made and - after minor modifications - the Exchange Server's certificate must be created based on that modified certificate template. I've never had any issues when doing it. Now when I deployed the WinServer 2022 DC for the first time and installed the CA and the Web Enrollment on it I got this:

1) if I try to request the Exchnage Server's certificate (on the https://dc.domain.com/certsrv) from the DC - I see only the two certificate templates:

2) when I connect to the same page from the exchange server I see more certificate templates...

...including the buil-it Web Server certificate template - but still does NOT see the Contoso Web Server certificate which is the copy od the built-in Web Server certificate!

...don't have any ideas what can be wrong here... :(

Answer 1

Hi SamWu,

"It is difficult to reproduce your problem based on this messageemphasized text" - why? If there's a Windows Server
2022 DC+CA at hand it's a matter of minutes to reach for the https://dc.../certsrv and at least to see whether the Web Server template is available or not -any domain admin must see this template...

Answer 2

P.S. Can anyone tell me what defines whether the certificate template is available for selection on the wewb enrollment page or not?
I know only one parameter - the Security settings (Read+Enroll). Is there any else?

Answer 3

Hi SamWu-MSFT,

"what is the version of the Contonso Web Server template? Only v1 and v2 templates are allowed in Web Enrollment Pages" - v4 (this time I've selected Windows Server 2016 on the template's properties page).

After re-issuing the template as v2 it did not appear in the template's list until I've granted Authentication Users the Read and the Enroll permissions, which I've never done before! So you were right - v4 don't work at all ALTHOUGH THE ARTICLE YOU MENTIONED ABOVE APPLIES ONLY TO Windows Server 2008/2012!!!

There's, however, one question left: why do the different templates show up differently on the Web Enrollment page?

In other words: why does the Web Server template not require the Authentication Users\Enroll permission while the copy (v2) of this template - Contoso Web Server does require? I'm requesting those certificates as domain\enterprise admin so theoretically I should NOT need the extra permission for the Authenticated Users group (and I've never done it before)?

Answer 4

You really should NOT grant authenticated users enroll right, this would mean that anyone can issue a certificate. Perhaps try to add Enroll right directly to your account, or specific group, try to avoid using groups that need elevated application rights (UAC).

Martin

Answer 5

"You really should NOT grant authenticated users enroll right, this would mean that anyone can issue a certificate." - I know but in WinServer 2022 it was the only method to issue a certificate - maybe it's a bug, I'm opening a case with MS right now.