Re: Windows 2003 - Child domain cannot request certificate from root domain

The main thing is that you have to modify the permissions on the certificate templates you wish to issue.
By default, permissions assume a single domain forest.
You must change the permissions to allow users and computers from a child domain to request certificates from the CA>
- The certificate templates are edited using the Certificate Templates console (certtmpl.msc)
- By default, only Enterprise Admins and forest root Domain Admins have the permissions to edit the certificate templates.
- The certificate templates are stored in the Configuration naming context and replicated to all DCs in the forest (requiring the use of either global groups or universal groups for the permission assignments.

You can use of of two permission strategies.
1) Create a custom global group in each domain to represent the target users or target computers for the certificate template. Add both groups (based on the fact that you state you have a root domain and a child domain), and assign each group Read and Enroll permissions.
2) Create a custom global group in each domain to represent the target users or target computers for the certificate template. Add each global group to a custom universal group and assign the universal group Read and Enroll permission for the certificate template.

Brian

"JulioHM" <juliohm@xxxxxxxxx> wrote in message news:c608d1e5-9e29-45ef-b721-d981f9b89963@xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
Hi,

We have a forest setup (all servers are win2003) where we have one
root domain controller (actresses.net) and one child domain
(hot.actresses.net) controller.

Root domain has an Enterprise CA installed, and we are trying to allow
computers in the child domain to request certificates from the root
domain. We keep getting the same error message, no matter what we try.

After following the Certificate Request Wizard in the MMC Certificate
snap-in, the following error message appears.


---------------------------
Certificate Request Wizard
---------------------------
The certificate request failed because of one of the following
conditions:
- The certificate request was submitted to a Certification
Authority (CA) that is not started.
- You do not have the permissions to request certificates from the
available CAs.
---------------------------
OK
---------------------------


Apparently, as we have googled around, this message seems to have
several possible reasons to show up. We've tried changing all kinds of
permissions everywhere (templates, active directory) but without any
luck.

Would anyone have any clue of how work around this?

Any help is apreciated.

Thanks
Julio

.

Relevant Pages

  • Re: Cant decrypt w/admin acct
    ... >>First off you need to rule out a permissions problem. ... >>Run mmc and select the certificate snapin for user and go ... >>used to decrypt the files. ... The certificate is a "key pair" in that the certificate is used to encrypt the files ...
    (microsoft.public.win2000.security)
  • Re: Windows 2003 - Child domain cannot request certificate from root domain
    ... It sounds like you have replication problems ... permissions on the certificate template you want to use. ...
    (microsoft.public.windows.server.security)
  • Re: HttpListener, SSL Certificates, Sever and client certificate a
    ... One thing to look out for is that files underneath the "keys" directory do ... NOT inherit permissions from the folder, so the ACL change you made there ... Certificate Services: ...
    (microsoft.public.dotnet.security)
  • Re: Certificate Renewal minimum requirements
    ... > permissions are granted user always must have enroll permissions too. ... > able to enroll smart card user certificates by themselves. ... The solution is to use two certificate templates. ...
    (microsoft.public.windows.server.security)
  • Re: Certificate Web enrollment pages
    ... Check the account the web server is running under - does it have permissions ... > able to request a certificate using a form. ... > the following error message - "No certificate templates could be ...
    (microsoft.public.win2000.security)