Link to home
Start Free TrialLog in
Avatar of EnjoyNet
EnjoyNetFlag for United States of America

asked on

Certificate Request doesn't sit in pending folder

We have a certificate authority server in Windows 2016.  After I created a web server certificate request from my web server and submit it to CA, the certificate was issued right away and CR didn't sit in pending folder and wait for issuing.  

Thank you so much for your help in advance.

EN
Avatar of Rich Weissler
Rich Weissler

Yes, that's right.

Oh wait.  Presumably that isn't the desired behaviour?  You want to approve those certificates before they're issued?
Go into the Certificate Templates console... (should be able to right click Certificate Templates, and manage.)  Select the template you want a manager to approve before issuing, go to the 'Issuance Requirements' and check "CA certificate manager approval".

If you're using the quick task to issue a domain certificate from within IIS, it's apparently hard coded to using the Web Server template... and that is likely stuck at template Schema Version 1, and that won't support the Issuance Requirements.  You'll want to make a copy of the Web Server template for your environment, and promote it to a newer version... which also means you won't be able to use the task within IIS to use that template either.
Avatar of EnjoyNet

ASKER

Thank you for your advice.  I didn't see 'Issuance Requirement' by either right click on the template or in its property.  Please help.
What Schema Version is the template?  That should be on display in the center panel of the Certificate Template Console.  I suspect/assume it'll be Schema Version 1.
If that is the case, make a copy of the template (right click, 'Duplicate Template') so we don't mess up your original template.  Just making the duplicate should at least bring that template up to version 2, which will have the Issuance Requirements.  Once you have that template setup the way you want, don't forget in the Certificate Authority console, right click the Certificate Template , NEW, Certificate Template to Issue, and add the new template to your server.
I was able to duplicate the template.  But during submitting request, there are only two templates to choose, one is User and the other one is Basic EFS.  I didn't see the one I duplicated.  Thank you for your help again
*nod*  Go back to the Certificate Template Manager, in the properties on the certificate template you created, go to the security tab, and grant at least Read and Enroll permissions to you (Authenticated User, if that's what you want) (if you're creating the certificate as your user identity), or to your computer/server (if you're creating a certificate as the local machine.)
The certificate template I duplicated doesn't show in the list of Certificate Template after I gave both my login account and Authenticated User account a full right.  Please advise.
In the Certificate Authority console, right click the 'Certificate Templates' folder, 'New', 'Certificate Template to Issue', and select your new template.
It works.  Thank you so much.   After the certificate was issued, I opened it but I found that valid time is only two years.  I created it and changed it from 5 to 10 years.  Could you please advise again?
Sure thing.  I ran into this as I tried to issue extended life certificates for an issuing subordinate CA.
Keep in mind that any certificates issued by a CA can not have an expiration date after the certificate authority's certificate expiration.   I assume you aren't running into that.
I'm also assume Server 2016 hasn't change the registry values... this article gives instructions on issuing certificates with expirations out longer than two years... but was written for 2003/2008... but is the same in 2012.
It works after I changed in regedit.  Last issue I need you help is "Issue To" on certificate: My Name.  How can I change it to IT or something else?

I really appreciate your help.
ASKER CERTIFIED SOLUTION
Avatar of Rich Weissler
Rich Weissler

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
Thank you so much for your help.  You are really a CA expert.
I don't know somehow I saw 0 points to give him.  I want to give him a max point for his help.  How can I do?  Thanks
I think he gets 1000 points.  Thanks