I need to renew my exchange server's iis certificate. I generate the request on the exchange server. I bring up the web page xxx.xxx.xxx.xxx/CertSrv and click Request a Certificate. I get the message:
No certificate templates could be found. You do not have permission to request a certificate from this CA, or an error occurred while accessing the Active Directory.
Per internet searches, I found the following suggestion:
You will need to view the Active Directory dNSHostName attribute on the following object: pkiEnrollmentService. To find this object, check the following locations:
CN=CertificateServer,CN=Enrollment Services,CN=Public Key
Services,CN=Services,CN=Configuration,DC=MyDomain,DC=com
To be able to see the dNSHostName attribute, you will have to use ADSIEdit.msc or LDP.exe.
When I try ADSI or LPD, I do not see any of the above. My ASDI shows:
Name Class Distinguished Name
CN=Builtin builtinDomain CN=Builtin,DC=MyDomain,DC=local
CN=Computers container CN=Computers,DC=MyDomain,DC=local
OU=Domain Controllers organizationalUnit OU=Domain Controllers,DC=MyDomain,DC=local
CN=ForeignSecurityPrincipals container CN=ForeignSecurityPrincipals,DC=MyDomain,DC=local
CN=LostAndFound lostAndFound CN=LostAndFound,DC=MyDomain,DC=local
CN=Managed Service Accounts container CN=Managed Service Accounts,DC=MyDomain,DC=local
OU=Microsoft Exchange Security Groups organizationalUnit OU=Microsoft Exchange Security Groups,DC=MyDomain,DC=local
CN=Microsoft Exchange System Objects msExchSystemObjectsContainer CN=Microsoft Exchange System Objects,DC=MyDomain,DC=local
OU=MyBusiness organizationalUnit OU=MyBusiness,DC=MyDomain,DC=local
CN=NTDS Quotas msDS-QuotaContainer CN=NTDS Quotas,DC=MyDomain,DC=local
CN=Program Data container CN=Program Data,DC=MyDomain,DC=local
CN=System container CN=System,DC=MyDomain,DC=local
CN=TPM Devices msTPM-InformationObjectsContainer CN=TPM Devices,DC=MyDomain,DC=local
CN=Users container CN=Users,DC=MyDomain,DC=local
CN=Infrastructure infrastructureUpdate CN=Infrastructure,DC=MyDomain,DC=local
Am I missing something?
ASKER
certreq -submit \\svrxx\svrxxd\td\exchiis.
I get a panel asking me which CA to use, MyDomain-SVRXX-CA or MyDomain-SVRXX-CA-1, both on computer SVRXX.MyDomain.local. I dont know why it thinks I have 3 CA's. Is there a way I can clean up, delete one of them? I choose the newer one, -CA-1. I then get the error:
Certificate not issued (Denied) Denied by Policy Module 0x80094801, The request does not contain a certificate template
extension or the CertificateTemplate request attribute.
The request contains no certificate template information. 0x80094801 (-2146875391 CERTSRV_E_NO_CERT_TYPE)
Certificate Request Processor: The request contains no certificate template information. 0x80094801 (-2146875391 CERTSRV
_E_NO_CERT_TYPE)
Denied by Policy Module 0x80094801, The request does not contain a certificate template extension or the CertificateTem
plate request attribute.
Is the request command correct? I simply asked for a renewal when I made the request file. Is there something else I need to to?
Thanks.