• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 1776
  • Last Modified:

Cannot Request Domain Controller Certificate from Domain Controller

Hi all,

I am currently having an issue where I cannot request a domain controller certificate from my AD integrated enterprise CA that's running on a Windows 2003 server. I am attempting to request it from another domain controller since its certificate expired. When I attempt to request it I get the following error:

The certificate request failed because of one of the following conditions:
-The certificate request was submitted to a Certification Authority (CA) that is not started.
-You do not have the permissions to request certificates from the available CAs.

All other machines and users are able to request certificates. I am requesting the certificate as a domain admin.

Any help would be greatly appreciated. Thank you!
0
sandvine
Asked:
sandvine
1 Solution
 
markpalinuxCommented:


Been there done that.

Here you go,  I will make a guess last time you needed to get a cert for a DC your CA was running Windows 2003 without SP1 and now the CA is running 2003 SP1.

Look at the following from Technote from MS:

    Description of the changes to DCOM security settings after you install Windows Server 2003 Service Pack 1
    http://support.microsoft.com/kb/903220/en-us

Look at the section that starts "If the certification authority is installed on a domain controller"

I think I ended up doing  Run, and then type dcomcnfg - look at the DCOM Config Cert Request and gave the everyone group local and remote access, I have a child domain (CA in parent) it was trying to get a SSL cert for a child domain dc that caused me to come across this in the past.

I do not have detailed notes on each step I took and I think I could have done things differently but I was in a bind.

Good luck, let me know if you have questions. If you can detail anything you do here for others and to share with me so I could review my config.

Thanks,
Mark
0
 
sandvineAuthor Commented:
Thank you for your response Mark. After reading through that article I was able to get a domain controller certficiate within minutes. Thanks again.
0

Featured Post

Free Tool: Path Explorer

An intuitive utility to help find the CSS path to UI elements on a webpage. These paths are used frequently in a variety of front-end development and QA automation tasks.

One of a set of tools we're offering as a way of saying thank you for being a part of the community.

Tackle projects and never again get stuck behind a technical roadblock.
Join Now